Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 21:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    3.1MB

  • MD5

    aefbd9e285960b704524b4c33b0c9567

  • SHA1

    688eb719525b89f93db7d22bcbae38a13e7a973b

  • SHA256

    bc240f565f4a4aab03cdf04b6ae4522179347145e338ef33df918e741afc5ebb

  • SHA512

    9186ca00f1451b750f59bc999e696964866639a06018e4ad241dd5ddf85550ffdd370d91e72f45a04644f555c150021383e16b29f7c0c27cb8b7cf9465e0ad8f

  • SSDEEP

    49152:iIUtVtTZ0pIj3/bL4zoK79ucME+bkhG+WA73nilkwo:iIkVtTZ0pIj3vK79ucL+b9A73R

Score
10/10
amadeygcleanergurculummastealcvidar9c9aa5stokcredential_accessdiscoveryevasionexecutionloaderpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=7427009775

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 3 IoCs
    stealer
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    evasion
  • Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Looks for VMWare drivers on disk 2 TTPs 3 IoCs
    evasion
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 44 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 13 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 7 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Kills process with taskkill 6 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 56 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3352
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3016
      • C:\Users\Admin\AppData\Local\Temp\1019345001\0KGPkVX.exe
        "C:\Users\Admin\AppData\Local\Temp\1019345001\0KGPkVX.exe"
        3⤵
        • Looks for VirtualBox drivers on disk
        • Looks for VMWare drivers on disk
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2860
          • C:\Windows\system32\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1332
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1588
          • C:\Windows\system32\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3648
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4724
          • C:\Windows\system32\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:5100
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4332
          • C:\Windows\system32\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3364
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4964
          • C:\Windows\system32\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3748
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5108
          • C:\Windows\system32\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:464
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4048
          • C:\Windows\system32\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4412
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          4⤵
            PID:4120
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            4⤵
              PID:3184
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic cpu get ProcessorId,Name,SerialNumber /format:csv"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3136
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic cpu get ProcessorId,Name,SerialNumber /format:csv
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1504
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid,IdentifyingNumber,Name /format:csv"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2964
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic csproduct get uuid,IdentifyingNumber,Name /format:csv
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4268
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic bios get SerialNumber,Name /format:csv"
              4⤵
                PID:2996
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic bios get SerialNumber,Name /format:csv
                  5⤵
                    PID:2140
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe /C taskkill /F /PID 2280 & del /f /q "0KGPkVX.exe"
                  4⤵
                    PID:4568
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /PID 2280
                      5⤵
                      • Kills process with taskkill
                      PID:3468
                • C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe
                  "C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3884
                  • C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe
                    "C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:4324
                  • C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe
                    "C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:1376
                  • C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe
                    "C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe"
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2632
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 316
                    4⤵
                    • Program crash
                    PID:2028
                • C:\Users\Admin\AppData\Local\Temp\1019563001\hYW0tgm.exe
                  "C:\Users\Admin\AppData\Local\Temp\1019563001\hYW0tgm.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3672
                • C:\Users\Admin\AppData\Local\Temp\1019610001\murrgHN.exe
                  "C:\Users\Admin\AppData\Local\Temp\1019610001\murrgHN.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:3648
                  • C:\Users\Admin\AppData\Local\Temp\1019610001\murrgHN.exe
                    "C:\Users\Admin\AppData\Local\Temp\1019610001\murrgHN.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:3424
                  • C:\Users\Admin\AppData\Local\Temp\1019610001\murrgHN.exe
                    "C:\Users\Admin\AppData\Local\Temp\1019610001\murrgHN.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:3388
                  • C:\Users\Admin\AppData\Local\Temp\1019610001\murrgHN.exe
                    "C:\Users\Admin\AppData\Local\Temp\1019610001\murrgHN.exe"
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4724
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 328
                    4⤵
                    • Program crash
                    PID:396
                • C:\Users\Admin\AppData\Local\Temp\1019663001\c238497c62.exe
                  "C:\Users\Admin\AppData\Local\Temp\1019663001\c238497c62.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3860
                • C:\Users\Admin\AppData\Local\Temp\1019664001\4eed285158.exe
                  "C:\Users\Admin\AppData\Local\Temp\1019664001\4eed285158.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:4284
                  • C:\Users\Admin\AppData\Local\Temp\1019664001\4eed285158.exe
                    "C:\Users\Admin\AppData\Local\Temp\1019664001\4eed285158.exe"
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3356
                • C:\Users\Admin\AppData\Local\Temp\1019666001\84e155f7a8.exe
                  "C:\Users\Admin\AppData\Local\Temp\1019666001\84e155f7a8.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4868
                • C:\Users\Admin\AppData\Local\Temp\1019667001\9429ed704c.exe
                  "C:\Users\Admin\AppData\Local\Temp\1019667001\9429ed704c.exe"
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1496
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "powershell.exe" Add-MpPreference -ExclusionPath "C:\xshmbbpao"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1468
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3144
                  • C:\xshmbbpao\c9835d9c36294ab7b9557e37c04bb444.exe
                    "C:\xshmbbpao\c9835d9c36294ab7b9557e37c04bb444.exe"
                    4⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1328
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\xshmbbpao\c9835d9c36294ab7b9557e37c04bb444.exe" & rd /s /q "C:\ProgramData\RIM7GLNG4OZM" & exit
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:4956
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /t 10
                        6⤵
                        • System Location Discovery: System Language Discovery
                        • Delays execution with timeout.exe
                        PID:1036
                  • C:\xshmbbpao\e0a54407a58b40dfb4e96ca953fe787a.exe
                    "C:\xshmbbpao\e0a54407a58b40dfb4e96ca953fe787a.exe"
                    4⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    PID:2964
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9MSZ40SLW145?ocid=&referrer=psi
                      5⤵
                      • Enumerates system info in registry
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:2896
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6cf146f8,0x7ffa6cf14708,0x7ffa6cf14718
                        6⤵
                          PID:2136
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5776914471223925755,10012457426670080184,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
                          6⤵
                            PID:1508
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5776914471223925755,10012457426670080184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
                            6⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3644
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,5776914471223925755,10012457426670080184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
                            6⤵
                              PID:4136
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5776914471223925755,10012457426670080184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                              6⤵
                                PID:5084
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5776914471223925755,10012457426670080184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
                                6⤵
                                  PID:2368
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5776914471223925755,10012457426670080184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
                                  6⤵
                                    PID:5248
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5776914471223925755,10012457426670080184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
                                    6⤵
                                      PID:5256
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5776914471223925755,10012457426670080184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 /prefetch:8
                                      6⤵
                                        PID:5468
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5776914471223925755,10012457426670080184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 /prefetch:8
                                        6⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5700
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5776914471223925755,10012457426670080184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
                                        6⤵
                                          PID:5844
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5776914471223925755,10012457426670080184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
                                          6⤵
                                            PID:5852
                                    • C:\Users\Admin\AppData\Local\Temp\1019668001\4f7be8292a.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1019668001\4f7be8292a.exe"
                                      3⤵
                                      • Enumerates VirtualBox registry keys
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3236
                                    • C:\Users\Admin\AppData\Local\Temp\1019669001\a1d0455ae1.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1019669001\a1d0455ae1.exe"
                                      3⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2876
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 636
                                        4⤵
                                        • Program crash
                                        PID:5892
                                    • C:\Users\Admin\AppData\Local\Temp\1019670001\d8b50e58ff.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1019670001\d8b50e58ff.exe"
                                      3⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4976
                                    • C:\Users\Admin\AppData\Local\Temp\1019671001\b7818e3bf0.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1019671001\b7818e3bf0.exe"
                                      3⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Loads dropped DLL
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Checks processor information in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:6096
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                        4⤵
                                        • Uses browser remote debugging
                                        • Enumerates system info in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        • Suspicious use of FindShellTrayWindow
                                        PID:5220
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa70a7cc40,0x7ffa70a7cc4c,0x7ffa70a7cc58
                                          5⤵
                                            PID:5340
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2340,i,12256721587067196538,15886890497849543488,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2336 /prefetch:2
                                            5⤵
                                              PID:5476
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1836,i,12256721587067196538,15886890497849543488,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2392 /prefetch:3
                                              5⤵
                                                PID:5504
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1956,i,12256721587067196538,15886890497849543488,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2568 /prefetch:8
                                                5⤵
                                                  PID:5512
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,12256721587067196538,15886890497849543488,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3100 /prefetch:1
                                                  5⤵
                                                  • Uses browser remote debugging
                                                  PID:5936
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,12256721587067196538,15886890497849543488,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3108 /prefetch:1
                                                  5⤵
                                                  • Uses browser remote debugging
                                                  PID:5864
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4488,i,12256721587067196538,15886890497849543488,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4268 /prefetch:1
                                                  5⤵
                                                  • Uses browser remote debugging
                                                  PID:3600
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                                                4⤵
                                                • Uses browser remote debugging
                                                • Enumerates system info in registry
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                PID:6880
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe8,0x108,0x7ffa6cf146f8,0x7ffa6cf14708,0x7ffa6cf14718
                                                  5⤵
                                                  • Checks processor information in registry
                                                  • Enumerates system info in registry
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:6900
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9586851348261195981,9758777957331238477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
                                                  5⤵
                                                    PID:5948
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9586851348261195981,9758777957331238477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
                                                    5⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3164
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,9586851348261195981,9758777957331238477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
                                                    5⤵
                                                      PID:6208
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,9586851348261195981,9758777957331238477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                                                      5⤵
                                                      • Uses browser remote debugging
                                                      PID:6328
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,9586851348261195981,9758777957331238477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
                                                      5⤵
                                                      • Uses browser remote debugging
                                                      PID:6336
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,9586851348261195981,9758777957331238477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
                                                      5⤵
                                                      • Uses browser remote debugging
                                                      PID:7872
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,9586851348261195981,9758777957331238477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
                                                      5⤵
                                                      • Uses browser remote debugging
                                                      PID:5648
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\DGDBKFBAKF.exe"
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3864
                                                    • C:\Users\Admin\Documents\DGDBKFBAKF.exe
                                                      "C:\Users\Admin\Documents\DGDBKFBAKF.exe"
                                                      5⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      PID:7868
                                                • C:\Users\Admin\AppData\Local\Temp\1019672001\667c825207.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\1019672001\667c825207.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:5268
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /F /IM firefox.exe /T
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Kills process with taskkill
                                                    PID:5292
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /F /IM chrome.exe /T
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Kills process with taskkill
                                                    PID:5004
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /F /IM msedge.exe /T
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Kills process with taskkill
                                                    PID:2396
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /F /IM opera.exe /T
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Kills process with taskkill
                                                    PID:524
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /F /IM brave.exe /T
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Kills process with taskkill
                                                    PID:5376
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                    4⤵
                                                      PID:3164
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                        5⤵
                                                        • Checks processor information in registry
                                                        • Modifies registry class
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:5776
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {33506b9b-e3e0-4d4b-90f7-9e63b7853958} 5776 "\\.\pipe\gecko-crash-server-pipe.5776" gpu
                                                          6⤵
                                                            PID:3124
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35d7c346-5c76-4b65-9463-80500374651d} 5776 "\\.\pipe\gecko-crash-server-pipe.5776" socket
                                                            6⤵
                                                              PID:5016
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3048 -childID 1 -isForBrowser -prefsHandle 3268 -prefMapHandle 3264 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c10a8977-1c6a-4dc2-a8e4-9ec16ecbeb11} 5776 "\\.\pipe\gecko-crash-server-pipe.5776" tab
                                                              6⤵
                                                                PID:6348
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4008 -childID 2 -isForBrowser -prefsHandle 4024 -prefMapHandle 4020 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83100170-6822-4259-98ad-751b5ef6e292} 5776 "\\.\pipe\gecko-crash-server-pipe.5776" tab
                                                                6⤵
                                                                  PID:6524
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4696 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4644 -prefMapHandle 4640 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5344ac9-9743-419b-b98e-a5eec39b9e8b} 5776 "\\.\pipe\gecko-crash-server-pipe.5776" utility
                                                                  6⤵
                                                                  • Checks processor information in registry
                                                                  PID:7224
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 3 -isForBrowser -prefsHandle 5220 -prefMapHandle 5224 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {396038fb-a609-4fef-8552-363f03ca03dc} 5776 "\\.\pipe\gecko-crash-server-pipe.5776" tab
                                                                  6⤵
                                                                    PID:7772
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 4 -isForBrowser -prefsHandle 5200 -prefMapHandle 5180 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {728b5471-d32b-4078-bd7a-163851775c97} 5776 "\\.\pipe\gecko-crash-server-pipe.5776" tab
                                                                    6⤵
                                                                      PID:7784
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5572 -childID 5 -isForBrowser -prefsHandle 5576 -prefMapHandle 5580 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74387753-c7b8-4999-b013-42037f40da63} 5776 "\\.\pipe\gecko-crash-server-pipe.5776" tab
                                                                      6⤵
                                                                        PID:7820
                                                                • C:\Users\Admin\AppData\Local\Temp\1019673001\e3fbafce6b.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\1019673001\e3fbafce6b.exe"
                                                                  3⤵
                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                  • Checks BIOS information in registry
                                                                  • Executes dropped EXE
                                                                  • Identifies Wine through registry keys
                                                                  • Windows security modification
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3992
                                                                • C:\Users\Admin\AppData\Local\Temp\1019674001\aca6f31470.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\1019674001\aca6f31470.exe"
                                                                  3⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:7604
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                                                                    4⤵
                                                                      PID:8172
                                                                      • C:\Windows\system32\mode.com
                                                                        mode 65,10
                                                                        5⤵
                                                                          PID:2956
                                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                                          7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:1620
                                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                                          7z.exe e extracted/file_7.zip -oextracted
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:2688
                                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                                          7z.exe e extracted/file_6.zip -oextracted
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:3560
                                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                                          7z.exe e extracted/file_5.zip -oextracted
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:2492
                                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                                          7z.exe e extracted/file_4.zip -oextracted
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:6708
                                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                                          7z.exe e extracted/file_3.zip -oextracted
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:6084
                                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                                          7z.exe e extracted/file_2.zip -oextracted
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:1984
                                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                                          7z.exe e extracted/file_1.zip -oextracted
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:5804
                                                                        • C:\Windows\system32\attrib.exe
                                                                          attrib +H "in.exe"
                                                                          5⤵
                                                                          • Views/modifies file attributes
                                                                          PID:6104
                                                                        • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                                                                          "in.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:4668
                                                                          • C:\Windows\SYSTEM32\attrib.exe
                                                                            attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                                            6⤵
                                                                            • Views/modifies file attributes
                                                                            PID:6140
                                                                          • C:\Windows\SYSTEM32\attrib.exe
                                                                            attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                                            6⤵
                                                                            • Views/modifies file attributes
                                                                            PID:6136
                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                            schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                                                                            6⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:5688
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell ping 127.0.0.1; del in.exe
                                                                            6⤵
                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                            PID:5544
                                                                            • C:\Windows\system32\PING.EXE
                                                                              "C:\Windows\system32\PING.EXE" 127.0.0.1
                                                                              7⤵
                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                              • Runs ping.exe
                                                                              PID:6772
                                                                    • C:\Users\Admin\AppData\Local\Temp\1019675001\2c7ba07bed.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\1019675001\2c7ba07bed.exe"
                                                                      3⤵
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Identifies Wine through registry keys
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5660
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1456
                                                                        4⤵
                                                                        • Program crash
                                                                        PID:5764
                                                                    • C:\Users\Admin\AppData\Local\Temp\1019676001\377c6c447e.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\1019676001\377c6c447e.exe"
                                                                      3⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6036
                                                                      • C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe"
                                                                        4⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5628
                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\clip64.dll, Main
                                                                          5⤵
                                                                          • Blocklisted process makes network request
                                                                          • Loads dropped DLL
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2368
                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\cred64.dll, Main
                                                                          5⤵
                                                                          • Loads dropped DLL
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3812
                                                                          • C:\Windows\system32\rundll32.exe
                                                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\cred64.dll, Main
                                                                            6⤵
                                                                            • Blocklisted process makes network request
                                                                            • Loads dropped DLL
                                                                            PID:2904
                                                                            • C:\Windows\system32\netsh.exe
                                                                              netsh wlan show profiles
                                                                              7⤵
                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                              • System Network Configuration Discovery: Wi-Fi Discovery
                                                                              PID:1776
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\756129449312_Desktop.zip' -CompressionLevel Optimal
                                                                              7⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:8036
                                                                    • C:\Users\Admin\AppData\Local\Temp\1019677001\63bd6eb1d5.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\1019677001\63bd6eb1d5.exe"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Adds Run key to start application
                                                                      • Drops file in Program Files directory
                                                                      PID:4940
                                                                      • C:\Program Files\Windows Media Player\graph\graph.exe
                                                                        "C:\Program Files\Windows Media Player\graph\graph.exe"
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:3560
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3884 -ip 3884
                                                                  1⤵
                                                                    PID:4452
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3648 -ip 3648
                                                                    1⤵
                                                                      PID:3904
                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                      1⤵
                                                                        PID:3180
                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                        1⤵
                                                                          PID:2572
                                                                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                          1⤵
                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                          • Checks BIOS information in registry
                                                                          • Executes dropped EXE
                                                                          • Identifies Wine through registry keys
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:4488
                                                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                          1⤵
                                                                            PID:5116
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5660 -ip 5660
                                                                            1⤵
                                                                              PID:3812
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2876 -ip 2876
                                                                              1⤵
                                                                                PID:7488
                                                                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                1⤵
                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                • Checks BIOS information in registry
                                                                                • Executes dropped EXE
                                                                                • Identifies Wine through registry keys
                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                PID:4912
                                                                              • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                                                C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                PID:6736
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  2⤵
                                                                                    PID:8144
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                                                                    2⤵
                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                    PID:5700
                                                                                    • C:\Windows\system32\PING.EXE
                                                                                      "C:\Windows\system32\PING.EXE" 127.1.10.1
                                                                                      3⤵
                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                      • Runs ping.exe
                                                                                      PID:6032
                                                                                • C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:6812

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Reconnaissance

                                                                                Resource Development

                                                                                Initial Access

                                                                                Execution

                                                                                Command and Scripting Interpreter

                                                                                1
                                                                                T1059

                                                                                PowerShell

                                                                                1
                                                                                T1059.001

                                                                                Scheduled Task/Job

                                                                                1
                                                                                T1053

                                                                                Scheduled Task

                                                                                1
                                                                                T1053.005

                                                                                Persistence

                                                                                Boot or Logon Autostart Execution

                                                                                1
                                                                                T1547

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Event Triggered Execution

                                                                                1
                                                                                T1546

                                                                                Netsh Helper DLL

                                                                                1
                                                                                T1546.007

                                                                                Modify Authentication Process

                                                                                1
                                                                                T1556

                                                                                Scheduled Task/Job

                                                                                1
                                                                                T1053

                                                                                Scheduled Task

                                                                                1
                                                                                T1053.005

                                                                                Privilege Escalation

                                                                                Boot or Logon Autostart Execution

                                                                                1
                                                                                T1547

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Event Triggered Execution

                                                                                1
                                                                                T1546

                                                                                Netsh Helper DLL

                                                                                1
                                                                                T1546.007

                                                                                Scheduled Task/Job

                                                                                1
                                                                                T1053

                                                                                Scheduled Task

                                                                                1
                                                                                T1053.005

                                                                                Defense Evasion

                                                                                Hide Artifacts

                                                                                1
                                                                                T1564

                                                                                Hidden Files and Directories

                                                                                1
                                                                                T1564.001

                                                                                Impair Defenses

                                                                                2
                                                                                T1562

                                                                                Disable or Modify Tools

                                                                                2
                                                                                T1562.001

                                                                                Modify Authentication Process

                                                                                1
                                                                                T1556

                                                                                Modify Registry

                                                                                3
                                                                                T1112

                                                                                Virtualization/Sandbox Evasion

                                                                                5
                                                                                T1497

                                                                                Credential Access

                                                                                Credentials from Password Stores

                                                                                1
                                                                                T1555

                                                                                Credentials from Web Browsers

                                                                                1
                                                                                T1555.003

                                                                                Modify Authentication Process

                                                                                1
                                                                                T1556

                                                                                Steal Web Session Cookie

                                                                                1
                                                                                T1539

                                                                                Unsecured Credentials

                                                                                6
                                                                                T1552

                                                                                Credentials In Files

                                                                                5
                                                                                T1552.001

                                                                                Credentials in Registry

                                                                                1
                                                                                T1552.002

                                                                                Discovery

                                                                                Browser Information Discovery

                                                                                1
                                                                                T1217

                                                                                File and Directory Discovery

                                                                                2
                                                                                T1083

                                                                                Process Discovery

                                                                                1
                                                                                T1057

                                                                                Query Registry

                                                                                9
                                                                                T1012

                                                                                Remote System Discovery

                                                                                1
                                                                                T1018

                                                                                System Information Discovery

                                                                                5
                                                                                T1082

                                                                                System Location Discovery

                                                                                1
                                                                                T1614

                                                                                System Language Discovery

                                                                                1
                                                                                T1614.001

                                                                                System Network Configuration Discovery

                                                                                2
                                                                                T1016

                                                                                Internet Connection Discovery

                                                                                1
                                                                                T1016.001

                                                                                Wi-Fi Discovery

                                                                                1
                                                                                T1016.002

                                                                                Virtualization/Sandbox Evasion

                                                                                5
                                                                                T1497

                                                                                Lateral Movement

                                                                                Collection

                                                                                Data from Local System

                                                                                5
                                                                                T1005

                                                                                Command and Control

                                                                                Web Service

                                                                                1
                                                                                T1102

                                                                                Exfiltration

                                                                                Impact

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\ProgramData\DHCAAEBKEGHJKEBFHJDB
                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  a7ff8033f6c31c9da4e373fdee1ac637

                                                                                  SHA1

                                                                                  72f513eb6c517cc059afa707c535d569fc79456b

                                                                                  SHA256

                                                                                  563e403c6226fe859011799404bd8c9851c3e17ec378520821eef6820710b1db

                                                                                  SHA512

                                                                                  971d0c2232f6f5caa491802f1e24e49c90ce3d97481051ebf9f0d57bd4e71995ae5ee6d7afabb0ff2a97497f48ea6671441564e3f6ad46f52e9efa7cd3586bff

                                                                                  Download Submit

                                                                                • C:\ProgramData\mozglue.dll
                                                                                  Filesize

                                                                                  593KB

                                                                                  MD5

                                                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                                                  SHA1

                                                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                  SHA256

                                                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                  SHA512

                                                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                  Filesize

                                                                                  2B

                                                                                  MD5

                                                                                  d751713988987e9331980363e24189ce

                                                                                  SHA1

                                                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                                                  SHA256

                                                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                  SHA512

                                                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  968cb9309758126772781b83adb8a28f

                                                                                  SHA1

                                                                                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                                                  SHA256

                                                                                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                                                  SHA512

                                                                                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  2009555c0bb5f9bf2c55e65e80350eef

                                                                                  SHA1

                                                                                  667993bb8554032c3b3755b7733fd6532b0685c8

                                                                                  SHA256

                                                                                  65dfb785a61414136f5b61c4e8e9dea11d6e714917704c752bc5f67568f9f4e7

                                                                                  SHA512

                                                                                  29819a30731703e1e8ea1141314dc1931a6792c99911c60b065653be36d8f9311b2f95014338dbf5924ffdd453e6c1e6d8fca2782c443e874560beba6d777531

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  cce9e9f4b9fd8e0f9ef79f48c6dbaec4

                                                                                  SHA1

                                                                                  4fe453b717b00775adec43b84db8955e1108d8c8

                                                                                  SHA256

                                                                                  c4191c0180a10c00ab5e70dbb4c01173954a481f48c2202f59257b277868e637

                                                                                  SHA512

                                                                                  ddd6475da132aff41462af588dc4ec8702e2ca6e029f30f42f2410b061530cd535b559a4a5a3ab219e8cfdff388dbb3a25503a4d8d9fd155d9f7e80065fe5b49

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  a0486d6f8406d852dd805b66ff467692

                                                                                  SHA1

                                                                                  77ba1f63142e86b21c951b808f4bc5d8ed89b571

                                                                                  SHA256

                                                                                  c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

                                                                                  SHA512

                                                                                  065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  dc058ebc0f8181946a312f0be99ed79c

                                                                                  SHA1

                                                                                  0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

                                                                                  SHA256

                                                                                  378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

                                                                                  SHA512

                                                                                  36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
                                                                                  Filesize

                                                                                  20KB

                                                                                  MD5

                                                                                  f7d95e4f79c3019470bb074e4ce06379

                                                                                  SHA1

                                                                                  6f32c058835986e9dd9f3e2d8a9a2bf038174a1e

                                                                                  SHA256

                                                                                  f87e1f243dbdb501087fdcbfc8a743f575b251c2faa59123db04e3ad8cdce3ae

                                                                                  SHA512

                                                                                  2d3bb9081628abd20e7fbce00bee9156563e18a1dc3671fc7c4f4cfe7072f250d92e5bd3437b2bd5a6cff05a393d7f5895d8d94f3298454ca90575d1faadc0e2

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
                                                                                  Filesize

                                                                                  124KB

                                                                                  MD5

                                                                                  73b499add1498ebaa77e63b0133a15b5

                                                                                  SHA1

                                                                                  393173ce5e195aadc7a8845f7e8f132158d6eced

                                                                                  SHA256

                                                                                  b3093b023bdd205816d1ec1409a0d3504dae083ff1091ed456da5c411a17e222

                                                                                  SHA512

                                                                                  49f5fe6a46d7b0d9af33dadadee0f66b6a13107cff6298ed14ac5fbda3983fae1140a1f77e4a7ebcec5b78ae442de59dc53bad7f175ec19fe05342005c8c6572

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  Filesize

                                                                                  5KB

                                                                                  MD5

                                                                                  2fc47be36762e12835ec6a29c7d8ec73

                                                                                  SHA1

                                                                                  d422a94506adf41780cd281a0cdd2dfa10b7059a

                                                                                  SHA256

                                                                                  c2a47baedbf12fa268d5b607c69a9741b29ac4a69e0f8f3a489ff077c62e2a33

                                                                                  SHA512

                                                                                  6c2e029f972732c66065200e48e3c4d8a0b15466dfc4ae68e64fadf5fd9965787f025d0346297ff96fb92bf36d9620dfa23b0bcedb967e9ed707fdc161d8b1c1

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  Filesize

                                                                                  6KB

                                                                                  MD5

                                                                                  a450f85d073cf4aca2321fb94cf0ccd0

                                                                                  SHA1

                                                                                  ac36ae9b2358c724127698ce9d1b222b527ef5a0

                                                                                  SHA256

                                                                                  f74f3af59fec3bf455d17236142b820ef69f0419139ed4aeb962bab3e89e9d74

                                                                                  SHA512

                                                                                  a34505a82d8d4edde2c5243d07f909b0b52f2ead76f54c6ce3df26917a1961c7eb19cacf66fe3a1f8a6d14e248105461d19325d5c93b88e6201ed7210f4659b3

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  Filesize

                                                                                  6KB

                                                                                  MD5

                                                                                  645664dbac2d32230e2a2f70f69584c9

                                                                                  SHA1

                                                                                  fe1be1a856ad8732265a05b3b3daceaa51af8b4f

                                                                                  SHA256

                                                                                  889186ebba3437b263c53ebc8514b5812dd9b544fcdcd10777c7179766ecbe50

                                                                                  SHA512

                                                                                  acda6090fa2820939c9f6a088974d7aaa8736db794c33546ae812ac39af0c6fc784715c5cd76052b59bd9d13ebe706f0ed6f47a61fd551e4ba3ed844ba6df578

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
                                                                                  Filesize

                                                                                  109B

                                                                                  MD5

                                                                                  23a450de1786a4b8784c93ae72575839

                                                                                  SHA1

                                                                                  e2380781074d6151409f9c9d92b1f8c22f4cf831

                                                                                  SHA256

                                                                                  7cd76aa7348e74b1eb5a7788d2777617b4ce6483a740d7984acbb8335d2387b3

                                                                                  SHA512

                                                                                  97a724b18ed99f2cd6394673434c8265425ef5daf8e53cd8db74b1eaa227f382284d974e9afc3a64f976c512f4989df8a42e47637b8cbf2e2120670b3394221d

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
                                                                                  Filesize

                                                                                  204B

                                                                                  MD5

                                                                                  6317da1c1077ca86b24426601937aa6a

                                                                                  SHA1

                                                                                  8118b2d8054e726ae2663bada177d169b54040ef

                                                                                  SHA256

                                                                                  1bae4a3b4878d26ae04fece4ffc66fbb3fe91b451bad074443472739f2b4bcfc

                                                                                  SHA512

                                                                                  147de30995ec5a4a0f7d2a964adb9bd5cbdec9db30e1809e2c3fad237f39c92411a3dae506c1007dad653e0e69a496a94296630e17d9b34de77303f9f34699dd

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b485b52d-29a0-435b-94b9-151e31f415f3.tmp
                                                                                  Filesize

                                                                                  1B

                                                                                  MD5

                                                                                  5058f1af8388633f609cadb75a75dc9d

                                                                                  SHA1

                                                                                  3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                  SHA256

                                                                                  cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                  SHA512

                                                                                  0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                  Filesize

                                                                                  16B

                                                                                  MD5

                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                  SHA1

                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                  SHA256

                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                  SHA512

                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                                  Filesize

                                                                                  11B

                                                                                  MD5

                                                                                  838a7b32aefb618130392bc7d006aa2e

                                                                                  SHA1

                                                                                  5159e0f18c9e68f0e75e2239875aa994847b8290

                                                                                  SHA256

                                                                                  ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                                                                                  SHA512

                                                                                  9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  7bd6fe3683908ee4541968e049e16ed3

                                                                                  SHA1

                                                                                  344b4b50752935aa5606f761c18cf710ba96812d

                                                                                  SHA256

                                                                                  333e276feb5ee8191c04f45cc97bc313d13c9857a004f7036941d5fcd9469b95

                                                                                  SHA512

                                                                                  0e0a29703b8f7aee4e8174d56091093408a3998bb972fa190b51cb0f29d4b3005ab2a8e1cfe8076e9055020d0286a8bc39a2efd15749d6c0c2e13a572ef31188

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0GUUC90F\download[1].htm
                                                                                  Filesize

                                                                                  1B

                                                                                  MD5

                                                                                  cfcd208495d565ef66e7dff9f98764da

                                                                                  SHA1

                                                                                  b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                                  SHA256

                                                                                  5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                                  SHA512

                                                                                  31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                  Filesize

                                                                                  18KB

                                                                                  MD5

                                                                                  ed6e38bfb3c9ac94c8dab409456b8209

                                                                                  SHA1

                                                                                  5b0cc4739b40be91065b2930d45edccd6d02bb28

                                                                                  SHA256

                                                                                  fc3ddeb9dff7ba24910a52162444190c647fb79392c7f7ca60dfc903038e3036

                                                                                  SHA512

                                                                                  6c1a5cdc76c1771cc3a95287a18c2a4ad9f8b2951cc82eb3140da6bcd91a6f8b755f3e10cee236be4934d89e76cc39911a4557d8ac22a56ea5f48a03be7caa74

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json.tmp
                                                                                  Filesize

                                                                                  18KB

                                                                                  MD5

                                                                                  16766741b4359d6e66c7561888972028

                                                                                  SHA1

                                                                                  3eae95b3eb4204dae54c0aacef96ae71d6687ef9

                                                                                  SHA256

                                                                                  10680bcbafaefb5ca35e7b636b3286314de16cb7216211194927a628363fc639

                                                                                  SHA512

                                                                                  82c5b6432372bd2cab79e3248e8898317811285d4f48dc058037cba143e210eb741b38c102fe753ac53234fc269446797bb799209602dcb53814935bbfb80fe1

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                                                  Filesize

                                                                                  15KB

                                                                                  MD5

                                                                                  96c542dec016d9ec1ecc4dddfcbaac66

                                                                                  SHA1

                                                                                  6199f7648bb744efa58acf7b96fee85d938389e4

                                                                                  SHA256

                                                                                  7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                                                  SHA512

                                                                                  cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019345001\0KGPkVX.exe
                                                                                  Filesize

                                                                                  8.7MB

                                                                                  MD5

                                                                                  1c848c274240a7b5561550c4867c336f

                                                                                  SHA1

                                                                                  fe286e578f0652077cd858850939a152835dcc6c

                                                                                  SHA256

                                                                                  8b5af8709908fa9da7792816d03feb6287ded45a9cb5a5afd4f061113638a092

                                                                                  SHA512

                                                                                  7d96fd7398ce1a3199ea4cb0c7bc4e0f7b76692d9200dd27499b3f96e50a0b91cc77169ad542be46c74fc09e13a84597d180c4c4f0fd23ce45e8c3fa99c8042d

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe
                                                                                  Filesize

                                                                                  538KB

                                                                                  MD5

                                                                                  8339294bc24bf06136ca6eeb31651fb6

                                                                                  SHA1

                                                                                  f2a27ecfa302cee73a90e8b8bb9450f36d63ad6d

                                                                                  SHA256

                                                                                  78c22e4814c30c5e31c6a12427a908d03d9bdcdebd716514d54c517c131d46d7

                                                                                  SHA512

                                                                                  62dcfae552afb890e471f68bbe9267d93e562a715dcd71464e01177e5ce38ecbcf5cda7d501f723a35522036c20e251a986c07de5bd9d91a58ed7e50f47f8692

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019563001\hYW0tgm.exe
                                                                                  Filesize

                                                                                  295KB

                                                                                  MD5

                                                                                  b251cf9e14aa07b1a2e506ad4ee0028c

                                                                                  SHA1

                                                                                  3bafd765233c9bc50ba3945446b4153d6f10a41a

                                                                                  SHA256

                                                                                  be4ae482b0ca161f7d52dcfecc38e55af4b0a0342b0c1b854329da4f42b6c1cb

                                                                                  SHA512

                                                                                  660313d8286535b3acab03c8894d069d7fcb65eb4b5e75026529a096c2337cd68d8a291abf78f612d75b5aec2a413e0936eb16c8c1a94bfda0568dd41312c2c7

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019610001\murrgHN.exe
                                                                                  Filesize

                                                                                  543KB

                                                                                  MD5

                                                                                  4f36d38adf1aa27764e834263b790397

                                                                                  SHA1

                                                                                  c38cd4f1bc7762951225d35e06578b8bd91606d5

                                                                                  SHA256

                                                                                  d6a9fcd0a2fccd03908113ac2febc012c36cd007c30ff2e8903e3dd26e189bbd

                                                                                  SHA512

                                                                                  76d100555bb8a3ef8529b4dcb9391696b440e5b349f38c36ee1fb1ad8a46aa9289b805511d91597ceaa8dccf8fe64c6130111dcfe09cab0651428c83bd0bce23

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019663001\c238497c62.exe
                                                                                  Filesize

                                                                                  2.5MB

                                                                                  MD5

                                                                                  87330f1877c33a5a6203c49075223b16

                                                                                  SHA1

                                                                                  55b64ee8b2d1302581ab1978e9588191e4e62f81

                                                                                  SHA256

                                                                                  98f2344ed45ff0464769e5b006bf0e831dc3834f0534a23339bb703e50db17e0

                                                                                  SHA512

                                                                                  7c747d3edb04e4e71dce7efa33f5944a191896574fee5227316739a83d423936a523df12f925ee9b460cce23b49271f549c1ee5d77b50a7d7c6e3f31ba120c8f

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019664001\4eed285158.exe
                                                                                  Filesize

                                                                                  758KB

                                                                                  MD5

                                                                                  afd936e441bf5cbdb858e96833cc6ed3

                                                                                  SHA1

                                                                                  3491edd8c7caf9ae169e21fb58bccd29d95aefef

                                                                                  SHA256

                                                                                  c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                                                                                  SHA512

                                                                                  928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019666001\84e155f7a8.exe
                                                                                  Filesize

                                                                                  1.3MB

                                                                                  MD5

                                                                                  669ed3665495a4a52029ff680ec8eba9

                                                                                  SHA1

                                                                                  7785e285365a141e307931ca4c4ef00b7ecc8986

                                                                                  SHA256

                                                                                  2d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6

                                                                                  SHA512

                                                                                  bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019667001\9429ed704c.exe
                                                                                  Filesize

                                                                                  21KB

                                                                                  MD5

                                                                                  04f57c6fb2b2cd8dcc4b38e4a93d4366

                                                                                  SHA1

                                                                                  61770495aa18d480f70b654d1f57998e5bd8c885

                                                                                  SHA256

                                                                                  51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

                                                                                  SHA512

                                                                                  53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019668001\4f7be8292a.exe
                                                                                  Filesize

                                                                                  4.2MB

                                                                                  MD5

                                                                                  0ff2001aeabb55d9ac0bfeb28c577633

                                                                                  SHA1

                                                                                  e5f37210806ae7b9cacd40a52dc1e20ceea5b89b

                                                                                  SHA256

                                                                                  dc1e0f683dabb770d3b77040889f5a189e6e5de7040a9625f688a8c240624d3a

                                                                                  SHA512

                                                                                  936cdfc268ec50b7c4df7d53ccbc45a8626a6c52869a1c5a1e0f944f8ab051700e53e0466c328e123e6797c865a329186bfaaba1d075d69c250f72e2f7326d54

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019669001\a1d0455ae1.exe
                                                                                  Filesize

                                                                                  1.9MB

                                                                                  MD5

                                                                                  87448823dab50a9edd9f481b99aca4ee

                                                                                  SHA1

                                                                                  2711209da94d4e33d7a6636fe1a797fba552002c

                                                                                  SHA256

                                                                                  4c813bff7644e8b3db0c1f15db3eae43ba2ca5badf089ec028607c888164e539

                                                                                  SHA512

                                                                                  37085c98ca976ef91631cc7d6b81bfcbf64f72443205d1df2a35105a504878b0795d45057a3c82a1cbddf0895d11dba9ffc234fb13aff14eb2def33ea449bf43

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019670001\d8b50e58ff.exe
                                                                                  Filesize

                                                                                  1.8MB

                                                                                  MD5

                                                                                  1c76387d2784b116b9f532b8b0a48c8b

                                                                                  SHA1

                                                                                  9b977e6b1404a5e4f1b3f3254a1c025fa996ab0d

                                                                                  SHA256

                                                                                  ec07d0613f3d6cf3ba318445c88e2cc77c06065cdf8a1f61a402236c0687f1d9

                                                                                  SHA512

                                                                                  0fcf85db4a716b7f2da97304c70b0f7bed88d6fe448be5bff6d657df8f87cd6b57b007484017128a8c4b28c61ad5352949dba774f67d6afe8b94e701019fcaa9

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019671001\b7818e3bf0.exe
                                                                                  Filesize

                                                                                  2.7MB

                                                                                  MD5

                                                                                  5f8d93018394ecd9f599aa2c10147a5f

                                                                                  SHA1

                                                                                  2d8e3a0d25f83fd723861b5d6cca4e1ca98ac3eb

                                                                                  SHA256

                                                                                  681176f836e4a1921854c9aa2ae0fc6929b850c589beb81ccb45be4b355f2044

                                                                                  SHA512

                                                                                  66a5d018dec2b2353f0048113ced96e55870d78b9253b0704f625e9003293c60e03de56cf534613ece08f183701226b4f71a7ff3adafe3128e79fcadcc1359eb

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019672001\667c825207.exe
                                                                                  Filesize

                                                                                  944KB

                                                                                  MD5

                                                                                  c62f6307b430705a222d91251c64a3fd

                                                                                  SHA1

                                                                                  2e02770695aa07c45ccdc17160f7d57588d938e7

                                                                                  SHA256

                                                                                  bf00151c4e9ccb994891b277adca7ffb6dbb5f1e8704c9f877fabdf81653912b

                                                                                  SHA512

                                                                                  698a75e35b8466252357c46ac7089ce1d52289320a125c7f431a0befa80752cc5a75dc2d959935e0a9baa61848913801fb1d24e4cebe857c7754b7ae676bada6

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019673001\e3fbafce6b.exe
                                                                                  Filesize

                                                                                  2.6MB

                                                                                  MD5

                                                                                  c682c12739cbb53b85334e649cf0b772

                                                                                  SHA1

                                                                                  d80e059a1162d937a09a3823022e749d5d7cdff8

                                                                                  SHA256

                                                                                  28ee82a1695d62f46ce43ee4ebd525806cdb508ed5f68dfe07113bd58b2587e3

                                                                                  SHA512

                                                                                  937d7d84b5af30d1788e958e8893195ad2e8abd6d9640d2343c5e9da199cee67199b824a10965a20b6a77e61844fc6c0bb9d887630b7f6433364671ee507c6dc

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019674001\aca6f31470.exe
                                                                                  Filesize

                                                                                  4.2MB

                                                                                  MD5

                                                                                  3a425626cbd40345f5b8dddd6b2b9efa

                                                                                  SHA1

                                                                                  7b50e108e293e54c15dce816552356f424eea97a

                                                                                  SHA256

                                                                                  ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                                                                                  SHA512

                                                                                  a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019675001\2c7ba07bed.exe
                                                                                  Filesize

                                                                                  1.8MB

                                                                                  MD5

                                                                                  15709eba2afaf7cc0a86ce0abf8e53f1

                                                                                  SHA1

                                                                                  238ebf0d386ecf0e56d0ddb60faca0ea61939bb6

                                                                                  SHA256

                                                                                  10bff40a9d960d0be3cc81b074a748764d7871208f324de26d365b1f8ea3935a

                                                                                  SHA512

                                                                                  65edefa20f0bb35bee837951ccd427b94a18528c6e84de222b1aa0af380135491bb29a049009f77e66fcd2abe5376a831d98e39055e1042ccee889321b96e8e9

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019676001\377c6c447e.exe
                                                                                  Filesize

                                                                                  429KB

                                                                                  MD5

                                                                                  51ff79b406cb223dd49dd4c947ec97b0

                                                                                  SHA1

                                                                                  b9b0253480a1b6cbdd673383320fecae5efb3dce

                                                                                  SHA256

                                                                                  2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e

                                                                                  SHA512

                                                                                  c2b8d15b0dc1b0846f39ce007be2deb41d5b6ae76af90d618f29da8691ed987c42f3c270f0ea7f4d10cbd2d3877118f4133803c9c965b6ff236ff8cfafd9367c

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\1019677001\63bd6eb1d5.exe
                                                                                  Filesize

                                                                                  591KB

                                                                                  MD5

                                                                                  3567cb15156760b2f111512ffdbc1451

                                                                                  SHA1

                                                                                  2fdb1f235fc5a9a32477dab4220ece5fda1539d4

                                                                                  SHA256

                                                                                  0285d3a6c1ca2e3a993491c44e9cf2d33dbec0fb85fdbf48989a4e3b14b37630

                                                                                  SHA512

                                                                                  e7a31b016417218387a4702e525d33dd4fe496557539b2ab173cec0cb92052c750cfc4b3e7f02f3c66ac23f19a0c8a4eb6c9d2b590a5e9faeb525e517bc877ba

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\756129449312
                                                                                  Filesize

                                                                                  96KB

                                                                                  MD5

                                                                                  19b5873da1ece1dad1afab5759e2137e

                                                                                  SHA1

                                                                                  13645f286f536e342feb2d507e7be9563dc0ccd7

                                                                                  SHA256

                                                                                  b17a93065aeb08aba35197a479b404ff96750c504ec451870fce52351e61fccb

                                                                                  SHA512

                                                                                  e3ab49ad265b39576783886f206ed5265c208ad4a87713366243f37a7932a02bf862a620fff68488d2beecfb2ec3aeb9bbae2924b0904fa3ed5bf652faf762d1

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\Tmp2AB5.tmp
                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  a10f31fa140f2608ff150125f3687920

                                                                                  SHA1

                                                                                  ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b

                                                                                  SHA256

                                                                                  28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6

                                                                                  SHA512

                                                                                  cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3c32xdpw.wct.ps1
                                                                                  Filesize

                                                                                  60B

                                                                                  MD5

                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                  SHA1

                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                  SHA256

                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                  SHA512

                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                  Filesize

                                                                                  3.1MB

                                                                                  MD5

                                                                                  aefbd9e285960b704524b4c33b0c9567

                                                                                  SHA1

                                                                                  688eb719525b89f93db7d22bcbae38a13e7a973b

                                                                                  SHA256

                                                                                  bc240f565f4a4aab03cdf04b6ae4522179347145e338ef33df918e741afc5ebb

                                                                                  SHA512

                                                                                  9186ca00f1451b750f59bc999e696964866639a06018e4ad241dd5ddf85550ffdd370d91e72f45a04644f555c150021383e16b29f7c0c27cb8b7cf9465e0ad8f

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                                                  Filesize

                                                                                  458KB

                                                                                  MD5

                                                                                  619f7135621b50fd1900ff24aade1524

                                                                                  SHA1

                                                                                  6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                                                  SHA256

                                                                                  344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                                                  SHA512

                                                                                  2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                  Filesize

                                                                                  479KB

                                                                                  MD5

                                                                                  09372174e83dbbf696ee732fd2e875bb

                                                                                  SHA1

                                                                                  ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                                  SHA256

                                                                                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                                  SHA512

                                                                                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                                                  Filesize

                                                                                  13.8MB

                                                                                  MD5

                                                                                  0a8747a2ac9ac08ae9508f36c6d75692

                                                                                  SHA1

                                                                                  b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                                  SHA256

                                                                                  32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                                  SHA512

                                                                                  59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\clip64.dll
                                                                                  Filesize

                                                                                  124KB

                                                                                  MD5

                                                                                  7fe5b933ed9391ea24647479c80e904e

                                                                                  SHA1

                                                                                  963721e46b8056e2e883c598e95d7daa7bdf8d9b

                                                                                  SHA256

                                                                                  2e12355cb9b11c923dc06f195399d678bc46680e982856d9405f64e7563fe8b3

                                                                                  SHA512

                                                                                  82d92d0c5155fff5ce97099cb9e78422ff328e0c516fbab7634e624215366c2191ec6ff6fe8d939268275c6770accb208af7ac69c3cc13c9188a49ef41339bb0

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\cred64.dll
                                                                                  Filesize

                                                                                  1.2MB

                                                                                  MD5

                                                                                  d862c12a4467ebae581a8c0cc3ea2211

                                                                                  SHA1

                                                                                  9e797375b9b4422b2314d3e372628643ccf1c5db

                                                                                  SHA256

                                                                                  47f8a270b27c18bab9013f4a8f0ee6e877e4050bd4018d682eb502bcfd5bff6d

                                                                                  SHA512

                                                                                  cf6545df4a244bb7dc699a565759f97c759ba19bcc9ad9ad91a20cd07aee19cbe10eb82dd21416b717581b34dc4f24ba6d43a00e7d8018b8be133dbbc9e8113c

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  c4b87f71e8056b26243b6b10f8d0d2c5

                                                                                  SHA1

                                                                                  6765b1ad9c7ee4819375be45623b109ac72d561d

                                                                                  SHA256

                                                                                  462a25e67d8b833a59ec5cd2ae887434675c7537dd4795b1aee215b39b8c5e75

                                                                                  SHA512

                                                                                  fb3baed25427608dc8851191dde5c620aa32eeb28d15d22f26f6a33996d0dfcb47b06876a8fc0f8f4dceef8b6e52e09fa1c255634296bdeab359e43ef5593606

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
                                                                                  Filesize

                                                                                  17KB

                                                                                  MD5

                                                                                  70d8d86fa558b7df2ff25e7b935f5dca

                                                                                  SHA1

                                                                                  a59fe3ad4b606fd9462bc188691a71f032e2fa15

                                                                                  SHA256

                                                                                  50b2fd753652aa59331af0d444516b04b854b092a238e76382fedc36f327c199

                                                                                  SHA512

                                                                                  d7ea003a76fd27499a7e96126e094bea67ceee16270e7bd65c1c269213f9027d707043a8f1b60dec383471d78ad5fa0dfbaf0cd40d065fa024379b88468f5ffa

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
                                                                                  Filesize

                                                                                  5KB

                                                                                  MD5

                                                                                  d18e5f1340cabda422f41155cf7af37a

                                                                                  SHA1

                                                                                  c4b0c83f8e2c826d2072ac8d7af3d6acdd552d85

                                                                                  SHA256

                                                                                  ef75f93eb9a3ec98dc3dc2f4f317e05dc14445f0ec793d2e90203a862043ec69

                                                                                  SHA512

                                                                                  e3d68d753d50a38f8f5dc8d0dcdb1e5e075b3324728b748fe1bee97bd039876d38e9f977f7befd5da94b03d751da1a6e05493ac99bb847220fd3a3074b4c9dc9

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
                                                                                  Filesize

                                                                                  27KB

                                                                                  MD5

                                                                                  b114b77e2198a6eb1484abb0a253f215

                                                                                  SHA1

                                                                                  0d5373df6bb3d9257b6ca3fa4830650b2ddb29f4

                                                                                  SHA256

                                                                                  4a7c9521837453771d8b89754ccb59ca953443d3568a482211c6635db2955559

                                                                                  SHA512

                                                                                  ecc8916674a9fa499a1b34693ccc398d2fab4699bbf01580d39e4ef2d14c7b9442b941b17df5cd1c054fac495cc4a13a0bb1d136dfd5b8050ef84b87f0caffde

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\2622e0a6-9fa9-493d-ba37-fa90d2a52be0
                                                                                  Filesize

                                                                                  27KB

                                                                                  MD5

                                                                                  513e9c80defae0b20e5e36936908edce

                                                                                  SHA1

                                                                                  682f5ba01e25367dda812ebab8163147011cf550

                                                                                  SHA256

                                                                                  b824bdd65080fe4af95e5ca054bcd4aa5ab7fee9b9b5151c553e4b77ffbd7f50

                                                                                  SHA512

                                                                                  4e8d64c90a23da9c9cf79f9107110b1a253193ddbfbac9f39f00b41ddf799fc26e5fbad29ffc964a64915a70a638082187d3f32c432e0a13a8a28ab4b3e0bd6b

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\a5f81839-7138-49e2-9f02-47d0a624e9cd
                                                                                  Filesize

                                                                                  671B

                                                                                  MD5

                                                                                  f2038a6c7d2193b8f16be6fe720df987

                                                                                  SHA1

                                                                                  92e949a06b40adadfe3684cddad727efe2f3ddc1

                                                                                  SHA256

                                                                                  aa15320442bf3c3f45fa161902710185e9089220094284cc1550609e3f25402c

                                                                                  SHA512

                                                                                  7440d339269960b40b9f40e7c0a265a136c72125fd0a47339fe126d9b2b213bdda44922cd6c0c6967bfc99e83198b961b058c1f00232284b398a7fed4197a95c

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\e0336ecf-e4f6-4978-bf5b-cfc13995d7a7
                                                                                  Filesize

                                                                                  982B

                                                                                  MD5

                                                                                  f72a9112362307e75571a39b48c8fb6e

                                                                                  SHA1

                                                                                  0e4444acd9d30617e9242cda49c6e0671d14dc4e

                                                                                  SHA256

                                                                                  7851d0b2d885b3bfc04229e3461c5606ab53f7a7b1091769c131b6fa96331166

                                                                                  SHA512

                                                                                  d7edc30dfee16c9747e4a92c0a5bf560742e3df1cbe42ee2b4db7e21242dfdc719742a2373b7d89ebede4b57e0b658794957d122af42a8d17df39886a58d782f

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                                                                  Filesize

                                                                                  1.1MB

                                                                                  MD5

                                                                                  842039753bf41fa5e11b3a1383061a87

                                                                                  SHA1

                                                                                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                                  SHA256

                                                                                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                                  SHA512

                                                                                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                                                                  Filesize

                                                                                  116B

                                                                                  MD5

                                                                                  2a461e9eb87fd1955cea740a3444ee7a

                                                                                  SHA1

                                                                                  b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                                  SHA256

                                                                                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                                  SHA512

                                                                                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp
                                                                                  Filesize

                                                                                  479B

                                                                                  MD5

                                                                                  49ddb419d96dceb9069018535fb2e2fc

                                                                                  SHA1

                                                                                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                                                  SHA256

                                                                                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                                                  SHA512

                                                                                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                                                                  Filesize

                                                                                  372B

                                                                                  MD5

                                                                                  bf957ad58b55f64219ab3f793e374316

                                                                                  SHA1

                                                                                  a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                                  SHA256

                                                                                  bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                                  SHA512

                                                                                  79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                                                                  Filesize

                                                                                  17.8MB

                                                                                  MD5

                                                                                  daf7ef3acccab478aaa7d6dc1c60f865

                                                                                  SHA1

                                                                                  f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                                  SHA256

                                                                                  bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                                  SHA512

                                                                                  5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  01c5d8a2a4e7ecc02b54f6ad2eec4ebd

                                                                                  SHA1

                                                                                  c609ecf52652e4485c54dc3f91c8df9cd6178401

                                                                                  SHA256

                                                                                  8323954a8c6f4cde0a16867c0ad15751661018450e7f08bb79761180e4e5d5b4

                                                                                  SHA512

                                                                                  43dc24f4d909ae85739962f2887b273a6c13ed5e6a70594e874221af81a36568d049362fafa98d212e533307b7dac77d29a942100564deb9442cdcb5f89a5df8

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
                                                                                  Filesize

                                                                                  12KB

                                                                                  MD5

                                                                                  85c88872c04457edd7748a73a0adfbb4

                                                                                  SHA1

                                                                                  06b56545d330021e2d15691175f27f0318eda8b1

                                                                                  SHA256

                                                                                  b038ff55b77a36c9726137b2a919c3f825e1f02c11faf464652b40f539132a85

                                                                                  SHA512

                                                                                  211624386d59ef8eae35607606888f48a8960cd1094ef535a99ac26be5928565f0d969892b0fabbbfdc6073afd3d32cafe6a10fbf521176e9e1969a0a2d58fc8

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  4c209b05dc540f884d2272620cb8a970

                                                                                  SHA1

                                                                                  eb87c3915ad14df8c8ca67e1babdee050d12b43f

                                                                                  SHA256

                                                                                  65244fb956051ca6249dc6fc7710547da18337c3117ce4b6d7709d29b486568e

                                                                                  SHA512

                                                                                  5c8eab8e18e4a34d7f364297612924b30dd8719ba260d80e34165cb2c559a13bbe210724373fc7e38d1bb0627c34a3b54938476e2e4378eb5ba5ff530e7dfdd7

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  d70da973a12bcac3bb09b7361bfee57c

                                                                                  SHA1

                                                                                  128f141b774d6ed55111e576ce0212a5a876b2ec

                                                                                  SHA256

                                                                                  d9bf57e905f8d216f3ada510f4a222a11189eb567f126388ced7eae8ae937713

                                                                                  SHA512

                                                                                  f940e9f4a33221900596be7669df9bbcf0f6b2df0b7c20af6ef468c2396e7c3fd8a6d358ea025415bb527987d4479c5996b6de7e0b73a68e984e1f47f836e701

                                                                                  Download Submit

                                                                                • C:\xshmbbpao\c9835d9c36294ab7b9557e37c04bb444.exe
                                                                                  Filesize

                                                                                  144KB

                                                                                  MD5

                                                                                  cc36e2a5a3c64941a79c31ca320e9797

                                                                                  SHA1

                                                                                  50c8f5db809cfec84735c9f4dcd6b55d53dfd9f5

                                                                                  SHA256

                                                                                  6fec179c363190199c1dcdf822be4d6b1f5c4895ebc7148a8fc9fa9512eeade8

                                                                                  SHA512

                                                                                  fcea6d62dc047e40182dc4ff1e0522ca935f9aeefdb1517957977bc5d9ac654285a973261401f3b98abf1f6ed62638b9e31306fd7aaeb67214ca42dfc2888af0

                                                                                  Download Submit

                                                                                • C:\xshmbbpao\e0a54407a58b40dfb4e96ca953fe787a.exe
                                                                                  Filesize

                                                                                  1.0MB

                                                                                  MD5

                                                                                  971b0519b1c0461db6700610e5e9ca8e

                                                                                  SHA1

                                                                                  9a262218310f976aaf837e54b4842e53e73be088

                                                                                  SHA256

                                                                                  47cf75570c1eca775b2dd1823233d7c40924d3a8d93e0e78c943219cf391d023

                                                                                  SHA512

                                                                                  d234a9c5a1da8415cd4d2626797197039f2537e98f8f43d155f815a7867876cbc1bf466be58677c79a9199ea47d146a174998d21ef0aebc29a4b0443f8857cb9

                                                                                  Download Submit

                                                                                • memory/1328-320-0x0000000000400000-0x0000000000639000-memory.dmp

                                                                                  Filesize

                                                                                  2.2MB

                                                                                  Download

                                                                                • memory/1328-403-0x0000000000400000-0x0000000000639000-memory.dmp

                                                                                  Filesize

                                                                                  2.2MB

                                                                                  Download

                                                                                • memory/1468-225-0x0000000005680000-0x0000000005CA8000-memory.dmp

                                                                                  Filesize

                                                                                  6.2MB

                                                                                  Download

                                                                                • memory/1468-224-0x0000000004F70000-0x0000000004FA6000-memory.dmp

                                                                                  Filesize

                                                                                  216KB

                                                                                  Download

                                                                                • memory/1468-226-0x0000000005490000-0x00000000054B2000-memory.dmp

                                                                                  Filesize

                                                                                  136KB

                                                                                  Download

                                                                                • memory/1468-227-0x0000000005E60000-0x0000000005EC6000-memory.dmp

                                                                                  Filesize

                                                                                  408KB

                                                                                  Download

                                                                                • memory/1468-228-0x0000000005ED0000-0x0000000005F36000-memory.dmp

                                                                                  Filesize

                                                                                  408KB

                                                                                  Download

                                                                                • memory/1468-235-0x0000000005F40000-0x0000000006294000-memory.dmp

                                                                                  Filesize

                                                                                  3.3MB

                                                                                  Download

                                                                                • memory/1468-240-0x0000000006570000-0x00000000065BC000-memory.dmp

                                                                                  Filesize

                                                                                  304KB

                                                                                  Download

                                                                                • memory/1468-239-0x0000000006550000-0x000000000656E000-memory.dmp

                                                                                  Filesize

                                                                                  120KB

                                                                                  Download

                                                                                • memory/1468-246-0x0000000006B50000-0x0000000006B82000-memory.dmp

                                                                                  Filesize

                                                                                  200KB

                                                                                  Download

                                                                                • memory/1468-247-0x00000000700D0000-0x000000007011C000-memory.dmp

                                                                                  Filesize

                                                                                  304KB

                                                                                  Download

                                                                                • memory/1468-258-0x0000000007740000-0x00000000077E3000-memory.dmp

                                                                                  Filesize

                                                                                  652KB

                                                                                  Download

                                                                                • memory/1468-257-0x0000000006B20000-0x0000000006B3E000-memory.dmp

                                                                                  Filesize

                                                                                  120KB

                                                                                  Download

                                                                                • memory/1468-259-0x0000000007EC0000-0x000000000853A000-memory.dmp

                                                                                  Filesize

                                                                                  6.5MB

                                                                                  Download

                                                                                • memory/1468-260-0x0000000007870000-0x000000000788A000-memory.dmp

                                                                                  Filesize

                                                                                  104KB

                                                                                  Download

                                                                                • memory/1468-261-0x00000000078E0000-0x00000000078EA000-memory.dmp

                                                                                  Filesize

                                                                                  40KB

                                                                                  Download

                                                                                • memory/1468-267-0x0000000007B90000-0x0000000007B98000-memory.dmp

                                                                                  Filesize

                                                                                  32KB

                                                                                  Download

                                                                                • memory/1468-262-0x0000000007AF0000-0x0000000007B86000-memory.dmp

                                                                                  Filesize

                                                                                  600KB

                                                                                  Download

                                                                                • memory/1468-263-0x0000000007A70000-0x0000000007A81000-memory.dmp

                                                                                  Filesize

                                                                                  68KB

                                                                                  Download

                                                                                • memory/1468-266-0x0000000007BB0000-0x0000000007BCA000-memory.dmp

                                                                                  Filesize

                                                                                  104KB

                                                                                  Download

                                                                                • memory/1468-265-0x0000000007AB0000-0x0000000007AC4000-memory.dmp

                                                                                  Filesize

                                                                                  80KB

                                                                                  Download

                                                                                • memory/1468-264-0x0000000007AA0000-0x0000000007AAE000-memory.dmp

                                                                                  Filesize

                                                                                  56KB

                                                                                  Download

                                                                                • memory/1496-223-0x00000000008B0000-0x00000000008BC000-memory.dmp

                                                                                  Filesize

                                                                                  48KB

                                                                                  Download

                                                                                • memory/2280-67-0x000001DD12F40000-0x000001DD13058000-memory.dmp

                                                                                  Filesize

                                                                                  1.1MB

                                                                                  Download

                                                                                • memory/2280-62-0x000001DD128D0000-0x000001DD128F9000-memory.dmp

                                                                                  Filesize

                                                                                  164KB

                                                                                  Download

                                                                                • memory/2280-57-0x000001DD128B0000-0x000001DD128C5000-memory.dmp

                                                                                  Filesize

                                                                                  84KB

                                                                                  Download

                                                                                • memory/2280-52-0x000001DD10590000-0x000001DD10599000-memory.dmp

                                                                                  Filesize

                                                                                  36KB

                                                                                  Download

                                                                                • memory/2280-78-0x000001DD12D10000-0x000001DD12D2E000-memory.dmp

                                                                                  Filesize

                                                                                  120KB

                                                                                  Download

                                                                                • memory/2280-41-0x0000000180000000-0x00000001805CD000-memory.dmp

                                                                                  Filesize

                                                                                  5.8MB

                                                                                  Download

                                                                                • memory/2280-74-0x000001DD12D00000-0x000001DD12D0B000-memory.dmp

                                                                                  Filesize

                                                                                  44KB

                                                                                  Download

                                                                                • memory/2280-47-0x000001DD12390000-0x000001DD123A5000-memory.dmp

                                                                                  Filesize

                                                                                  84KB

                                                                                  Download

                                                                                • memory/2632-106-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                  Filesize

                                                                                  336KB

                                                                                  Download

                                                                                • memory/2632-104-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                  Filesize

                                                                                  336KB

                                                                                  Download

                                                                                • memory/2876-598-0x0000000000400000-0x0000000000C64000-memory.dmp

                                                                                  Filesize

                                                                                  8.4MB

                                                                                  Download

                                                                                • memory/2876-376-0x0000000000400000-0x0000000000C64000-memory.dmp

                                                                                  Filesize

                                                                                  8.4MB

                                                                                  Download

                                                                                • memory/2876-1360-0x0000000000400000-0x0000000000C64000-memory.dmp

                                                                                  Filesize

                                                                                  8.4MB

                                                                                  Download

                                                                                • memory/2876-480-0x0000000010000000-0x000000001001C000-memory.dmp

                                                                                  Filesize

                                                                                  112KB

                                                                                  Download

                                                                                • memory/2964-350-0x000001E44B060000-0x000001E44B09C000-memory.dmp

                                                                                  Filesize

                                                                                  240KB

                                                                                  Download

                                                                                • memory/2964-349-0x000001E44A080000-0x000001E44A092000-memory.dmp

                                                                                  Filesize

                                                                                  72KB

                                                                                  Download

                                                                                • memory/2964-352-0x000001E44E2D0000-0x000001E44E308000-memory.dmp

                                                                                  Filesize

                                                                                  224KB

                                                                                  Download

                                                                                • memory/2964-333-0x000001E44A020000-0x000001E44A02A000-memory.dmp

                                                                                  Filesize

                                                                                  40KB

                                                                                  Download

                                                                                • memory/2964-377-0x000001E44F150000-0x000001E44F176000-memory.dmp

                                                                                  Filesize

                                                                                  152KB

                                                                                  Download

                                                                                • memory/2964-353-0x000001E44E2A0000-0x000001E44E2AE000-memory.dmp

                                                                                  Filesize

                                                                                  56KB

                                                                                  Download

                                                                                • memory/2964-334-0x000001E44B9D0000-0x000001E44BA8A000-memory.dmp

                                                                                  Filesize

                                                                                  744KB

                                                                                  Download

                                                                                • memory/2964-354-0x000001E44EF90000-0x000001E44F116000-memory.dmp

                                                                                  Filesize

                                                                                  1.5MB

                                                                                  Download

                                                                                • memory/2964-331-0x000001E42FAC0000-0x000001E42FBC2000-memory.dmp

                                                                                  Filesize

                                                                                  1.0MB

                                                                                  Download

                                                                                • memory/2964-351-0x000001E44B390000-0x000001E44B398000-memory.dmp

                                                                                  Filesize

                                                                                  32KB

                                                                                  Download

                                                                                • memory/3016-20-0x0000000000C61000-0x0000000000CC9000-memory.dmp

                                                                                  Filesize

                                                                                  416KB

                                                                                  Download

                                                                                • memory/3016-25-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3016-282-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3016-24-0x0000000000C61000-0x0000000000CC9000-memory.dmp

                                                                                  Filesize

                                                                                  416KB

                                                                                  Download

                                                                                • memory/3016-72-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3016-23-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3016-73-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3016-22-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3016-187-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3016-21-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3016-19-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3016-415-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3016-148-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3144-280-0x00000000063B0000-0x0000000006704000-memory.dmp

                                                                                  Filesize

                                                                                  3.3MB

                                                                                  Download

                                                                                • memory/3144-283-0x00000000700D0000-0x000000007011C000-memory.dmp

                                                                                  Filesize

                                                                                  304KB

                                                                                  Download

                                                                                • memory/3236-491-0x0000000000B30000-0x000000000178C000-memory.dmp

                                                                                  Filesize

                                                                                  12.4MB

                                                                                  Download

                                                                                • memory/3236-516-0x0000000000B30000-0x000000000178C000-memory.dmp

                                                                                  Filesize

                                                                                  12.4MB

                                                                                  Download

                                                                                • memory/3236-311-0x0000000000B30000-0x000000000178C000-memory.dmp

                                                                                  Filesize

                                                                                  12.4MB

                                                                                  Download

                                                                                • memory/3236-1179-0x0000000000B30000-0x000000000178C000-memory.dmp

                                                                                  Filesize

                                                                                  12.4MB

                                                                                  Download

                                                                                • memory/3352-0-0x0000000000B30000-0x0000000000E52000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3352-4-0x0000000000B30000-0x0000000000E52000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3352-1-0x0000000077C54000-0x0000000077C56000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/3352-17-0x0000000000B30000-0x0000000000E52000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3352-18-0x0000000000B31000-0x0000000000B99000-memory.dmp

                                                                                  Filesize

                                                                                  416KB

                                                                                  Download

                                                                                • memory/3352-2-0x0000000000B31000-0x0000000000B99000-memory.dmp

                                                                                  Filesize

                                                                                  416KB

                                                                                  Download

                                                                                • memory/3352-3-0x0000000000B30000-0x0000000000E52000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/3356-184-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                                  Filesize

                                                                                  344KB

                                                                                  Download

                                                                                • memory/3356-186-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                                  Filesize

                                                                                  344KB

                                                                                  Download

                                                                                • memory/3992-1280-0x0000000000720000-0x00000000009C8000-memory.dmp

                                                                                  Filesize

                                                                                  2.7MB

                                                                                  Download

                                                                                • memory/3992-1287-0x0000000000720000-0x00000000009C8000-memory.dmp

                                                                                  Filesize

                                                                                  2.7MB

                                                                                  Download

                                                                                • memory/3992-785-0x0000000000720000-0x00000000009C8000-memory.dmp

                                                                                  Filesize

                                                                                  2.7MB

                                                                                  Download

                                                                                • memory/3992-786-0x0000000000720000-0x00000000009C8000-memory.dmp

                                                                                  Filesize

                                                                                  2.7MB

                                                                                  Download

                                                                                • memory/3992-784-0x0000000000720000-0x00000000009C8000-memory.dmp

                                                                                  Filesize

                                                                                  2.7MB

                                                                                  Download

                                                                                • memory/4488-498-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/4488-492-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/4668-1250-0x00007FF709BA0000-0x00007FF70A030000-memory.dmp

                                                                                  Filesize

                                                                                  4.6MB

                                                                                  Download

                                                                                • memory/4668-1247-0x00007FF709BA0000-0x00007FF70A030000-memory.dmp

                                                                                  Filesize

                                                                                  4.6MB

                                                                                  Download

                                                                                • memory/4724-147-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                                  Filesize

                                                                                  348KB

                                                                                  Download

                                                                                • memory/4724-145-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                                  Filesize

                                                                                  348KB

                                                                                  Download

                                                                                • memory/4868-241-0x0000000001A40000-0x0000000001A96000-memory.dmp

                                                                                  Filesize

                                                                                  344KB

                                                                                  Download

                                                                                • memory/4868-294-0x0000000000E80000-0x0000000000FD7000-memory.dmp

                                                                                  Filesize

                                                                                  1.3MB

                                                                                  Download

                                                                                • memory/4868-520-0x0000000000E80000-0x0000000000FD7000-memory.dmp

                                                                                  Filesize

                                                                                  1.3MB

                                                                                  Download

                                                                                • memory/4912-1604-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/4912-1606-0x0000000000C60000-0x0000000000F82000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/4976-578-0x0000000000BC0000-0x0000000001059000-memory.dmp

                                                                                  Filesize

                                                                                  4.6MB

                                                                                  Download

                                                                                • memory/4976-474-0x0000000000BC0000-0x0000000001059000-memory.dmp

                                                                                  Filesize

                                                                                  4.6MB

                                                                                  Download

                                                                                • memory/5544-1256-0x000002BCF1E00000-0x000002BCF1E22000-memory.dmp

                                                                                  Filesize

                                                                                  136KB

                                                                                  Download

                                                                                • memory/5660-1281-0x0000000000FE0000-0x0000000001478000-memory.dmp

                                                                                  Filesize

                                                                                  4.6MB

                                                                                  Download

                                                                                • memory/5660-1337-0x0000000000FE0000-0x0000000001478000-memory.dmp

                                                                                  Filesize

                                                                                  4.6MB

                                                                                  Download

                                                                                • memory/6096-572-0x0000000000510000-0x0000000000A03000-memory.dmp

                                                                                  Filesize

                                                                                  4.9MB

                                                                                  Download

                                                                                • memory/6096-1420-0x0000000000510000-0x0000000000A03000-memory.dmp

                                                                                  Filesize

                                                                                  4.9MB

                                                                                  Download

                                                                                • memory/6096-1085-0x0000000000510000-0x0000000000A03000-memory.dmp

                                                                                  Filesize

                                                                                  4.9MB

                                                                                  Download

                                                                                • memory/6736-1607-0x00007FF78F5C0000-0x00007FF78FA50000-memory.dmp

                                                                                  Filesize

                                                                                  4.6MB

                                                                                  Download

                                                                                • memory/6736-1621-0x00007FF78F5C0000-0x00007FF78FA50000-memory.dmp

                                                                                  Filesize

                                                                                  4.6MB

                                                                                  Download

                                                                                • memory/7868-1408-0x00000000005F0000-0x0000000000912000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/7868-1406-0x00000000005F0000-0x0000000000912000-memory.dmp

                                                                                  Filesize

                                                                                  3.1MB

                                                                                  Download

                                                                                • memory/8036-1585-0x0000018CAD880000-0x0000018CAD892000-memory.dmp

                                                                                  Filesize

                                                                                  72KB

                                                                                  Download

                                                                                • memory/8036-1586-0x0000018CAD360000-0x0000018CAD36A000-memory.dmp

                                                                                  Filesize

                                                                                  40KB

                                                                                  Download