Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    368s
  • max time network
    368s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2025, 16:07

General

  • Target

    https://storage-prod-do-blr1-c.transfernow.net/files/2025-01-18%2F50881acb09bfe9169b09851e682d9750%2F20250118d1daVVAq%2FSfkyIv%2FR%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip?fileName=R%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip&bucketName=tnow-prod-apac&bucketId=6713bc8a-6b2c-4105-a432-4ff791c2ab89&size=12460685&singleFile=true&storageCache=true&x-amz-server-side-encryption-customer-algorithm=AES256&x-amz-server-side-encryption-customer-key=qX8L58lkXHtloqHC2VoqtciGSfMgTJBrZYdYl%2BafW3Y%3D&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXRoIjoiL2ZpbGVzLzIwMjUtMDEtMTglMkY1MDg4MWFjYjA5YmZlOTE2OWIwOTg1MWU2ODJkOTc1MCUyRjIwMjUwMTE4ZDFkYVZWQXElMkZTZmt5SXYlMkZSJUQwJUI1bGUlRDAlQjBzJUQwJUI1JUQwJTkyLXg2NC56aXAiLCJpYXQiOjE3Mzc1NjE4NzAsImV4cCI6MTczNzU2MTk5MH0.VfVxchBVaNcA5E4sYgslQ-LyozAYQsOCdeX8R4tUEE0

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://tradersneez.click/api

https://impolitewearr.biz/api

https://toppyneedus.biz/api

https://lightdeerysua.biz/api

https://suggestyuoz.biz/api

https://hoursuhouy.biz/api

https://mixedrecipew.biz/api

https://affordtempyo.biz/api

https://pleasedcfrown.biz/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Executes dropped EXE 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Drops file in Windows directory 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://storage-prod-do-blr1-c.transfernow.net/files/2025-01-18%2F50881acb09bfe9169b09851e682d9750%2F20250118d1daVVAq%2FSfkyIv%2FR%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip?fileName=R%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip&bucketName=tnow-prod-apac&bucketId=6713bc8a-6b2c-4105-a432-4ff791c2ab89&size=12460685&singleFile=true&storageCache=true&x-amz-server-side-encryption-customer-algorithm=AES256&x-amz-server-side-encryption-customer-key=qX8L58lkXHtloqHC2VoqtciGSfMgTJBrZYdYl%2BafW3Y%3D&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXRoIjoiL2ZpbGVzLzIwMjUtMDEtMTglMkY1MDg4MWFjYjA5YmZlOTE2OWIwOTg1MWU2ODJkOTc1MCUyRjIwMjUwMTE4ZDFkYVZWQXElMkZTZmt5SXYlMkZSJUQwJUI1bGUlRDAlQjBzJUQwJUI1JUQwJTkyLXg2NC56aXAiLCJpYXQiOjE3Mzc1NjE4NzAsImV4cCI6MTczNzU2MTk5MH0.VfVxchBVaNcA5E4sYgslQ-LyozAYQsOCdeX8R4tUEE0
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1efb46f8,0x7ffc1efb4708,0x7ffc1efb4718
      2⤵
        PID:4860
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
        2⤵
          PID:2684
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2632
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
          2⤵
            PID:3604
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
            2⤵
              PID:4408
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
              2⤵
                PID:388
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
                2⤵
                  PID:5004
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1856
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                  2⤵
                    PID:4060
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
                    2⤵
                      PID:1060
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
                      2⤵
                        PID:4156
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
                        2⤵
                          PID:632
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3400 /prefetch:8
                          2⤵
                            PID:2856
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                            2⤵
                              PID:468
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4760
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5144 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4204
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
                              2⤵
                                PID:1156
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
                                2⤵
                                  PID:1996
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
                                  2⤵
                                    PID:4116
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
                                    2⤵
                                      PID:532
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
                                      2⤵
                                        PID:4884
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
                                        2⤵
                                          PID:4536
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
                                          2⤵
                                            PID:3484
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
                                            2⤵
                                              PID:3716
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
                                              2⤵
                                                PID:4432
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
                                                2⤵
                                                  PID:2456
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3140 /prefetch:8
                                                  2⤵
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2052
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6128 /prefetch:8
                                                  2⤵
                                                    PID:3020
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:3012
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:2344
                                                    • C:\Windows\System32\rundll32.exe
                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                      1⤵
                                                        PID:1812
                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_RеleаsеВ-x64.zip\README.txt
                                                        1⤵
                                                          PID:2700
                                                        • C:\Users\Admin\Documents\ReleaseB\BootstrapperGUI.exe
                                                          "C:\Users\Admin\Documents\ReleaseB\BootstrapperGUI.exe"
                                                          1⤵
                                                          • Drops file in Windows directory
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3628
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c copy Re Re.cmd & Re.cmd
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4380
                                                            • C:\Windows\SysWOW64\tasklist.exe
                                                              tasklist
                                                              3⤵
                                                              • Enumerates processes with tasklist
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4984
                                                            • C:\Windows\SysWOW64\findstr.exe
                                                              findstr /I "opssvc wrsa"
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1396
                                                            • C:\Windows\SysWOW64\tasklist.exe
                                                              tasklist
                                                              3⤵
                                                              • Enumerates processes with tasklist
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1472
                                                            • C:\Windows\SysWOW64\findstr.exe
                                                              findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2216
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd /c md 340917
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1972
                                                            • C:\Windows\SysWOW64\extrac32.exe
                                                              extrac32 /Y /E Claimed
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2552
                                                            • C:\Windows\SysWOW64\findstr.exe
                                                              findstr /V "Regarded" Biodiversity
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:464
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd /c copy /b 340917\Disposal.com + Violence + Above + Purse + Porcelain + Imaging + Zdnet + Photo + Facts + Ipod + Selling + Johnson 340917\Disposal.com
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2724
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd /c copy /b ..\Single + ..\Certification + ..\Wikipedia + ..\Usgs + ..\Loving + ..\Prophet + ..\Registered D
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2600
                                                            • C:\Users\Admin\AppData\Local\Temp\340917\Disposal.com
                                                              Disposal.com D
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:2884
                                                            • C:\Windows\SysWOW64\choice.exe
                                                              choice /d y /t 5
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:208
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                          1⤵
                                                            PID:844
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                              2⤵
                                                              • Checks processor information in registry
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:3768
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f4c3fee-fe73-4eb9-840f-1fa004ceecd7} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" gpu
                                                                3⤵
                                                                  PID:516
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2356 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc7fbf1b-7978-4dda-b769-492de75006e1} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" socket
                                                                  3⤵
                                                                  • Checks processor information in registry
                                                                  PID:208
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3008 -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 3204 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a986e2a-54fd-40df-b939-66f0056a249b} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab
                                                                  3⤵
                                                                    PID:3480
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4140 -childID 2 -isForBrowser -prefsHandle 1164 -prefMapHandle 880 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9d323a8-886d-47f5-9fd0-36525482a289} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab
                                                                    3⤵
                                                                      PID:3640
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4916 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4908 -prefMapHandle 4904 -prefsLen 32348 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c5d9187-1936-4390-b877-acb212464808} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" utility
                                                                      3⤵
                                                                      • Checks processor information in registry
                                                                      PID:5572
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5052 -childID 3 -isForBrowser -prefsHandle 5092 -prefMapHandle 4144 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c2921e1-9006-4d35-93e2-e6ff26f4e84b} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab
                                                                      3⤵
                                                                        PID:5904
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5060 -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf305d17-417d-4a94-bc54-7685a07c6ab1} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab
                                                                        3⤵
                                                                          PID:5916
                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 5 -isForBrowser -prefsHandle 5560 -prefMapHandle 5568 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccf6e42a-0838-4834-b278-74f40d63c213} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab
                                                                          3⤵
                                                                            PID:5928
                                                                      • C:\Windows\system32\taskmgr.exe
                                                                        "C:\Windows\system32\taskmgr.exe" /7
                                                                        1⤵
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of SendNotifyMessage
                                                                        PID:5564

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        d7cb450b1315c63b1d5d89d98ba22da5

                                                                        SHA1

                                                                        694005cd9e1a4c54e0b83d0598a8a0c089df1556

                                                                        SHA256

                                                                        38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

                                                                        SHA512

                                                                        df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        37f660dd4b6ddf23bc37f5c823d1c33a

                                                                        SHA1

                                                                        1c35538aa307a3e09d15519df6ace99674ae428b

                                                                        SHA256

                                                                        4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

                                                                        SHA512

                                                                        807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

                                                                        Filesize

                                                                        504B

                                                                        MD5

                                                                        72672a734333e61780ac6b578f78adad

                                                                        SHA1

                                                                        3a7d5dbe3653969105f109bee9c925aa2a73ff7a

                                                                        SHA256

                                                                        924caa2b89b7184bea7d8a40a9f616a6bfe5798d240e7f1dc20de6a486824a02

                                                                        SHA512

                                                                        7649865074b7ab97753ed445f4c3c37587eb9b8ff49707b7f3bcd80317c8e18e115547eaad170e11a749295fab76822791f90857796940765cb86b2b059b32c1

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        206B

                                                                        MD5

                                                                        01c773943215504d3c9aea332c78b3d2

                                                                        SHA1

                                                                        f9c05c87d0a1326417549c2a272c569b3a24b001

                                                                        SHA256

                                                                        5e6fba68910f4691120cc0713b80afaff3515ee0a26c891d5f9c9ce2960331a7

                                                                        SHA512

                                                                        71b180472a03b9e03f6b3f064407d88b957904a0fa2abf5efd9d16705187c9a0526483eb90f96b9090b979d9f38d717dbb2042bd19234e54f61341191984d57b

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        666cf8b3e41404ca80f3a8e111a175c6

                                                                        SHA1

                                                                        f00fb03079ad03085e4e11f8564d3a9f0023257e

                                                                        SHA256

                                                                        f322224a8dce830b116c150f315ef8baf5baa99a42facd9d721ab7c93f40e88a

                                                                        SHA512

                                                                        839a3aef3d8475fcfd8df509995366b8e2fa7f93365111fedb07caa67c3ede38065cf283eca4795d277fdb0167376d0b08edff59b138d8e3040a521437386e00

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        2b4f28dca9a5ed57d7626008ccea72fd

                                                                        SHA1

                                                                        acca102bd1eb0eaf83227e372805a6ec4b3b8cca

                                                                        SHA256

                                                                        299ef11afbe405f2a7a43e4bb52de4141478e79439df4e1b09930544e5878138

                                                                        SHA512

                                                                        f9965a3ca8c60cfc568a44831b4f6ad120679b9bdbef77d7f855c1f51e1c111c05087d2ea3097683250ce64212a2e972c22e13579f0d005f6706cde9102bd254

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        b556b4faef0e173baf7af52ddf558932

                                                                        SHA1

                                                                        7044d809033457b16ae99e29a28306a0621b5766

                                                                        SHA256

                                                                        e6b40e793de576149eda2c2971ad9ac070068bbafb6f13f2b0e71d2c9f7da214

                                                                        SHA512

                                                                        eb4678b98fb7a59304f49ef91b4fd5a70e379d7e477edad040a56c7c734ea5dd698fd84368d79a7a9aff025a458a433e519f696e5edc7667d5d7e1cf3d78295e

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        14069d671f3421157fe15f73afe8329b

                                                                        SHA1

                                                                        efdd0897b5b4a4f2b7ab9713d6f146a1560cd15a

                                                                        SHA256

                                                                        0fd85b4b473887689d94dcc6a54fd2e7fe6dcdc9428df29beebbf92d92d96330

                                                                        SHA512

                                                                        cc415476fee7fdbbbfc2c40a6f3dcd1f6994f35a58b9f4b06e37ce85a694e864cf9af6d4432d9d98a0e9493d1b17deafbc17824fc532edc141fc333f054d6731

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        5KB

                                                                        MD5

                                                                        6d44d5b4f2f1423c80974d2256d26895

                                                                        SHA1

                                                                        a9e4a449883cd968278a99d9be0c85c297d285f1

                                                                        SHA256

                                                                        e5e6f8f859622257f266ea9b8b482d6436aa07d1f1e9a7ea02d069152cd895df

                                                                        SHA512

                                                                        6014b5db4a12b464c6cdc9cfdbff14983133f296d90f6c68024a82c854b2531b328bfed5510c27773a945005a3abf037422fb58a9d3fc40d42f0f23701f80a55

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        d39286c2a085eb167bc5487df4264178

                                                                        SHA1

                                                                        8cad183c90fba00d5fa53b20a211b9db9cb70cc6

                                                                        SHA256

                                                                        83f37160574548cbaefa6202d4658863be688b790505c41b23c361809ec0e319

                                                                        SHA512

                                                                        bb5342ae5fde6e757ac006818fe37a8aaeefd136d3576112a63d91a2c35521f98f5f712b0933780c53d50bf8fd2698eb1eb79bf6b6962e4500003921f2bb80d5

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        1a183ba15ebf19425089be78ee5ce4b3

                                                                        SHA1

                                                                        ed59f521fc1084f83d7aedc4b29cadf6fc805e2a

                                                                        SHA256

                                                                        45af109f0242508a0b36461d22c18f8d0da17393a252e4b546836c88ffa09eb3

                                                                        SHA512

                                                                        19e846c21150b73dfa969d9b360696e0b0dd37a1658e3bc7fc3e6838ad5bd301ffa285d2de23d71abdeabe63de9fe6a640793946118dd58011c8cb45d7de1ee2

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        89f65b545cc9c9e4127ff27dec46fb6a

                                                                        SHA1

                                                                        ef175e5cc2396729c573ee77bdd402789573eaf6

                                                                        SHA256

                                                                        49f98c4ed5eb9543455ab8779b9cd89f2f86bf2bd551683bb40a900f9d4576da

                                                                        SHA512

                                                                        6f869edcf3a2a0f484e0331033574e6b14db0385b4c5f7a6f7a66644212e8663be4d3a7a985b68519da5924ac9bbd3607f71a5f0ea7608a545ba6bc2f971f388

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        368B

                                                                        MD5

                                                                        11df15ca4e9e78d5035071c4cdad8121

                                                                        SHA1

                                                                        79b26450baf3837e50d14f4546dcbc4eec232ad8

                                                                        SHA256

                                                                        231c609ef84174b2bd4426332fd1a2a19525124e967bb9ba6f22dde9eb8844d6

                                                                        SHA512

                                                                        59aca5cfd7c9c134a0fd84b511cdb913432c9e6cc6f4e64ac96673f80523632028b134d18eca1fa812cd1a90f196d2664615b6a4d2871a45bb88e0b61e961008

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5ae8fa.TMP

                                                                        Filesize

                                                                        201B

                                                                        MD5

                                                                        bab6b5a40d3436c0d60b0398cfdd5873

                                                                        SHA1

                                                                        f32e63af0d3269d01e796dbae995469f6f9ff794

                                                                        SHA256

                                                                        5f0738b6b0b8059efd2b59149bf047cdf6c204969fd7e398b0ce79dc63a708c0

                                                                        SHA512

                                                                        ed5fd7e7840e5db11dd10e65bdeaba8a7f5c118ab0fdbdfa7e43f37fe85d1cdf5da1dc19685853bcf7288988c50f8d9e434a92b8ce4c1d81b836148568c9e54c

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                        Filesize

                                                                        16B

                                                                        MD5

                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                        SHA1

                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                        SHA256

                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                        SHA512

                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        a824347e47fda05cd602a7fa23c7f716

                                                                        SHA1

                                                                        34758ca7bfd290ce830a8b538c738a6850fbd860

                                                                        SHA256

                                                                        91d8a03900185b7bb49bf329e43a897496158528b15eb7e9b308851b4c255bc3

                                                                        SHA512

                                                                        2df07a3a47297287401ce2aec3472f5c7513a22e1324ad784b77c155c11af06982123a291d2d457ddfe3504dca790ffc04b0d4e4361c7a7ff8ba8b3931c7ece9

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        8f9756294ca1365cc86c88cc375cfee2

                                                                        SHA1

                                                                        d4a0f7ca9bffca56ffb60350f69280292aec5841

                                                                        SHA256

                                                                        feff9264ddc7cb17b41c29dc9780f5ac04b636b909f40ce53f2e5561b7c50116

                                                                        SHA512

                                                                        5c6e10c5bcf59a966c14c2dabb30923e2b3fbae1f0228f857630afa4819edd50709f8d51eee3c5d74f28bcd8fd60a204315be914b4a39db80ec70be44ad4b77f

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        988a8a5f3aeb2f4801d0b967720dc62f

                                                                        SHA1

                                                                        6bdca66ea809b8eb9d0537e6bb19e214624d1e71

                                                                        SHA256

                                                                        ff53c8265d5d0cddb8693925b144a986e075a9bdcbb1fe0d0333edecd5d9522c

                                                                        SHA512

                                                                        6d705c3985e2a5bb9f2df2e80b31e892ddf015624ed983aabd509bf092dc827e1fc2aa1ea28e94e22f4e0b1057f787acb3cd8eaec06ffb1d48b104412ce30aa8

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        b0253b845bf6accd779915135ebcd761

                                                                        SHA1

                                                                        61cbe21b2f14f84c22de4a0edc739e45d867fcf4

                                                                        SHA256

                                                                        07722af8cc90476a782821f20e80a7bb066f1cc7c6c17a1e7ddf69c879c4ab41

                                                                        SHA512

                                                                        9be37045dd7c735a6d8b808345fdcff1644a6da320fc8f4d4125984c53f83381364c283f504c23d5e3ff6e333ceca17c69b72237d4c8695e40d10b4117344f8e

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        8e9f83dbe413b19ab5931f3a907e16ec

                                                                        SHA1

                                                                        68f9493060f5f18d7d5c2288662cea9ebb56127e

                                                                        SHA256

                                                                        e9b10f31bdde25beb6ffcfe8dafa039120531243eb0145c1a72b70ec8593f63f

                                                                        SHA512

                                                                        f1192341bc030cc1023eecce4716db418efa60b725317265d7e18a51386c792afc3f074ca5280c0bc22caaafbc5211a60979141d246711e4767156a6b463eef8

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        0939bbae62c4f290ba7a8861f8be39bd

                                                                        SHA1

                                                                        5d2c66e20c2a662caa3a70e53451d11759b749c7

                                                                        SHA256

                                                                        a5fe60038050e657370336fe02d3b6827fa4b183c69ae64a4d6ce059a18f8469

                                                                        SHA512

                                                                        21a1e121f482f77abce4f592e06837e4c30dbc55ed735d2bea0d41a6210212d0434165a1962fc2252c6d4a6e14b24136ee44baac6727a9f8d17ff42037a7b37d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a932c466-07c7-4de7-9f39-b03a0185d9fe.tmp

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        17224f4a22b3790e63f5d748b07233be

                                                                        SHA1

                                                                        97737dd0242b714c1908a8b1e66b832697dab2f5

                                                                        SHA256

                                                                        e0df78fbba0644c6adf77fd492b21a2488f84e8c28da4b1ded562759af838e18

                                                                        SHA512

                                                                        fc784ba16fabae1f568d82a25e22970bd5e305e011bdc5064f75ecfb0c5b44ff74fc7faa8384676ca4ee91ee34a865b0e81933228cfbf212f24fd8f4d6c23500

                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json

                                                                        Filesize

                                                                        21KB

                                                                        MD5

                                                                        a21efe74e34e451fe8c9dff7da62b14c

                                                                        SHA1

                                                                        f21dbba3afce381ca790f997369f7970a27662c2

                                                                        SHA256

                                                                        d9e20b30006f181c0d2fb0d85f340c66a6259e92a0b4aa66e5a356b8ef5df376

                                                                        SHA512

                                                                        a7158f03fd7f6356bf8a8278fd3e121c9d7e7e308e894db0e050d54a36816cf2047962c9ef7240deadc79d41bb653b177bce6a714b97fbba40293b5d5030026c

                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                                                        Filesize

                                                                        15KB

                                                                        MD5

                                                                        96c542dec016d9ec1ecc4dddfcbaac66

                                                                        SHA1

                                                                        6199f7648bb744efa58acf7b96fee85d938389e4

                                                                        SHA256

                                                                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                                        SHA512

                                                                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                                      • C:\Users\Admin\AppData\Local\Temp\340917\D

                                                                        Filesize

                                                                        496KB

                                                                        MD5

                                                                        17dd7466297f02a8dfd1b1d3b1446531

                                                                        SHA1

                                                                        f24b5d9ac103fe1d6ac109c7b374401ec042771a

                                                                        SHA256

                                                                        e5d5315fc8dc081dbe78f185682759ca7c8493885d892131942f49e5ab411f14

                                                                        SHA512

                                                                        01f5483f5505776031a332283c70f1e24742048e1b9164b6f63e6b7adef5802a879782c766acc7c145c89620152779edb3b7ef9f47ed83e1503bae313d1e389f

                                                                      • C:\Users\Admin\AppData\Local\Temp\340917\Disposal.com

                                                                        Filesize

                                                                        145KB

                                                                        MD5

                                                                        1e0d955fb192084c15c3e53ef296f1e2

                                                                        SHA1

                                                                        e2f545ba5fbbb4cd18363dca6f8007521afefea9

                                                                        SHA256

                                                                        3e06d95d13ac2415fab7eed85b22eda677af960bffbd31850274840bd2d91955

                                                                        SHA512

                                                                        3267d139915eacd335056c9e0a7e6c5810fd51a0e64a9c615a9699f58fcabc82a6917ab8e5b4be56c8b42c7c205c3d5fe4df7ead2aabf48fae7b5cf043dd07a7

                                                                      • C:\Users\Admin\AppData\Local\Temp\340917\Disposal.com

                                                                        Filesize

                                                                        925KB

                                                                        MD5

                                                                        62d09f076e6e0240548c2f837536a46a

                                                                        SHA1

                                                                        26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

                                                                        SHA256

                                                                        1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

                                                                        SHA512

                                                                        32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

                                                                      • C:\Users\Admin\AppData\Local\Temp\Above

                                                                        Filesize

                                                                        59KB

                                                                        MD5

                                                                        d88e04f7a23e77ad1be7d45352d1991b

                                                                        SHA1

                                                                        c187f58ee4ee55f86cc9e9fb884e4648621ac9c3

                                                                        SHA256

                                                                        ea7713f92c5e61dce396c08c527bc0820033e9344e4f21ecd8f0455da1a9de12

                                                                        SHA512

                                                                        6ec1db2eb816f5ecb823f3044a1c8e990b8654f0cb132c91508a68f45cf78cda89e64cff8c3c61daf05f53e55c9272b360d9ca170378808cb296611f499d9ad2

                                                                      • C:\Users\Admin\AppData\Local\Temp\Biodiversity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        4fe6f5461c7c40db33d910a12fec2a79

                                                                        SHA1

                                                                        aa2ee0de4e71001550a3945081882d4a8a1c2d59

                                                                        SHA256

                                                                        b004161a9eda8d8aa733a38062146c9bceafc32ba621a758718605506010aedf

                                                                        SHA512

                                                                        e41e3b7cac3c86b17ed5c535709b62ac2889f8326f2478e70ebae80d75566e1516ce2e603461cb550b1ad226894a7f96d946c42ec0c571627cfbc88accb4b557

                                                                      • C:\Users\Admin\AppData\Local\Temp\Certification

                                                                        Filesize

                                                                        91KB

                                                                        MD5

                                                                        abb21134a4f9211d2f28a8d2ba0b1fe1

                                                                        SHA1

                                                                        a40a8360efea23fcd9af117f26768cb3d7265ada

                                                                        SHA256

                                                                        b44e36ed9ff6a88adfdaadbfdb8691bc40606d33f15799810962e2619f80c466

                                                                        SHA512

                                                                        e48e7efd94916867f8707f3a6b69b3de8373664ad6e31bd25b4ffc639df3fee5bcf9653018a65fc7f74e4342a73721ad2617f12abe9ab4a8ae37ed37b9ad3337

                                                                      • C:\Users\Admin\AppData\Local\Temp\Claimed

                                                                        Filesize

                                                                        476KB

                                                                        MD5

                                                                        20fc38827d4eb4452035cfcfee2d8c14

                                                                        SHA1

                                                                        aa4ec6a834a732dabfe1e068b05bf8b5ac9412b5

                                                                        SHA256

                                                                        f2f03b313f4007bdfac6dd5bb15eddeeeeff5c40553acc31d0906fe08a9c275a

                                                                        SHA512

                                                                        0ea8b707989dd684944b3f83f94eb5479414323f2177d888bebc2b104238f9f0f353718b714737667bcd9ec00cce52aa248e9f639b0fbd1ac4bd3b9b5e8236a0

                                                                      • C:\Users\Admin\AppData\Local\Temp\Facts

                                                                        Filesize

                                                                        57KB

                                                                        MD5

                                                                        60ffad7f702c52c0335984fba06dca2d

                                                                        SHA1

                                                                        11100fc0104616b4c79fe10e71694d5fad766a58

                                                                        SHA256

                                                                        e7bbd8738ebde9f732b70120304516a70e75ae8448fd7b135941888c435dab28

                                                                        SHA512

                                                                        632a5660ea545994a17f4643bc74beac19509676a16ce38f31cbc9defd0f4987b64a13fa3b25265c586c6added16c6d7c6a46bcd9238514d916d902e958284fe

                                                                      • C:\Users\Admin\AppData\Local\Temp\Imaging

                                                                        Filesize

                                                                        135KB

                                                                        MD5

                                                                        561abfe4a979b2713e00849ef7b5750f

                                                                        SHA1

                                                                        7894820d54b3bd0d0cea927da161e65d408abbb2

                                                                        SHA256

                                                                        ef840c0c3741162a4055f501a50535dc9f1ab3f1a2adc3ea363aebf3fd0a5834

                                                                        SHA512

                                                                        bcf4670f8889b25c4e7e9b5e2dc567cd952874abb53ca7b481cd90216254a0a80d5107f3317962440f461b0fbd6bb89d4d3c4d562e6bc6270d8cd0fe51fcc8ee

                                                                      • C:\Users\Admin\AppData\Local\Temp\Ipod

                                                                        Filesize

                                                                        75KB

                                                                        MD5

                                                                        2eafff2ca929d25609899da5168732ce

                                                                        SHA1

                                                                        ee838b4a882cb68de828bfdd31013bebbcddca3c

                                                                        SHA256

                                                                        18757fe406aec7ed2c45e2e380ce3f1bf409fba01ae4a1a195958ff69718e1eb

                                                                        SHA512

                                                                        6b471e93d739b46e2bb42b24dcc22b71d43b6ddf0e4761c23d451647bd9a39c2be37cb35690e446391c045724459db5a62d29c0c6b42ab8797a02784581ee1b2

                                                                      • C:\Users\Admin\AppData\Local\Temp\Johnson

                                                                        Filesize

                                                                        43KB

                                                                        MD5

                                                                        e254802b09d9b8bd3847a0df8a078325

                                                                        SHA1

                                                                        44490d529dcf461b0d6c6418a2059b0cc6557afd

                                                                        SHA256

                                                                        bb046cff9ed9fc400735abf70c05ef8a1971dd4df24b6fad7995d98881de5ed2

                                                                        SHA512

                                                                        128736e13f9311cdbf2d2aa2e5b65a8117ab04a40550c232be60b424c608980bfb337730cc29153db18fe06eaca48b6e3085439588568545c27c3848f67f03b9

                                                                      • C:\Users\Admin\AppData\Local\Temp\Loving

                                                                        Filesize

                                                                        74KB

                                                                        MD5

                                                                        f31b4023aa01fb113405a331278ab9a9

                                                                        SHA1

                                                                        393714a5765d77cf96b8642410eb2bba0cda5313

                                                                        SHA256

                                                                        169d4ad56c587292db439bea272a5f0f212a509c0ea3946136cd82d3a4512cc0

                                                                        SHA512

                                                                        0b28dd7e7f6718993453df48c712e34cc9ec0bff5eda9d152052015861f9cec0acb72b34715bb2d6601683f0fcef3ecf8563032b6cf8dd9b96e5b01992456fca

                                                                      • C:\Users\Admin\AppData\Local\Temp\Photo

                                                                        Filesize

                                                                        65KB

                                                                        MD5

                                                                        1f34b509444ddafdc5db392355d6030c

                                                                        SHA1

                                                                        0eb74a71e7f9d032202907e53a5eca616f0854eb

                                                                        SHA256

                                                                        c3aac528b8ce09f7fa8a8f093bba53a5f931c057fff82703cdb85dd93df2d07b

                                                                        SHA512

                                                                        21255d420fe6d5dec4bcf880e208df1a39875b3d404c8892f07c228edc6d20431a95ab05c63418f9b2cd15a9eaac74991b758d5869345b86abed69dfd12772a6

                                                                      • C:\Users\Admin\AppData\Local\Temp\Porcelain

                                                                        Filesize

                                                                        55KB

                                                                        MD5

                                                                        89ea696be802aaf4204fc6c0b76afcc6

                                                                        SHA1

                                                                        9ede6af57ea48370afc71afaa3adbfef5208eab2

                                                                        SHA256

                                                                        899437f29213e6649b4c000ee9827e3cac3bd8028c7a2eff28627ab9d88e827a

                                                                        SHA512

                                                                        748097e7f81658cda377b09559e82d00ffbdbed057188336aedfff156c172604b2d9138309b7d127ecaa706f1373ada29f491ff0a3e6ed9ee87bf44717172edd

                                                                      • C:\Users\Admin\AppData\Local\Temp\Prophet

                                                                        Filesize

                                                                        67KB

                                                                        MD5

                                                                        cd937d6d4d1cebc84b5150d1a3d4db6d

                                                                        SHA1

                                                                        7bbef6be5454bf941127e3d0762247e3f918b2f0

                                                                        SHA256

                                                                        66a998c2b5862f22b098f00ce1ae1e08e9b7298a9ec57aa8db3bf2db253a3a81

                                                                        SHA512

                                                                        1f939a423cd0e731db0d9f88fe3cbe28c5de067403fe6d9b8f5036fe36f97bbce712e4fa0d68196b712fe4d5d5a73d6ee9624ada0598b81effe7178f7b213d49

                                                                      • C:\Users\Admin\AppData\Local\Temp\Purse

                                                                        Filesize

                                                                        141KB

                                                                        MD5

                                                                        fcf10aef7e06666b64bd2166f710a8f4

                                                                        SHA1

                                                                        4168d616038689401e6aec4d7918245ea7e95652

                                                                        SHA256

                                                                        ac89bff5c9d9af8fe4506382fd7772e1e464f7904a554e75f34963516a848bd3

                                                                        SHA512

                                                                        295269e5123347ddf10cc2212e569a7cb389d2a33b3fad2dc7327ab8bdb8f956a7ac7f6592489a47889f95b2126bd63e664f28ca72a3c68e52481905e55e796f

                                                                      • C:\Users\Admin\AppData\Local\Temp\Re

                                                                        Filesize

                                                                        27KB

                                                                        MD5

                                                                        e4b460462746b77bca3afe76fdbf0810

                                                                        SHA1

                                                                        38e685630a8ef761db8bb8d0fc269dc7ef878dbf

                                                                        SHA256

                                                                        eb37f2aee73e6060a6eb96c88b08af0b4f273f731b72e99b31e075d4418ce0b5

                                                                        SHA512

                                                                        f6f8692a053203434cf30e6f8b8d20a1e56c83112775a160d90ea47beaa3b8cccedcb09b51f1b9fb28a4d048d46c59fe6d88d883ef9a0133ce9f7359ff5e6557

                                                                      • C:\Users\Admin\AppData\Local\Temp\Registered

                                                                        Filesize

                                                                        57KB

                                                                        MD5

                                                                        5ae9352835d7e57259848104d413748e

                                                                        SHA1

                                                                        565c5865e233cbb15201eb36fcecf0f1b9f1fc51

                                                                        SHA256

                                                                        ea1ec57ce0147188b91ae6346063e60dabce991f09f968ca86e98437b9fbdd2c

                                                                        SHA512

                                                                        1aa9781503f7a7f5f3504096e5dcdf00f3ca2ad702e93eec9147aa92a09f1e955ffc41ba4a6dddac73332433b35853d492a6abcf20aa1980ad5f81f2579487c6

                                                                      • C:\Users\Admin\AppData\Local\Temp\Selling

                                                                        Filesize

                                                                        120KB

                                                                        MD5

                                                                        ef6c0c4a03942b898c1345fc5e2923d1

                                                                        SHA1

                                                                        802a01cee96e04725ecd527c5f9426fca7edbd35

                                                                        SHA256

                                                                        fc4c66f7e940be137583a37a40c71ddece824dcb2c945049c56d377f869c8266

                                                                        SHA512

                                                                        98cd652ec23a7acac03c5097e6e9cc41003eb7146e7eaf21db7ae36de30d1cd6e8cfaceb1978f18e3e446944d776080481eb45e71a1ffd1c52cfe2cb1641ccaa

                                                                      • C:\Users\Admin\AppData\Local\Temp\Single

                                                                        Filesize

                                                                        67KB

                                                                        MD5

                                                                        5349a477a2081ab09b1f1aca6ca572dc

                                                                        SHA1

                                                                        57968a903f92ccacc6e7d577e6488d2894e3877c

                                                                        SHA256

                                                                        b129d35e0906df8b0e81844992d7a663073110a1f60d51e7c1e8995aff9f6cd3

                                                                        SHA512

                                                                        5806e022a63ea9586d3fc3243793b6a604103b856ff92bd31a396334756df9641dfadacca7b62562f531110715a3b8ec28aaa0c5f0309dec33ad6cb8357bcc1c

                                                                      • C:\Users\Admin\AppData\Local\Temp\Usgs

                                                                        Filesize

                                                                        70KB

                                                                        MD5

                                                                        9152d897abfc11e7f47f4dcffa4e1dcb

                                                                        SHA1

                                                                        bac18a4e2819d4ecf18dd70d5e36638a58387ed0

                                                                        SHA256

                                                                        a5ef2e4a4553670780a5d4fbac1f4ff7ad2232b5eefb343f6548a1b68912138a

                                                                        SHA512

                                                                        5f23307e7c29ec2d9cfd0063b9dfa6552433e90575958a860c76f11302a5397e37723f65d906d7f3c92ef9843587fee4b4f98a96adf5d6dabd4dfc80afc351ba

                                                                      • C:\Users\Admin\AppData\Local\Temp\Violence

                                                                        Filesize

                                                                        85KB

                                                                        MD5

                                                                        98624849254fb1f0653da5db882e1560

                                                                        SHA1

                                                                        5c7967add2247827f8d8fcc4f7311a66a4a36204

                                                                        SHA256

                                                                        0656568395a1b68f778098b6d3519bdfd86dd9f5a39da10a5850b2b17545f139

                                                                        SHA512

                                                                        27dc9d10e8c3113f62028435ddc51b9402a8d507ea1f43a88a300374a722ad20fba8c7877bc483a0f55deb0cee25e3bb64d54c32cc032e4d1384a1626d8e2fe1

                                                                      • C:\Users\Admin\AppData\Local\Temp\Wikipedia

                                                                        Filesize

                                                                        70KB

                                                                        MD5

                                                                        070190137c2a7ee0e964e261ebd9e25e

                                                                        SHA1

                                                                        3e5230f125ada287e1ccd9e52733539762cdac7e

                                                                        SHA256

                                                                        5cc23023cf6ea445764a4b39ffc0a4ef3ba9099254eee86b1ad51db63bcd5233

                                                                        SHA512

                                                                        547daf63266a12833e5e370eb606814a01b89c266fa3fce9ab47c686a0929e91d9b515ab3d7cf41954ccfceffbeac22e9756f298aad4710d01c0ab747bab9e1e

                                                                      • C:\Users\Admin\AppData\Local\Temp\Zdnet

                                                                        Filesize

                                                                        88KB

                                                                        MD5

                                                                        ad758f1e2bc2c34ec6c8a23df9236746

                                                                        SHA1

                                                                        48807f2ec69dc2cd96f78a7809d99f63853acb81

                                                                        SHA256

                                                                        c806b7ae24975aa2b7c4635d4c75781a97092e820946c0405630d7441985f3c2

                                                                        SHA512

                                                                        b17ba342403e16ecfde952dc5f482ad31c011375d3791046fc056170001073c169101e2cd37939c95cdbd19ee785b9ae53b572daec7a4628f013136c163f73dc

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        4885864c3762cbd96d84e67a143dd505

                                                                        SHA1

                                                                        7a9339dccbcac55c1ecb8d9a630bb9692156a995

                                                                        SHA256

                                                                        bf6381fd7c9b2882329dd88d6af77bcff51999e1438008f4050613b6e2da90bb

                                                                        SHA512

                                                                        900f830646588f2f4679265e2978aebef414aa5219b5c7a6012896ee954fd54c3373f8a54fd28246b2ef0f943b475f4e43e0cd23d596744b31c6c9075c59402c

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

                                                                        Filesize

                                                                        5KB

                                                                        MD5

                                                                        adc5772bba059e959937ca150999593f

                                                                        SHA1

                                                                        2ee3a3c14820e3355edf7c35a6458be17200bc73

                                                                        SHA256

                                                                        559238ec2a35925d129ea012f649964c3e4aebfb68be87bda8bd336ffdb49a68

                                                                        SHA512

                                                                        f50d51c9b6b78187f2422ee1e1131531753346eed8ff6e32b1218742ee66d606d4c6b37fb6bc16e7f5ac160f543d346941dbb7543c96de4286f4741eceded788

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        9e10921ac140af7d36b1c24a55309091

                                                                        SHA1

                                                                        f0611356e8e00fa4ddfc07871b42c9c944b2f7f8

                                                                        SHA256

                                                                        b743a2851844d260e1663de5ec11adadabc82f97831080186b2d1e332618aced

                                                                        SHA512

                                                                        a96ec9400d3f7a7668703b8c5c88bab15a4b798e567987224b37bb8b3522551777765911fb401c4ddb378e5a5721e479c2b9b1f3d11692c05cccb0b0cb22d151

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\0697120e-ccc0-4094-a84c-01d6e4fa15ab

                                                                        Filesize

                                                                        26KB

                                                                        MD5

                                                                        5a9c4e107b8b68fb5862bd1fda3a6cd9

                                                                        SHA1

                                                                        16b281961bef25fe7ca3147133616658294946b4

                                                                        SHA256

                                                                        f8044d7d7a22868a25e20e6493491b05c59eebfeac3f79bd152618db06b2d0d7

                                                                        SHA512

                                                                        fb16bdfa53b1931a660a59848310615f022fa6ea0ad9ca47e873492eebec4ff64a3e1d9cc399360fcedca46faa7dfae732ea1985398c071a6bacb36fe431f887

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\3d4ab05e-37e9-42aa-ac39-706d4353eac1

                                                                        Filesize

                                                                        982B

                                                                        MD5

                                                                        9b339a5063028b57d3f15de1ce847dcc

                                                                        SHA1

                                                                        dd57805825f4046012daf3777ee4a0130da8b64a

                                                                        SHA256

                                                                        8a60d618e3555544dd7682026af72c1b895cae5c10d6544c980edf4b5f869056

                                                                        SHA512

                                                                        c8934d011c07f4fc5a971e2c410799147d870b6f6692059dfd138a76dcc76eb43cb18709ca44c3b7364b9d2291453c6c6bfa03584da895a038c5769892e728a8

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\ff39d860-296b-49ec-b473-19cb004c2791

                                                                        Filesize

                                                                        671B

                                                                        MD5

                                                                        92ca65e90589c7a65b823acdbcee17d0

                                                                        SHA1

                                                                        c4534adb9bee1e474717230473511b38ed68602e

                                                                        SHA256

                                                                        3279d745368705e294deb762594cda1154a4af0195705cdc25a4b4b82125c355

                                                                        SHA512

                                                                        1647ef5f40f8616b3ba0363791639a875e8554732e71eacd38eff61050101fe12b3261ef2a22ab4347268ca66bc7dc4e5590ced0ed65d7983242c5a14ff72a4e

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        91f0dce209c3105e37a1131ff867b9e0

                                                                        SHA1

                                                                        af709a486f11d6606cb3a3379b85c54d1f6ce35a

                                                                        SHA256

                                                                        aa0787e989455f351c921efa9231df92738d0df392cc1fb272d5408393acef95

                                                                        SHA512

                                                                        26548e746ecb30d4fca60bbe3e36d32fc1fcc9376054c1987b84c91ee4393b43631b7dcbf17fdc9442bf614e45c6fa3b5ae16d1314e87aed202ecd31922bd388

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        29c2c66067a76b512a04b4469393d1ee

                                                                        SHA1

                                                                        d4d3a7c2db83ba5fc75e1f68ab4dd50f51adcb69

                                                                        SHA256

                                                                        d937e06e62e484c3cd81f81f3027e68f42b262474a95bf6aa4a1e36da7561930

                                                                        SHA512

                                                                        fde646556a42f734a5cb0fbebbe6f1890931abbb819812c8182388d33bfff3df6bd554ea5e6f295119eacefbb32c5c5263ee776dafa3e3bf4bf556456fed38e5

                                                                      • C:\Users\Admin\Downloads\RеleаsеВ-x64.zip

                                                                        Filesize

                                                                        11.9MB

                                                                        MD5

                                                                        7f5139bf0b495a08e171c0d353513463

                                                                        SHA1

                                                                        c51a1ac3db02c2d09800b33c907fde749a306343

                                                                        SHA256

                                                                        322e197be9a437de2ba07ec69b49c164d8c3121f1ceb161e983788407cf760fb

                                                                        SHA512

                                                                        9476ad6b0db052a320874dcde162d99e38e89ce6df41833a1426c7304d1a95adcffc34ec847c8afb7a5895130a8693b398bfcb1a372fa7ebd87babb432277459

                                                                      • memory/2884-935-0x0000000000040000-0x000000000009B000-memory.dmp

                                                                        Filesize

                                                                        364KB

                                                                      • memory/2884-934-0x0000000000040000-0x000000000009B000-memory.dmp

                                                                        Filesize

                                                                        364KB

                                                                      • memory/2884-933-0x0000000000040000-0x000000000009B000-memory.dmp

                                                                        Filesize

                                                                        364KB

                                                                      • memory/2884-936-0x0000000000040000-0x000000000009B000-memory.dmp

                                                                        Filesize

                                                                        364KB

                                                                      • memory/2884-937-0x0000000000040000-0x000000000009B000-memory.dmp

                                                                        Filesize

                                                                        364KB

                                                                      • memory/5564-1412-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/5564-1421-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/5564-1420-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/5564-1419-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/5564-1418-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/5564-1417-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/5564-1416-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/5564-1422-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/5564-1411-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/5564-1410-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

                                                                        Filesize

                                                                        4KB