hxxps://steamcommunijtvy[.]com/glft/19723#

Analysis

max time kernel
627s
max time network
628s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 21:05

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://steamcommunijtvy.com/glft/19723#

Score

8^/10

steam defense_evasion discovery execution persistence phishing

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
529	1500	firefox.exe
529	1500	firefox.exe

Executes dropped EXE 12 IoCs

pid	Process
2532	107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe
3188	107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe
1280	Geometry_Dash_v2.2.exe
4060	Geometry_Dash_v2.2.tmp
624	GeometryDash.exe
2052	VC_redist.x86.exe
3932	VC_redist.x86.exe
1236	VC_redist.x86.exe
2472	VC_redist.x64.exe
1072	VC_redist.x64.exe
1268	VC_redist.x64.exe
3416	GeometryDash.exe

Loads dropped DLL 39 IoCs

pid	Process
1280	Geometry_Dash_v2.2.exe
4060	Geometry_Dash_v2.2.tmp
4060	Geometry_Dash_v2.2.tmp
624	GeometryDash.exe
624	GeometryDash.exe
624	GeometryDash.exe
624	GeometryDash.exe
624	GeometryDash.exe
624	GeometryDash.exe
624	GeometryDash.exe
624	GeometryDash.exe
624	GeometryDash.exe
624	GeometryDash.exe
3432	WerFault.exe
3432	WerFault.exe
3432	WerFault.exe
3432	WerFault.exe
2052	VC_redist.x86.exe
3932	VC_redist.x86.exe
3932	VC_redist.x86.exe
2472	VC_redist.x64.exe
1072	VC_redist.x64.exe
1072	VC_redist.x64.exe
3892	VC_redist.x86.exe
916	VC_redist.x64.exe
3416	GeometryDash.exe
3416	GeometryDash.exe
3416	GeometryDash.exe
3416	GeometryDash.exe
3416	GeometryDash.exe
3416	GeometryDash.exe
3416	GeometryDash.exe
3416	GeometryDash.exe
3416	GeometryDash.exe
3416	GeometryDash.exe
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{e7802eac-3305-4da0-9378-e55d1ed05518} = "\"C:\\ProgramData\\Package Cache\\{e7802eac-3305-4da0-9378-e55d1ed05518}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{804e7d66-ccc2-4c12-84ba-476da31d103d} = "\"C:\\ProgramData\\Package Cache\\{804e7d66-ccc2-4c12-84ba-476da31d103d}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
540	1360	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001de1f-2479.dat	autoit_exe

Detected potential entity reuse from brand STEAM. 2 IoCs

phishing steam

flow	pid	Process
29	1860	IEXPLORE.EXE
101	2840	chrome.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe

Drops file in Windows directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI55AA.tmp	msiexec.exe
File created	C:\Windows\Installer\f7f354d.msi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	VC_redist.x86.exe
File opened for modification	C:\Windows\Installer\f7f3551.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7f3562.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7f354e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52D5.tmp	msiexec.exe
File created	C:\Windows\Installer\f7f3562.msi	msiexec.exe
File created	C:\Windows\Installer\f7f3536.msi	msiexec.exe
File created	C:\Windows\Installer\f7f353a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A4E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7f353a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7f3537.msi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	VC_redist.x64.exe
File opened for modification	C:\Windows\WindowsUpdate.log	VC_redist.x64.exe
File opened for modification	C:\Windows\WindowsUpdate.log	VC_redist.x86.exe
File created	C:\Windows\Installer\f7f3524.msi	msiexec.exe
File created	C:\Windows\Installer\f7f3565.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5629.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI37E9.tmp	msiexec.exe
File created	C:\Windows\Installer\f7f354e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7f3565.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f7f3527.ipi	msiexec.exe
File created	C:\Windows\Installer\f7f3551.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5344.tmp	msiexec.exe
File created	C:\Windows\Installer\f7f3537.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3ACD.tmp	msiexec.exe
File created	C:\Windows\Installer\f7f3561.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7f3524.msi	msiexec.exe
File created	C:\Windows\Installer\f7f3527.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3779.tmp	msiexec.exe
File created	C:\Windows\Installer\f7f3578.msi	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Geometry_Dash_v2.2.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\VC_redist.arm64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\VC_redist.x86.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3432	624	WerFault.exe	96
3620	3416	WerFault.exe	117

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geometry_Dash_v2.2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GeometryDash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GeometryDash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geometry_Dash_v2.2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1664	WScript.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CFBD7A1-DDBB-11EF-A073-FA59FB4FA467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004956291f80c9824cafd482f80e1caef30000000002000000000010660000000100002000000024c4249142684f25742d9ac418a3904a56e33ff65a854e6f64913cd1eb8e1db3000000000e8000000002000020000000aab65e942be556f576c7b9b77df51db03ddc74ad2a05f025a098b21dbb5ba26a20000000d9a4fd95b52b35c692fe63d65c29268e0a5179f9f91b635b46149ed18e90883c400000002367593177f321840d3e38fae20cd3aa449064186b6d4e8d075828621dc20779468afd37ce3e1888a8c6c2ced2739330286d01b18d64992028332285eebf3e35	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004956291f80c9824cafd482f80e1caef3000000000200000000001066000000010000200000002a1de466a0fbb8e19f00295fa2505a6fce4e9afea4d6fccfaf57c66bf8b9af60000000000e8000000002000020000000526e4e23b9263e16a04feab23b70a71d059ad74eff7a40629e0b6b56ed16a62390000000f4aaf1292fde48fde90edcbd5bc822af3d7fe3ec4944719957a85e87944af06aa2e8d9f7d6d47329435713fce7a880bbe3498132643d0cecec7221a7dcf707791d5936b8c03b07e5fd3bfc7a36f51b885bad75412225e992f8446658748524c39be8289bbe018d309ba990538fd3aed1829d9ad7080dbaed77ecb6dcc37e69e8b8c2d5df7fa5bb7570059dfc73b9858040000000beab1af3d0900725aacf90dad0ec052d8addb4a3e1090880d6185dccc3cf1fb9627e11af39f181082c49418c35a4026369bb32241188b44e1917e1753297e510	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50429d63c871db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpCache = e9fd0000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CNum_CpCache = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444260202"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AA59BB2C3F091984181C7A5E56BB38C6\VC_Runtime_Minimum	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6611F283904AB5C4B9E158DE35B82819\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\Version = "237667969"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{E1902FC6-C423-4719-AB8A-AC7B2694B367}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CF2091E324C9174BAA8CAB762493B76\Servicing_Key	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.42.34433"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{E1902FC6-C423-4719-AB8A-AC7B2694B367}v14.42.34433\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{C2BB95AA-90F3-4891-81C1-A7E565BB836C}v14.42.34433\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.42.34433"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AA59BB2C3F091984181C7A5E56BB38C6\Provider	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.42,bundle\Dependents\{804e7d66-ccc2-4c12-84ba-476da31d103d}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CF2091E324C9174BAA8CAB762493B76\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle\Dependents\{e7802eac-3305-4da0-9378-e55d1ed05518}	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\Version = "237667969"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\ = "{84E3E712-6343-484B-8B6C-9F145F019A70}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.42,bundle\Dependents	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\PackageCode = "1D9C529D8C7ACCB44AEB146B378F1D12"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{382F1166-A409-4C5B-9B1E-85ED538B8291}v14.42.34433\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CF2091E324C9174BAA8CAB762493B76\VC_Runtime_Additional	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.42,bundle\Version = "14.42.34433.0"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6611F283904AB5C4B9E158DE35B82819\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{e7802eac-3305-4da0-9378-e55d1ed05518}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CF2091E324C9174BAA8CAB762493B76	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{e7802eac-3305-4da0-9378-e55d1ed05518}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6611F283904AB5C4B9E158DE35B82819	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\6611F283904AB5C4B9E158DE35B82819	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.42.34433"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\ProductName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.42.34433"	msiexec.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\VC_redist.arm64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\VC_redist.x86.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Geometry_Dash_v2.2.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3068	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2292	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2116	chrome.exe
2116	chrome.exe
1436	ehshell.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
4060	Geometry_Dash_v2.2.tmp
4060	Geometry_Dash_v2.2.tmp
4060	Geometry_Dash_v2.2.tmp
4060	Geometry_Dash_v2.2.tmp
4060	Geometry_Dash_v2.2.tmp
4060	Geometry_Dash_v2.2.tmp
4060	Geometry_Dash_v2.2.tmp
4060	Geometry_Dash_v2.2.tmp
4060	Geometry_Dash_v2.2.tmp

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
640	mmc.exe
2308	7zFM.exe
272	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeDebugPrivilege	1436	ehshell.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
356	iexplore.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
2308	7zFM.exe
2308	7zFM.exe
2532	107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe
2532	107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
2532	107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe
2532	107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe
272	taskmgr.exe

Suspicious use of SetWindowsHookEx 48 IoCs

pid	Process
356	iexplore.exe
356	iexplore.exe
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
2292	EXCEL.EXE
2292	EXCEL.EXE
2292	EXCEL.EXE
640	mmc.exe
640	mmc.exe
640	mmc.exe
640	mmc.exe
640	mmc.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
4060	Geometry_Dash_v2.2.tmp
4060	Geometry_Dash_v2.2.tmp
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe
1500	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 356	2412	explorer.exe	31
PID 2412 wrote to memory of 356	2412	explorer.exe	31
PID 2412 wrote to memory of 356	2412	explorer.exe	31
PID 356 wrote to memory of 1860	356	iexplore.exe	32
PID 356 wrote to memory of 1860	356	iexplore.exe	32
PID 356 wrote to memory of 1860	356	iexplore.exe	32
PID 356 wrote to memory of 1860	356	iexplore.exe	32
PID 2116 wrote to memory of 1432	2116	chrome.exe	36
PID 2116 wrote to memory of 1432	2116	chrome.exe	36
PID 2116 wrote to memory of 1432	2116	chrome.exe	36
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2836	2116	chrome.exe	38
PID 2116 wrote to memory of 2840	2116	chrome.exe	39
PID 2116 wrote to memory of 2840	2116	chrome.exe	39
PID 2116 wrote to memory of 2840	2116	chrome.exe	39
PID 2116 wrote to memory of 2652	2116	chrome.exe	40
PID 2116 wrote to memory of 2652	2116	chrome.exe	40
PID 2116 wrote to memory of 2652	2116	chrome.exe	40
PID 2116 wrote to memory of 2652	2116	chrome.exe	40
PID 2116 wrote to memory of 2652	2116	chrome.exe	40
PID 2116 wrote to memory of 2652	2116	chrome.exe	40
PID 2116 wrote to memory of 2652	2116	chrome.exe	40
PID 2116 wrote to memory of 2652	2116	chrome.exe	40
PID 2116 wrote to memory of 2652	2116	chrome.exe	40
PID 2116 wrote to memory of 2652	2116	chrome.exe	40
PID 2116 wrote to memory of 2652	2116	chrome.exe	40
PID 2116 wrote to memory of 2652	2116	chrome.exe	40

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\explorer.exe
explorer https://steamcommunijtvy.com/glft/19723#
1⤵
PID:3044

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://steamcommunijtvy.com/glft/19723#
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:356
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:356 CREDAT:275457 /prefetch:2
    3⤵
    - Detected potential entity reuse from brand STEAM.
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6529758,0x7fef6529768,0x7fef6529778
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1196 --field-trial-handle=1384,i,2377319458133845293,10731346159536186396,131072 /prefetch:2
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1452 --field-trial-handle=1384,i,2377319458133845293,10731346159536186396,131072 /prefetch:8
  2⤵
  - Detected potential entity reuse from brand STEAM.
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1384,i,2377319458133845293,10731346159536186396,131072 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1616 --field-trial-handle=1384,i,2377319458133845293,10731346159536186396,131072 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1384,i,2377319458133845293,10731346159536186396,131072 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1612 --field-trial-handle=1384,i,2377319458133845293,10731346159536186396,131072 /prefetch:2
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3204 --field-trial-handle=1384,i,2377319458133845293,10731346159536186396,131072 /prefetch:1
  2⤵
  PID:328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 --field-trial-handle=1384,i,2377319458133845293,10731346159536186396,131072 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3652 --field-trial-handle=1384,i,2377319458133845293,10731346159536186396,131072 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1124 --field-trial-handle=1384,i,2377319458133845293,10731346159536186396,131072 /prefetch:1
  2⤵
  PID:2608

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2684

C:\Windows\eHome\ehshell.exe
"C:\Windows\eHome\ehshell.exe" /prefetch:1003 "C:\Users\Admin\Desktop\MeasureWatch.DVR"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RedoUnblock.css
1⤵
- Opens file in notepad (likely ransom note)
PID:3068

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PingCompare.js"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1664

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2292

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2452

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:1404

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1108
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.0.775110903\844165958" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1152 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04751421-7aac-44b7-9875-27cae36fb4dd} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 1332 fcd9158 gpu
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.1.1027504996\1846458648" -parentBuildID 20221007134813 -prefsHandle 1460 -prefMapHandle 1456 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9cb7c52-c503-44f6-b29b-921073f07ad2} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 1484 eaeb558 socket
    3⤵
    PID:2436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.2.331043248\1098740696" -childID 1 -isForBrowser -prefsHandle 2020 -prefMapHandle 2016 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c967b95-755c-4fa9-8f9f-ada2c8100e02} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 2032 195ec258 tab
    3⤵
    PID:1628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.3.1082393956\1124672060" -childID 2 -isForBrowser -prefsHandle 1796 -prefMapHandle 1740 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {863115bc-5afe-4b27-ae53-f57bb0f1fbc5} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 2020 d5b258 tab
    3⤵
    PID:1000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.4.2114609308\366940933" -childID 3 -isForBrowser -prefsHandle 2660 -prefMapHandle 2656 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dcdaee9-b476-4293-9793-a29a9e33742a} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 2680 1bdce158 tab
    3⤵
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.5.19988127\1889359154" -childID 4 -isForBrowser -prefsHandle 2324 -prefMapHandle 2316 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08e1e1f0-aae2-4956-840b-60820920466f} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 3808 1eec0858 tab
    3⤵
    PID:2984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.6.1506714388\665218680" -childID 5 -isForBrowser -prefsHandle 3988 -prefMapHandle 3992 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b76c27e-2d07-496e-b127-eae58ff26ab9} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 3976 1eec3e58 tab
    3⤵
    PID:1236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.7.470665908\1108083643" -childID 6 -isForBrowser -prefsHandle 4168 -prefMapHandle 4172 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98b98066-6769-4afe-9c32-79a1999abfbc} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 4156 1eec0e58 tab
    3⤵
    PID:272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.8.1129558286\1847739323" -childID 7 -isForBrowser -prefsHandle 4208 -prefMapHandle 4192 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cd369a1-23ce-4533-a728-88e36a51888c} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 2316 2248bb58 tab
    3⤵
    PID:2800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.9.1434353914\1565810619" -childID 8 -isForBrowser -prefsHandle 2808 -prefMapHandle 2728 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {115937d4-617f-4fc8-92d7-25057f4c4759} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 2792 22196558 tab
    3⤵
    PID:3716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.10.2132978441\1974187207" -childID 9 -isForBrowser -prefsHandle 1620 -prefMapHandle 1612 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77d037d4-3902-499e-b983-934b5d5d7f64} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 4160 1eb04d58 tab
    3⤵
    PID:4000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.11.723789817\2074838031" -childID 10 -isForBrowser -prefsHandle 4744 -prefMapHandle 4764 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2ac9865-95cc-4b50-8af7-aa20611831d1} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 4304 22ca5358 tab
    3⤵
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.12.1544944915\1503229904" -childID 11 -isForBrowser -prefsHandle 2940 -prefMapHandle 4552 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ab6c508-7e3c-42d1-9fdb-527e10ec81dc} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 2936 1eb50d58 tab
    3⤵
    PID:1948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.13.959138675\550020800" -childID 12 -isForBrowser -prefsHandle 4424 -prefMapHandle 2324 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fda7bbf-afeb-4ec4-81c3-85a8e27c5956} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 4464 1f83c058 tab
    3⤵
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.14.1592581116\1369671628" -childID 13 -isForBrowser -prefsHandle 4084 -prefMapHandle 4100 -prefsLen 26845 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67cd6616-b486-4421-a41e-8440f7b5a8d2} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 4080 1f8be658 tab
    3⤵
    PID:3712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.15.1318270646\1706110607" -childID 14 -isForBrowser -prefsHandle 3048 -prefMapHandle 3964 -prefsLen 26897 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {377946c5-a2b9-4e77-addc-6b575375c4b7} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 4680 1f83c658 tab
    3⤵
    PID:3772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.16.1348031022\531858314" -parentBuildID 20221007134813 -prefsHandle 4788 -prefMapHandle 4644 -prefsLen 27479 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {082d0704-feb4-4193-8a35-ba3dbf13c694} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 4620 d2de58 rdd
    3⤵
    PID:3192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.17.1751797908\212091446" -childID 15 -isForBrowser -prefsHandle 4668 -prefMapHandle 4656 -prefsLen 27479 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {daf288bf-4683-46f1-aa58-6e056b181948} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 4600 1edc8c58 tab
    3⤵
    PID:2812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.18.961033094\1290903432" -childID 16 -isForBrowser -prefsHandle 3564 -prefMapHandle 3868 -prefsLen 27479 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8248ee4-542a-4d85-befe-cf4be70eda9a} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 1744 20f5a258 tab
    3⤵
    PID:1180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.19.553620684\1104402405" -childID 17 -isForBrowser -prefsHandle 8364 -prefMapHandle 8360 -prefsLen 27479 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {46e4bea0-30d5-4d1f-b2f2-5334fc67929c} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 8376 233c1e58 tab
    3⤵
    PID:2576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.20.1716086600\227760514" -childID 18 -isForBrowser -prefsHandle 8308 -prefMapHandle 8816 -prefsLen 27479 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b98b7bed-0514-41e0-acbc-eeb8eff6d940} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 8476 23663158 tab
    3⤵
    PID:3720
- - C:\Users\Admin\Downloads\Geometry_Dash_v2.2.exe
    "C:\Users\Admin\Downloads\Geometry_Dash_v2.2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\is-51P35.tmp\Geometry_Dash_v2.2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-51P35.tmp\Geometry_Dash_v2.2.tmp" /SL5="$1B017A,258818887,714752,C:\Users\Admin\Downloads\Geometry_Dash_v2.2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4060
    - - C:\Games\Geometry Dash\GeometryDash.exe
        
        "C:\Games\Geometry Dash\GeometryDash.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 356
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:3432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.21.1114994526\1839782762" -childID 19 -isForBrowser -prefsHandle 4072 -prefMapHandle 4548 -prefsLen 27544 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ec98027-c4f9-4d01-9820-3a07de8c752e} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 5072 1f940e58 tab
    3⤵
    PID:3156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.22.906368749\927425865" -childID 20 -isForBrowser -prefsHandle 8360 -prefMapHandle 8520 -prefsLen 27544 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4db7f2e3-9a41-4581-b948-953dfd57c1fb} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 8512 1f987a58 tab
    3⤵
    PID:2168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.23.1087633339\916591318" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4708 -prefMapHandle 4736 -prefsLen 27544 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd28e754-f588-46de-a7e5-148804bb5fcc} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 4112 1f987158 utility
    3⤵
    PID:2908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.24.1782675365\1854325134" -childID 21 -isForBrowser -prefsHandle 8220 -prefMapHandle 8224 -prefsLen 27544 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9c86f42-20b2-4262-a8e0-f9c3943387fa} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 8208 219f1758 tab
    3⤵
    PID:4088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.25.1171289954\1139048680" -childID 22 -isForBrowser -prefsHandle 8520 -prefMapHandle 8360 -prefsLen 27544 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80dbb71f-212a-41b1-bfa5-977d2d875792} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 8756 1f8aa658 tab
    3⤵
    PID:2648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.26.836645230\1300341176" -childID 23 -isForBrowser -prefsHandle 4636 -prefMapHandle 8760 -prefsLen 27544 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {33411529-0b04-43b3-a751-9fd881c62258} 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 4592 2041a658 tab
    3⤵
    PID:3900
- - C:\Users\Admin\Downloads\VC_redist.x86.exe
    "C:\Users\Admin\Downloads\VC_redist.x86.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2052
  - - C:\Windows\Temp\{47071C1E-DF86-430A-9EE2-CABD040F76A4}\.cr\VC_redist.x86.exe
      "C:\Windows\Temp\{47071C1E-DF86-430A-9EE2-CABD040F76A4}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x86.exe" -burn.filehandle.attached=288 -burn.filehandle.self=292
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3932
    - - C:\Windows\Temp\{DEBCA669-AF09-48BF-AF32-BE686AD24304}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{DEBCA669-AF09-48BF-AF32-BE686AD24304}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{B950A88A-4C08-49D2-B2D7-EAE5C35CA988} {89C9EB37-852D-423A-A640-E4C53E9243AE} 3932
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1236
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=496 -burn.embedded BurnPipe.{926E8CE3-E3AE-4155-BEEF-149099FF1AC7} {21334146-831E-487E-908C-E185AA9D4551} 1236
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=496 -burn.embedded BurnPipe.{926E8CE3-E3AE-4155-BEEF-149099FF1AC7} {21334146-831E-487E-908C-E185AA9D4551} 1236
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3892
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{B85E1F54-8BB1-4C33-AA1C-87A230395240} {BDF0467D-899B-4DD2-8AC3-464161037CB8} 3892
        8⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4228
- - C:\Users\Admin\Downloads\VC_redist.x64.exe
    "C:\Users\Admin\Downloads\VC_redist.x64.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2472
  - - C:\Windows\Temp\{C0D455D8-71F6-4B5D-868A-46692D184C98}\.cr\VC_redist.x64.exe
      "C:\Windows\Temp\{C0D455D8-71F6-4B5D-868A-46692D184C98}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=288 -burn.filehandle.self=292
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1072
    - - C:\Windows\Temp\{B10D4C7A-BE11-45DF-9414-43D8DA80C403}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{B10D4C7A-BE11-45DF-9414-43D8DA80C403}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5838F5DB-C7DD-4203-B4B9-3BB281BC59EE} {3C0D6CBA-1C8E-4D09-B77B-F676BF5EDF70} 1072
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1268
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=504 -burn.embedded BurnPipe.{DEFB9DD6-4864-42A3-8AC7-BCB0ED3B60E0} {D3E133F9-0274-4267-92B0-FD6D2A974CD2} 1268
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=504 -burn.embedded BurnPipe.{DEFB9DD6-4864-42A3-8AC7-BCB0ED3B60E0} {D3E133F9-0274-4267-92B0-FD6D2A974CD2} 1268
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:916
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{317A2B5A-638B-465B-87B5-E7E11318A017} {0A511CD2-A9DA-4968-BA7E-8981326F97FA} 916
        8⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4568

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2308

C:\Users\Admin\Downloads\107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe
"C:\Users\Admin\Downloads\107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2532

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:272

C:\Users\Admin\Downloads\107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe
"C:\Users\Admin\Downloads\107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1288

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1360

C:\Games\Geometry Dash\GeometryDash.exe
"C:\Games\Geometry Dash\GeometryDash.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 328
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:3620

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:3992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x190
1⤵
PID:4660

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7f352a.rbs

Filesize
15KB

MD5
81a2adc0a6b3ccf4858173f6560ac384

SHA1
97a9bf6418267bd4c4f2447845b9921b44066c69

SHA256
eaf3fe0c255af60f94f59f7bb06145ff99d7055b57483b66a421994463431742

SHA512
a546f7f928afd90732da20feae6a5726192eb63a3633570e3f7014bfc9a1f4660ef5a7e1b800f346c8f0112e0926a0336428b871674c3abe45f3eab0561df0f2

Download Submit
C:\Config.Msi\f7f3535.rbs

Filesize
14KB

MD5
030f3bedb952f8808f9748e41f7f1962

SHA1
3e4fdc83290c23516bee05279a83bc8bc2a6f88c

SHA256
fa3575dbe354870864cf2560cbf17a9950e72285fc6a6ee87cff74ccf4279c57

SHA512
8302bdab98aa6a334fa33d6afa57bc981d5edce9046381ab53bddc13d740f428540cadd4489ce6fc0c9578cefd353e3ee5d93fa37fc5fe2aa9da3ac4fe0bd069

Download Submit
C:\Config.Msi\f7f353d.rbs

Filesize
17KB

MD5
accabee7364ca33b9ae2879d0821c557

SHA1
2a123b65ec94fc2037c4c0f7f6438a8bcb7eab61

SHA256
9c6568ace623a13dcc0eb5216fc2394894913d915a68db219e1b106f4382bc3a

SHA512
649080f7b5f5fe9f154ef929a60ed3530da5e944c075f5bcbf44886f90cc48ad7b601608f1d65bf10c9c60d2bc2856ebee173d382c9f0e3b8010224aea4365e2

Download Submit
C:\Config.Msi\f7f354c.rbs

Filesize
16KB

MD5
2771ea072aaa8afd40bfa04524ed3ce9

SHA1
8b1939293b230fb3ecb2a73ae03bc984280c7c4f

SHA256
88bce1a88d96a2b15f11a8b3df490fe140b029a56b485328f7fba5e8428c980e

SHA512
b29f5deafa8adc5d135a502907f6af22e5a1798d02eb7b23f54615fa85131f5827ef34a98e67dd808539b10d9ca68290b6aaa43d8653eeb8f93eb79adec54364

Download Submit
C:\Config.Msi\f7f3554.rbs

Filesize
17KB

MD5
0c6e98ab697b6c0b3dd16239f63c1cd2

SHA1
4940dd6a46cfef12ed8e1c172d7f90ea9bade414

SHA256
65496223bba265a167b9cee0cfa64fcb6450688d51e4b7e5f2352d7c648b4c32

SHA512
3d95ea239b32a21adfd98daeffba74a406ebdb637a8d16fc26662520628898b5ff8dba091a305c4d679ca5c09d888ffb4c09f2f410b1043a0991ecb5c3eaa605

Download Submit
C:\Config.Msi\f7f3560.rbs

Filesize
16KB

MD5
6b7c72030404d949daf84489a6fc2570

SHA1
74b6f3ac22bf6313f73f2e5fe24353ad7d29bd0e

SHA256
27cfa6d1f560c9e6d33a3fb63778e1b6db3d753e0360ef82b27141bceedb7f7f

SHA512
d685c19bd2a8ae309b2a9937320c4327cbe3c6b44152c4e4ad860ad97930bb1b33f67e354d54dc4f1dfbdd96fd864d88d658a6280d0ce400f11a5e48dfa3ca17

Download Submit
C:\Config.Msi\f7f3568.rbs

Filesize
18KB

MD5
2362c600ddc5fe78dc771705ca01fbbb

SHA1
5bd2ff5fbf958feec9565091e61468edfeabdea5

SHA256
a16a7fd51a1162ab669452803090b55cec51c7674f063d6815282f2a40a73620

SHA512
6145bd667a1a3e3a42073c50196f4d287317eebe5fa34f9f47a83aec20c17b34941acf2574e14f6d21cab03f4f77a4dff9c76dfdf759e586d7b707f33463b21f

Download Submit
C:\Config.Msi\f7f3577.rbs

Filesize
17KB

MD5
47bb8e3161b173ae2d98b9360559b68b

SHA1
cf923260d7208afc47f3b3b4df1ec54b62c7631e

SHA256
0619b80aae202787ea135488721f50bdb51e189615efab8a5f058ea8e82230b2

SHA512
c697350f5855339eebf5c646db34e8f12426dd8ae8fbd4c88142cc619cbbb0ead2dd2f22e3605da5d3412f3fc12a19db5baaa4d434969ab59d3d210451a41503

Download Submit
C:\Games\Geometry Dash\Resources\sfx\is-1DJA0.tmp

Filesize
25KB

MD5
5eea6f7ee2de54968abe281a35feda8a

SHA1
11ad23014ae94a2ef000ee5beafe000d6e50199e

SHA256
cd0f0544d50833a5dd384852a876a7a0a8878fbe503d3a242db7628b23ffe3c9

SHA512
71bfcc3edeeca6e2e46e298f96b930fb82344074bacf3f61d061a43877a8e604717f62608bf5592585e136b296672acdc5c68bfeca0f5320da43fa037ad47f6d

Download Submit
C:\Games\Geometry Dash\Resources\sfx\is-2EUU9.tmp

Filesize
13KB

MD5
64c4ca6b0dd89f3b721a31f8f8222cea

SHA1
fd7c162d0d783c2ce2bdb80dd0bc4633a69330c3

SHA256
8c14d2bba032519b7beb760f3d857b00874cdff0f8390e940d26d244729f3cc0

SHA512
495b254f3df7a6d71b7f2188afede88dbf82a42357a69c51ee27965cd642ba9e60a696876954d9f0e273b8b572ea357ffb93eb913e37ce7566823ad8503fd0d8

Download Submit
C:\Games\Geometry Dash\Resources\sfx\is-BEJL4.tmp

Filesize
8KB

MD5
62d1bfd2c2fa7c469eb6e0dae695b953

SHA1
cb2bc3ea9d0d3ea16d00f043cdfadf9dccbc2362

SHA256
8d708630394181565667a45861a6f6105d0dea60f33cb413f4d284a973aaac84

SHA512
1c935bd2a728d411ee4f659e633cc928299f66ef4a91a338f8093972df169fb76249364d211a783a4b702cd34ba1a43351058c79cef76b9907176cd87ee107d5

Download Submit
C:\Games\Geometry Dash\Resources\sfx\is-CPGOV.tmp

Filesize
10KB

MD5
cbe30b5fefa6d4de1f23b089c222ee45

SHA1
fb50dee951ebe2bd650d5bf97f2750c9b4749b95

SHA256
f6141b42c432d04749a5d1175b9978357017fc07a829634e7a0414740b409566

SHA512
f5505934631f3add0424c040b3ab7a8bebb890cd524089a1f9e5100c0fdc79aacf469abff2929233b6cd44bd0b22993c365342dfac829083d77f68845b1d1898

Download Submit
C:\Games\Geometry Dash\Resources\sfx\is-D5IGS.tmp

Filesize
62KB

MD5
7eca3df6e46adecb0596c5036ad2af7f

SHA1
c624254ac02233459269fe9487e88e3ce9b76e31

SHA256
b9b67136e89b2edcad7bd4fdff4569b281ee4dad3ef91536cc5009228d5f0e06

SHA512
e33712e8403fbe1f6c633525332f4259048669f040227042fc68811ca7fc263669f5a494ec7cf26905479c2342340841cd33b44dc58998df25db4cbcfebbfee0

Download Submit
C:\Games\Geometry Dash\Resources\sfx\is-DVK0N.tmp

Filesize
11KB

MD5
87d3094f8dfe01e7c4fcc47b9c43cc89

SHA1
ce5e68a8f0bb9ee6356ec832d9b7f1ab90f176d4

SHA256
11515a2dcba6f819df8e0336dadb125c6a691bb22094f9a3cd0e8bf1038b792c

SHA512
6bab5a4e4e51e9e01aa03cc82903ad6db15baa65078f85379e623e80f4b69b3877c72bdbf63f33d63077cd63297ac61b32b491ce7551687aeb7fe5b82b2bbced

Download Submit
C:\Games\Geometry Dash\Resources\sfx\is-U5VEL.tmp

Filesize
32KB

MD5
8af3469b02e2a7286c90a57accc1668b

SHA1
e38cd05b789cb2badbfbf3e3eb4605263fc330fe

SHA256
a814a2ac3243b6f7372aa65fa9086826bbec13b8aaad79faeeaf40fd887a1dcd

SHA512
ea61cae1c945077b6018f8449d569d2e752964b281a9bdad5e5d4ac9d048684e017b089171dbf57f1622a12d60d5fac97d454cadcaaea913ee2811f487b96509

Download Submit
C:\Games\Geometry Dash\is-9G5RG.tmp

Filesize
8.4MB

MD5
b435bf5ec944b5fc1a85b9754b0c78e1

SHA1
2666b6996326630c1152a5a463e66a753f5d5325

SHA256
e101d6c32894d779af789d90bd5f3c196d673a06f8834bd6fa24e767ae03c3c9

SHA512
f60c7399fc0e2c284d618a2e36b6f30c5e6f3d9a3426a63e0d81af6d192aa8bc2b0fa3cf79b0618c7f33a092c98d2bfa2de6ba7a420e37dae60c1dac05377a79

Download Submit
C:\Games\Geometry Dash\libcurl.dll

Filesize
1.1MB

MD5
a629bf05e48171a7152b15c479727da3

SHA1
b39c487c3a8ece83ef8bdecd2e37537c6617f9e6

SHA256
db4e84c77b41bd0e40e3b29db518faa44d4a40df802299befc21f87c16ec1124

SHA512
13596fc1f5be8de92177e7ee5e09a37e7f829ebc36678ff5233b627b7f798307270c69c9dec05407c1d758ff421484b66261a9e2c3abde7cf24fb0b5b15774b9

Download Submit
C:\Games\Geometry Dash\pthreadVCE2.dll

Filesize
76KB

MD5
ae4ae0ef65becf8684db223ceecbfba7

SHA1
1826006ee9ca5090eacfdca63bcc370e2be701e6

SHA256
27a8bd5814bf5e67858856f5090952e558c6e03fbebcbd66f7d8eb8fda2b369c

SHA512
880b38c69a38c02923988ccafba630e8a5a12ec885d713fc863f69174b475e408427fb68acdf6a3415a3bbd6cb80a1eb81eb752b18ef03a4590cdb36c9f52e3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
38c41e331e27f4e60bd4d0797e2336e0

SHA1
34aa46eebd6365a39dfff36a16107b413d514995

SHA256
689d67eb9f8d1d65cde3d332f79e4558b81b1009550ce368ccce072ae1b17d41

SHA512
bdf83c64193616f365ecaaeb7c23689cb837ea491e32d8d2cd5332ddd7e920a010f946e29b8692acc34e1ce5c68592bd58786183f22cec569bbedec997dc3d71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
734B

MD5
e192462f281446b5d1500d474fbacc4b

SHA1
5ed0044ac937193b78f9878ad7bac5c9ff7534ff

SHA256
f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60

SHA512
cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\459ED9858A73FEEF61DDD4034780A162

Filesize
345B

MD5
9f1779f4e8650c038471b3940efdfe43

SHA1
ef99ebc1674cd784ed490ff5b0ec7e97d5f8e44c

SHA256
49ff879182aed63e56bf048e7150f8f0e780d5b74ee140cd55618df01f6cdc8f

SHA512
9e4ac24b7edf95f4a36c2f90aba0af218b93d6f06e1278c296c2fd8b817a483787a18844e383467a677a14c7204c16dfaa5b4f2ff8cded78671191cb42bb5ed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
c9be626e9715952e9b70f92f912b9787

SHA1
aa2e946d9ad9027172d0d321917942b7562d6abe

SHA256
c13e8d22800c200915f87f71c31185053e4e60ca25de2e41e160e09cd2d815d4

SHA512
7581b7c593785380e9db3ae760af85c1a889f607a3cd2aa5a2695a0e5a0fe8ee751578e88f7d8c997faeda804e2fc2655d859bee2832eace526ed4379edaa3f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
1KB

MD5
04dc32fc9ee9ac84c7405b58e5894ca1

SHA1
a27f481740471cf35b6fd3b3fee4cd33162d54f2

SHA256
3eafdbc6abc76256fbfd3d98f30e7393dc3d0416ae3d340e17a7a183cd727d92

SHA512
aee73ad14349e5a87bbaab2f4d283aa1bbfb64b06edd45e77fcf4c14083601d04494e994fad624d724e0da5b1ced5f4b1fe30e123e175271afc6bdf20b74036e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
bcb1528c62bb587c638005d895405623

SHA1
8b08a801f93dcd0d422b6187ed90597c8da03291

SHA256
2fab8e79f74ea4c06ea30e7148477c1648e73d8104e8d1b4af9e0408c67df451

SHA512
c8e30c4d3992aec7321e1e3b0619ee59fd48e6e17ffc76ce8c13b3eddc040d6ba649758f6708ad47a233142574c06897e71f4fa2952333c5e95ecc0c43099482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
980B

MD5
39b90291bf6e1749cf3d50576f056e0d

SHA1
c53615bb606a1469534f8ed326824f092883b53b

SHA256
5866af2a2b9cfdb3154c41ce93fcb8e1789c15399d50ecdf5a0aba749a0c2dc5

SHA512
ffbebe61a96c05b86bb95b7a86469791fb19ee81a9a9d6c47badc32c3a8b9f51294fe6ea1f7ac1542b4c574f58b6d3001e4e69c7a71da8d72d8d465e5acff185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
f4848783e9882d906b2276f641825de2

SHA1
b036d52ffd125e40e7dcd1d9382fd2ef934a9c05

SHA256
13bc1100795b04fd60d1b76085311b1fa5e3afa65ea5eed8244c94f1478d660e

SHA512
b5644666a92b047a21fc77cecfca829b7c9d2dcf1fe153b1f4da2daa7705e19cef88f011e543d8d9fc4a112c0f19d1f0621d62067437c2b211d0ed9121fb9e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
643bee741c9a8e2375f5d4a436d5948b

SHA1
06e3fc3b5971e20e5688ad0efef6c4f31c682ca5

SHA256
2c2dd7d013626ededd588532542a663fc0a0edf368d266323d4b455b93018c93

SHA512
54bbeac1664f19f36adacffeec25920738da8cb00b0dcec12c484aa645b9cdf955b220db876b065ee4d79a741004bce2b5c032d5d0513665d762096ba1496157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
3bec099a333aecedaeccd3a2d99e1274

SHA1
6c53013791755f0982bc9bb7e3bfe4e8d05ff3d6

SHA256
bc776e1b9399b3fe97f93711e16bb85e28171859eaf9e3d402bc56d18e36fa69

SHA512
84364d85ccefbe77ff7844f7083db0f8d2bb0044f717d868a9c85db4f693605e4284cb9d9e6f782aee49e6d43a60a5ad42bdeb59782bcd25abc7e7dfc44aa468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
66acb4f11cfcf1e1c3c7f860ed4b5951

SHA1
fcf995a3adf506bf3e00b5a44dbb444f11fc52bc

SHA256
fcd207788536d0de60ed735a6c53bfcd8cd81762aed028ec734e5872f7150171

SHA512
09e11acec3b8a4ef1e36a16dfac5c94faed64a49452a57a01054fa9af21d9c809bfbea0d0988c1923c6f7491516cc491db837c61750f4dc1ba1c2d674ca246d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\459ED9858A73FEEF61DDD4034780A162

Filesize
548B

MD5
e112fffcd486812755cad3a353c91676

SHA1
2f0fd5d77f718725336d023092a958d70e497898

SHA256
dcf0a6aff50a6e6fd57ed68c3132c3829dfaa7071b0c5b20089c84fc52d253ce

SHA512
83a9747cf13f52fc1ef4c8a16e4f2f0ffbf3d143e58e72b469e7b04b738d3a09042f2fdaf06407df786ec213be0eabb075e222a17abf55abfd9047082d04e0f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
75f65b907a018732c6bc7ceb2be13813

SHA1
f14ff9afadcef82441b7af1aaa6f8bdc8808ef77

SHA256
8d9a8f41e88b87d5093876ba233c08027737ee73253108796a397933fc5af20d

SHA512
79d551a85f86f2edce5605f2efdfa142c6edcf97febc3cfa1ee374b8c246d60cb8df1d97436a73e70f6ea4929db355c5acf2cbce3829ff6bd4efd211042fa88a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8f9453d9616f10b515cb372aea70335

SHA1
5c0e659b83aae97a9fef7b87f2e41553332b54e7

SHA256
d2db098e694f12dfa9abc7f78123df1ca1862ef35eda88dcbb531f771bc1dfed

SHA512
c123a0c6c55c0037179fc52aed73b40340e73f09977e2b1fca69971cb0d030226680c8d0bd6b83a801af456172da2898a7d05434f785e141f2bfdeff46c87e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82071de7df19ddb8247c1e81b68c7002

SHA1
03c714bc8e4d2feb87d8cf908258f261ec9aef28

SHA256
f36291f1aa73b0dfb24a709a155820fc8d7d4725eb0d2d5181902759ab3df3ca

SHA512
913cc1d5087035e7c012b265b9c92f662152cda183c8e811fb27d04823144958a5de288cf6ff3c8cda4b8e5db23611031f24ea2d40df5e224249ffc60b649c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb04c8a841600077a3dd790f356bed10

SHA1
8207ddfa7937760ee379af95f61da30ffa786797

SHA256
7f3bad4071589bf1cb9690fdc29613b3a8e3bb15862233da6b9a2925ce06360b

SHA512
5ded08b8e93589e239c0f04dcdad0d0fa3f29f0e408076a9143c444a6a8bc8ea960d6dc5393d8c6235a0237ed22108e43bc8496a7449a47061164c17b7f8b0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6180189e3e1131b0645455ca0c9bd1a4

SHA1
e590e92a61acb2eb1451f8130ce8c51e958f8fab

SHA256
9dadc205a0de6c1183d93f5b9143f739abcd1be716d37350f1cd885b17fc6281

SHA512
325b6284e72723e8f226c2fdb233fc5268007231864b4fa521caa5b48f7070e9d262f7c3af8d07d1a250bb9fdbedfd0eb0f9c3cffa729e4092da131af879f3df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9dfbe2f2a11f94410144fe13fd50a84

SHA1
7d09068b382d64d992a68ee969858707ac3b1463

SHA256
69df4609cf02b3effa314b82b8a899a095778d2b8b2cc8ef77ea117406cab886

SHA512
dd994fca6f2885751856af1ac7620b1dffeb5f1855e93b30521f33ca33bbb5c672256803f29246cfa3dc0e44c23cef20015988f14ab62abd6892754891e168fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0283f51818d0553829be22a4a3d93049

SHA1
2f979aad145883256fed0a44217b5321248d93bd

SHA256
ac457a3d41175ace1c3cbb4c323eda4b4c0fa19836c23ada3901d27706543b12

SHA512
4df8743597a414542d5f52bb150e2ab3c954ec71a9ced2a129eb089ee34bdeedc4fe0c83884618e0d261b2378233203c4c516a42584f0cf05adcf90c8c852c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03b012bc1f3a66a9a5945e56f1d3a80f

SHA1
3ef9fb3dfcf92b81ff1c7bc95dceb5b875b58389

SHA256
6a7b364fffa85e84cf8207da747d7adadc85cdb717381c171a2fa419c8865b36

SHA512
aae96efd88a593087927378e7f8c8520f9c3374969eb2da2bc4e0076fcdebcaf8d8f10d1dd373b1b140ccd09845d243e63002dad367100eb1954ff0350dcc073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6f3e5f74030763df6d54235092a5d82

SHA1
efad4856ca64d119b8b4fabcb0e71903cb184dbc

SHA256
e25300a99d827bab98b77bc29cb4bbd0d1baec0019091094da048c86d968b4c4

SHA512
35a2952c1a691217e829be34ef702838dc41490b47b04e6861a93573439440e1987afab606a707be6ebced4a75b3b840976ee40cc800c3b2585108847ca69ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c163e143192ebef5b3d5a820c6c0eb76

SHA1
b1093bedf3daedae1ac1c432cdbf1cb8021b4872

SHA256
c84174ce8f65bfe125bae405fa4e179f6f79603e0a428923fdf77bb8b1dd16c7

SHA512
f62910c3a6b553e6ee7e154082b760c838482c15fda7dccea6c0bbd8e415a3de9959bff7c9580a96ab9c48f15810010d8ee7248eaefd96c5b0c9ccc83ff1925a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2fccf4eefb6484667cdb9fe909eca0c

SHA1
881bc0d7bc60a78e385e9105cee11f6eb0841549

SHA256
cb9fcf2a944900c54aa8d08bb598a669c985ba82fd260fd43e0aab5e7a53b4dc

SHA512
5b6237bff201540610cec92a6e6a0ac88a87ef2db81ac7f3cca1d32cba112d9aaca72c0664caafaa48acf82f43229abebc5d7d4b3c6be1ccf9139118916ba91d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cf7569f65f708f870588a4cbc67db3b

SHA1
ffefee0ba21d828bb34b2134f9efa9ffeb4aae9e

SHA256
4de9cbb269e3b0d526058ea3d397d092f567fe5400d36d44af28eb233af452d1

SHA512
cbfd19a4e3da01cfb6630a85ea6c6b6b319a1688fb940f0c0f058814f537719067e54e26b2c8df7d483e3990c89dde2321042f79699ec8768f7dbebaaf8c646e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2972250c5a7cfa03b904eecaaca76e6e

SHA1
83f3ef0a2fe5f37fd9180c2cedf1b6866b7847a0

SHA256
760e400337a47289745b1277c7a81d617b87b7dbde340b8d44964d65223daca4

SHA512
13defdd3a117ac227526884f5849272e09ede86652345cc4cf2f219da1e5f7520c8478dc46a948ac54e40a8450202231110101573bd012b89a8ce4b67bd356eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a955aeedd02789c57782a7fcd36c8982

SHA1
1bcf1e439ff1e8bfaa5423983b1bada5e5cf5225

SHA256
08cc958108707375c4d0ae8deaec8309f619adf8ee1c997c8fdfe7d0ca9b3a36

SHA512
38f754421b631d58221bee633e41146dc89f42fa9692af0e6f9a6df1080652a4b3ea8928d62c1901ad775aaff602a2781a4c89218fbd89071e7f51dc1dae55a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e4c8a8a7e5a606d7ba27365bf359af7

SHA1
822329a384afdfc7370a1262c9a19cdf7582b3be

SHA256
9678c760649d3797ea8eedae4be949ebffb870dbea62b677a670b51b1bf9018e

SHA512
4b30f2b87b75ca12747df0a5bf3908d757606ae40675843b7b44b17f7a5b8fe230579d3e0af61ef3dece1095325d237012c8249a6757ead4ae11408625879b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77fff78d4500b4d29629108a9074cdb6

SHA1
eddd04ca8ae9f7a5dbdbac4b4a4ccc3c2233fe55

SHA256
e153beec436bd3fbc9de78115b551f11d3c0b4c85e9ea05a629f0f66a5204d13

SHA512
0252f3b200f8c4529958eca0d27fd638bdaa48e525dd6912b5830fd6e2fcff34f56e0f3a4fde9a1a3e5dc0cc85f8279673102bdc2ff9bfd9a2a3ec9142f99f50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b562c6678eba63f0b79de593aa65caa3

SHA1
8b0ae223609d21434ac153a54ab48c0267fddcb8

SHA256
947796f453a6a0c342350a119b9b8306528afffe49eb9515e080831bfd68a2e2

SHA512
18455678e7263c68221cb46b676f57e65770b06dd626f25d1a037a8cfabd5fd3532344efc46a0aed25e0a0f85bba214b9b25bc65620c055ca4f1f1e4b3cf37b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9bb8f9d67e9aebd6e635bf91ca18b48

SHA1
42a3e7110671864fbc5664294ac1cedc2b79243e

SHA256
3f789147636400d95f839d22d08c7de1394f3be8bc04faece19bf9b363e1a8ea

SHA512
ab6573991accc6c93e56b278c31978168d918aef69603d956909c54fe7220b1c5e911f7fddea7daa5ff7849a2723b6171629f6e2fca12bb940c363e7cc439649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ac92eeaecae75b6cd16b6e848164526

SHA1
a62cde55b0d7c5110318206b5bf2dc349dbed0a3

SHA256
e2f102921de03fa9e09743b12942dfeaa852601839693ee584729f4242474690

SHA512
601a32fe15fa71b1fa18006ddd35a09c38813e77b7cbd7b64314f3bd919af4255cd06d91524990edfc434c2ce88aa5ed6206cc1f6e1bbb53216a84aa504380e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
006098d04bc1117334de77ac4e937d9e

SHA1
de6bff1aee56a4ee241a1306161cd11d43a469de

SHA256
d4afa0b9f93f808d29851495e7456aec4abb53e00efdbe4b361f4aa3120aebd8

SHA512
d52b97767dfe4e31471af3d3b77ded21e555c0349710bf9875bf6370d6e86361558ffa7b803f8fb82aa9a94f6a1583c7c3053eaa177eafaa5a42a8442b9b2931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5db087b694d097d270f519602fdaa03f

SHA1
28fe41da95623230268bb2d6bd1d7077873a1227

SHA256
520753cabd9cc027f9b20420745014efe69216021be8e7257217e7dd84260b35

SHA512
b6914220632b38ee6cc3ae3c05ee4fd6ea3444500ef1a306ad1d7fc83c0b609d6b2db4312b22c105766b346c2e864b9995ea108f465aac1bc1f2ae5806ee3fda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1783169821b680d5a0606895b0b3d261

SHA1
2ad81790dd3de1f0b42316f61dc066fed2194008

SHA256
db1192ff47e31bc98daed91f414a07a52e473777fcf05ee20c352102a4d35025

SHA512
0ddd7166220cbb41acdadf89b499c6ab3b9e02613ee792dae3c6ed1ed51230cc9e191995497061469e3183e5429125fad3e320636777feb095e78158ca5e2be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
888373ed2a9d3ab23b5e11fddf49c8a0

SHA1
fa19e9f0e7874b7ebf54d767df699e41cc723e44

SHA256
b2e001380bc7a2e1c948ae5f520d9625fe0cb2878b9553bddcc89d4e25264e59

SHA512
2249d2419e4aea5ab232c262d59635d33e3eac860bdb56327984c265f65e12e53ace9a0086b080b1137e6939c129f73dff7cdda12db542d686a6290a0e9ef7ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20f31332f82e7047cf44861b3e172d46

SHA1
cc3bf3183eb25d6154f30757e4392635066aa13e

SHA256
8a2d5ca03acb281699781b88d1e81e6cf8da46d1d5204b99690a1d67476e6ed2

SHA512
0330df645516cf78d6cb20269cd7e2ba92020484f67cbbcc9f45c19fde7a2f7ecfa3939b4d5113ba2d516ff404f5b4f3c19c45fdcbfe7711340c8afe1551b110

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fc4e4597c838e8d88f93ff2d3f371af

SHA1
8bf9fa6d16cd45bf73f915ca8c7d09e3d4b990bf

SHA256
1cf75441ff4d47886fa315f9523c9fd8d4a8e55697c7ac22318bd14fe6260e99

SHA512
bfcc9ca5910e71d422698015360965cfd51381bad8902f1d90dff73a945cb24d3c65821b2354bcf211bf2b23fa1bf7bbbb7c4d76ee03c5960bec78e1492b67c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb4529eb89b95736c185e13af9298930

SHA1
605e98d7b1450b966c91ae6ba19bcacca435b0ba

SHA256
db4104eed9c8eb9088ddb3f76e478624b7df7d9182093a9e5e4aae679a31cbdf

SHA512
36dc820935bc1e1fa68403a14d906b37081cf03753749a22bcb7505eb3b64956b1a47a29f5b317a02e343d96ae050234fc8b92345b963c16abae334c2ef4a0ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c136a28beca669d18af2f228400a60e3

SHA1
93e4ee460de6e3da99cf0099395c69eda6739ef2

SHA256
759f6680712171a5f1a9974b903fb94a620fcc649e26595f372cd27107dd9cb7

SHA512
366552bb104767d220e4d2fcfe3707b69b0de92f2d24f4a97c104caf3ef5d6d522228183aafda8572cf90f50411b347eee0cdb018fea74f9ae06c8681db661be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5fc2850b7a5438a9bfc66f774dfc0c1

SHA1
30a2dcf81ff06d1db675ad4b48e110a9d960084d

SHA256
9e06e556e6192b42ce92636c5254ea4071f35ca1d939a62302878c17be7dc1fb

SHA512
cbe2f3e58c6eb6ecd42a4f43a99a067439ea7c3665fbeaea102de03b59930b4340688ec1a7e18041ecaa4b071dcdae177ce7260b272805445187984c0254b28a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
c1200d471136d0fff6cfb559adb18816

SHA1
46a6caf9657aae787dd85ea973833cdf016c9806

SHA256
2964bd9f563a43aac4987fc1dc136e66daacbd92c337eb7eb23960bbb202fd7e

SHA512
5f7bc15fe05d7100a24a58f83473373fc543721565ad1de20ddb8efcd8ba733071b501fc83bd96c7bc9dc1963849edef43ee2115722e17b5b0617e49f565b557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
5d272d20b8056ce80638d620cfe30f38

SHA1
3240aed842cc9070cdd4db2d1bfba1ac35aacfbb

SHA256
ee0d89ab5827dc0b6681d251144d4e6378b47a09b1576c48afdf20101d447c7a

SHA512
77d539837efc18edf10be18261ba95a7c213729132f91797a46c19a2b36fa2c9ac6940b00ed61a683be670c44a6d03d7a09c8ca76ea813472d4ee72ff2239566

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
5eafa364aa899a94ebbfa1ba92e5f0e3

SHA1
e307c8277fb5992ad06fcad11a3b579ea6de3f34

SHA256
4cdeee8dee877ba1d47cd498aa5b2034ebb6009780d9ab80b60062a3c07e6a36

SHA512
766724f3b3e9ec99000058e40357b80a32904627cfc90dbb182023c2712822400e7d13fdb3335bcc447c5602d5c2e30d37aea14511d3405eeceffbabd26a1ae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
480B

MD5
622c62624aa7317936bbfc856aeab71a

SHA1
62c9f1897ddc5533b9613ae6f55cc2dc3ee9be08

SHA256
0a7fb74d27bbb5a2ffa3b4cc2890e3aabbc6bc97af7a28d8bde43e30b093aa8a

SHA512
114ef5a0ae1d1cc8a0db1c78b5b3da179d527130162da31ac50d02e832b7f07ca7e55c6e30952ccd7e12ca83634449d8e9c04aea48e031bbbf4478aa97d008a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
0868b54835d204c5127be36c32222864

SHA1
9252baa5d66f0209b587ec340b826a29915c072a

SHA256
3328d421b67fdf3f4432926c75e0587eb09c0de989e56fc055e708a400632275

SHA512
04f432e89055131b3bf61cfcf22fe72d1eaaf580903c9c22f61186c947573acacd912c00bf34b5b1bd51534396a7cf9237306d7434676f4759a7a9475779f7a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f50441cd2157d372c6652dd804bffb26

SHA1
2b6a35795e5e674c014b4e59850de2ec165f280b

SHA256
0197a2060b37219697df3e23e903223558a495f699496fac19228a5030c47399

SHA512
5a80c845a84ee6397ec2976bc5cfd68af322f29e9f447e7f42375e80fb6ca861ce9085a631f197f9f9a9fe5bc6e19236785583b82541260c234dabbaa2d43e63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8dea62d8-3384-450f-b78b-a34fa1207a53.tmp

Filesize
347KB

MD5
09b4223608f9c0a70bd9e979e654735d

SHA1
b0ae1fdedc17b97a64269011da8208359fc16a47

SHA256
43e0e71f403884c8d53c963b4e03bae12e8164a7282c75476905548868538aea

SHA512
9e735c4e240b0c09d085cb408e2b7c02959688b5deed64a0a5bba3ac4aaaf5fdab7c6ecbc25d41d0c9eb26ce48f44a47c20582aeb7f03afb598cc7edfa747dc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\766941ee-10ce-40a0-90da-c4f0bd24bfa0.tmp

Filesize
6KB

MD5
2a582c404bb3397c7d56fbf98e411580

SHA1
ac3a6bcea746bf91f1f9ddb9282759458e2461a4

SHA256
1b7e3319e228a9bdded25b6ada4b381163d85e0a206dde17e1d22d917c1eb78b

SHA512
bbc70814f3f4b180d86c7693f72d54378eff58f8919a813dda2e88d6830738edeb833af69b88fc352c7ea218cc9e88a0d6dc87ec097773959889d49f51082213

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
115KB

MD5
ce6bda6643b662a41b9fb570bdf72f83

SHA1
87bcf1d2820b476aaeaea91dc7f6dbedd73c1cb8

SHA256
0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6

SHA512
8023da9f9619d34d4e5f7c819a96356485f73fddcb8adb452f3ceefa8c969c16ca78a8c8d02d8e7a213eb9c5bbe5c50745ba7602e0ee2fe36d2742fb3e979c86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
120KB

MD5
6168553bef8c73ba623d6fe16b25e3e9

SHA1
4a31273b6f37f1f39b855edd0b764ec1b7b051e0

SHA256
d5692b785e18340807d75f1a969595bc8b1c408fb6fd63947775705e6d6baa66

SHA512
0246cee85a88068ca348694d38e63d46c753b03afadf8be76eca18d21e3de77b495215ed2384d62658a391104f9e00df8605edb77339366df332c75691928efb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
119KB

MD5
d45f521dba72b19a4096691a165b1990

SHA1
2a08728fbb9229acccbf907efdf4091f9b9a232f

SHA256
6b7a3177485c193a2e80be6269b6b12880e695a8b4349f49fccf87f9205badcc

SHA512
9262847972a50f0cf8fc4225c6e9a72dbf2c55ccbcc2a098b7f1a5bd9ea87502f3c495a0431373a3c20961439d2dae4af1b1da5b9fade670d7fcaed486831d8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

Filesize
117KB

MD5
4f7c668ae0988bf759b831769bfd0335

SHA1
280a11e29d10bb78d6a5b4a1f512bf3c05836e34

SHA256
32d4c8dc451e11db315d047306feea0376fbdc3a77c0ab8f5a8ab154164734d1

SHA512
af959fe2a7d5f186bd79a6b1d02c69f058ecd52e60ebd0effa7f23b665a41500732ffa50a6e468a5253bb58644251586ae38ec53e21eab9140f1cf5fd291f6a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
45c5864229a3658ac49343912473257b

SHA1
e2e9bbf6547fbfe25690297b315c6084d67964a8

SHA256
34c7a4ddcd23464ba6d6db15f5fbcab30bd75f01b15e6efdc9bb18a8761dc544

SHA512
6f3e9a145c04c24ca00ac96f6763d1efdbc51129486d450f635e585294a2d5f8aafc13151fd0b9785aec3db457038cbc3e6a3643617629fd23bf43a615eb9970

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
11b096a4db017bbd10aa520795e94ef7

SHA1
72e7de70c36baf598aaf5a69eb41151e00747d3b

SHA256
29d43529445be554801274c1770cc9d2917230086325d525b0f01c2cadecdc57

SHA512
7206b436c2915fbb7d68a8ab1b8edd2e553142b6be72f8d81e19c70dedd336e68621a076c0ff10744d80d192294268f47f8b6030d4daf8ddc0b716460ff46a37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
547eb874c06eff5ff3694e2b2d953a0b

SHA1
a68ccc6eefc309d74dcdf2cd14cea6ebc591530b

SHA256
64a5e004160f833b30819f88db0143784166e00d32caf5a1662844d6d41940b2

SHA512
769299bee367551f398151f31559bcca0fd005f28744f978b5dacda244b39e3f6794af488de09232599353afc2b7e86a0b1b06088f99e7e824e0c7116d0050b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
dc47c1ebd5d40c190152fbc82e230d77

SHA1
7ee079c9c0a63624a527bd7d54727128bae5f887

SHA256
e267472daf8abdf0a1f8595188013a4808eadb33540fab909a533ba4623d0652

SHA512
11e1d347183ef91150b5a0e57c38d76566d9c027fb616f5ee8b8974b7d6cfe1a45a18aa89412011ed824d111d93b26781e7e4c31cfc88d86c2521ffa964ebced

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
347KB

MD5
896e8f72fed87b3aeb9eb8890fb6d28b

SHA1
790baa547da66d30162280ad2c29412726886044

SHA256
e4bc166ec700b9ef3cf6897aca8bd1d852915626bf94a37d850c94fa11048f41

SHA512
e863e93ddcd6532d3b080f11b14eda20ff60b82c6f97dbf96ca5837cee6430b32497c25a493fbc0b13db9914a77dd4f5a685a75276b131bea3f9184214013b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\njqq61f\imagestore.dat

Filesize
38KB

MD5
6ee18099526de63aab9649d5cae57ea5

SHA1
7724d10dbf8090c938c6e3ab6a88fd2b1628925c

SHA256
2b31b8309d458eb3c523d2977e68937dfd5e5f431abd3558e8b281f185e73d42

SHA512
bc3c3efcbe2b835a4496433d105c910121fd7bd92babff6212dcb348a5528d13ed4221ad4167134b1f013b144324d32d76bf2fbab5c8306b993d9ad0b4570342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\favicon[1].ico

Filesize
37KB

MD5
231913fdebabcbe65f4b0052372bde56

SHA1
553909d080e4f210b64dc73292f3a111d5a0781f

SHA256
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad

SHA512
7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\jquery-ui[1].js

Filesize
458KB

MD5
c811575fd210af968e09caa681917b9b

SHA1
0bf0ff43044448711b33453388c3a24d99e6cc9c

SHA256
d2f0522008bff05c6434e48ac8f11f7464331436a4d5d96a14a058a81a75c82e

SHA512
d2234d9e8dcc96bca55fafb83bb327f87c29ae8433fc296c48be3ef8c9a21a0a4305e14823e75416951eecd6221f56fbbb8c89d44b244a27be7b6bea310f2fd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\204c2f042b555a515a0d12151307706744157e707c0b[1].htm

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\jquery.min[1].js

Filesize
86KB

MD5
220afd743d9e9643852e31a135a9f3ae

SHA1
88523924351bac0b5d560fe0c5781e2556e7693d

SHA256
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

SHA512
6e722fce1e8553be592b1a741972c7f5b7b0cdafce230e9d2d587d20283482881c96660682e4095a5f14df45a96ec193a9b222030c53b1b7bbe8312b2eae440d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
a26d9ca6ef3292cdfee87527fb200fbc

SHA1
441efad1afe3e9c32dcb1142d285a0e30e448689

SHA256
06787b2f75bd3cb189d469188da6b5fd590bf2964ffcbb8ca2bd3ecb51f0c150

SHA512
aea4884c91ba11dc4193f64bd32320bc5147288037f05165e73be4972d7f50b1b63e4831d9daf1799b58407e17488bce65b642e298a7a7d3126380fbab5f55d4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\doomed\11717

Filesize
8KB

MD5
6b31e63c9205e11c503a3c50497cd7ff

SHA1
294392a6a6d39591d6945b3811887a721421261a

SHA256
8895680c9eb94cbfaa01a275e961d04263a346c2c3b3e69974f5b188e485b9b9

SHA512
3ea115b6541a0f492b6034193fa7b6ce4cadcc120309d0e75aa48830e48531174e892696a7ff61d3697634cc5c73034be7e8e624d560c3655184fd0e5fc9d831

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\doomed\1223

Filesize
9KB

MD5
bc4953e3eca9e60f3fb89de8a77f1d99

SHA1
3ec0d079492446377a8aa59bbb8d032bd0617bab

SHA256
a90eda7174e1b54586d1ad7afedebeffc4bccb07e2d5f3a0bd5992a3f48a9159

SHA512
6804b341c200e98bf883a06a69671881958b506f4dc6a47f14cbeb123c2099beb7d925956632e0f82231f674100224165b18009cdcab9fdaa72f776e2fb0d3fe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\doomed\14521

Filesize
15KB

MD5
09bbaaa5f86767f06ca192dea6ba7b39

SHA1
4442ba1af8dc77406a4a2bdaf69f27ef57dfaee5

SHA256
73e709b0adb847243937927a3b1466a5aab5e4fbbf896dfc8b728aeb2d854625

SHA512
b4971ddd016fd609d0d47733dfe9392f8526d2974dfc530fd761231a894e39e4673d06793d9771ccbbd4448c80da07cb7a9aabd160890c9892ebdeb1c561aaa7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\doomed\25184

Filesize
58KB

MD5
49df7c6ee2744b49a203aaae8b3efed2

SHA1
f42d97ccef6dbf60516d916a35afb4614dbed5cf

SHA256
e8a75e86e7a6d95519e7a66e7a682fd3db22eadd5d3318436996f064056b02dd

SHA512
d48d2e6220c5c810cb5da022bf12d5ecac8c0d7eb322ba122f419d97da4961c71b8c4f9ab0ebee0d3b0ebc04ad0b7ccb2715fb471b1cc7987f6637db3ad67780

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\doomed\31464

Filesize
13KB

MD5
72170c306644557feb55bc4974024e56

SHA1
8bb855c9c6ba4a872e09982611e02e28dc0fe799

SHA256
7be27ef5cc090703e2071fb449e7bc896d5d81118833ae91c193eb190cf93213

SHA512
c4ba324750b0573c26c7595e6c7bce7ce4395bf9f99494b0dd502dc6d4e87a92edb9c84c5ad63c413e5899e39b2f9dc4afd0a37630cd0a0a69a8f90d39f689fe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\06AE02E19CFBD939DBE0AA3D436105938223B523

Filesize
34KB

MD5
ce1f33809cb5a12e6819ee8de41643cd

SHA1
be530b5a0cde3d11c291995b42d46576b726a557

SHA256
95f470a1f7ce1ca3f87b9d04d762cd4c034e29518810448808fecb88c03ae001

SHA512
f4a3800291b16dfe3c081ed517ff6c22ab9ec105d1c78babe7eac1ffbb668e3b56fbe23e854c60c708e8e5bf78027b8dbf6e5398edc9fcecfd80d76b68b820c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\0AA4F8AD27A4691282BB33C056EF241557E8E943

Filesize
49KB

MD5
26340f951fe95daf39019f31e30674af

SHA1
f2c13f10c876d1bc2fe03bc9b8bc47f5ce02a10c

SHA256
fb63329e750b19512613849b112ca84565c63dcd927279621a46620da60116f7

SHA512
638da0ec741f4dca7d40a31e164eaf4453bfa7d34cc67121a7234f2450f18cdc07b3350eccc138e13d8e1f3b25e995a119fa4691fc8e60ff111f23d49012e8d4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\210094FE2194727DAA201FD79E1905AAFC315528

Filesize
49KB

MD5
b35b177cfa1d2902c7955a253328c39f

SHA1
8ce3bfee90fcf170c92e8d31ad1f7915ddd990b9

SHA256
3b9db73ec485ca91dc25c04ec7f3a0b9ce3282a59bb47b1605088c7a09a06366

SHA512
7b90179040ea8783ade0e3cad43cd059e3d10952d2a45c89d71cfd1bdab2f9d7ce8840ae7955db24db623a9faf6742f0df284716b7cafe77d19f7120e77fd793

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\2271A1F46EABD10FA346EE0D2BF21DEC5EA93125

Filesize
56KB

MD5
df7df5a2b89e0ed1c22a9851fc26f8f8

SHA1
5fd38f35d0a39af8bfb13e822aedabfc14cb6466

SHA256
4f41a37c4a009b7d9e039d69e8e36fa3acbccade5baf76ba18684346701cb1c3

SHA512
888207a734729f8e4c170662e66d48b85f6dbb276069d0d0f08e400194193c4dd86f67fc08601acb2daa8c80c41b05acb7108aa4a90b50246f72e3abfec5af1f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\40A8F58CFC1A23A6BAE836E45F467F9B93975806

Filesize
41KB

MD5
e1418e8e1f5b2e9fc92efa54c6f9696e

SHA1
11133277189ca5df4b3551ee099ffb852b78b0e2

SHA256
f587dc328bda6e77ee4bd06470fd3179ee472acdefe392b7a804cf88cb2b8f91

SHA512
786edcb7cbf5865dfca2eab1aa6984319a9e5178240fdc39f8f15eeca9ea3a476b2b0e93d39132faeeb3bbae27f4d221707826a46c96ee682cd887c6386ef76b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\4ED6F8EC250AD7C9E174F5A82ABCC5161823BB1C

Filesize
22KB

MD5
cc46cd5bde36053ad5533313df282fb6

SHA1
83882b2ddc632a634466a3048d32ff7909457aad

SHA256
8ff7935e08043d03347fc1a1a31843db9c52169a2393f7be5bf4e9374469be28

SHA512
53bd272b47000d3a72d9f503d5ed46800907f58df5b2e401bfc0816db54affe99df995e4a1d986c1969d8c32829c7ea38c8742b8706e59ba0054aaa12b60465b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\57DB70FF094F10E0A16B55BD86FA6E99F9C48565

Filesize
16KB

MD5
035bb5dfe2682fe7a247758abc87921f

SHA1
28abaaa706273cd6eb1155865ff701f1ec74a898

SHA256
8ac287168bf592cca2244224aa31d36d6f2ff0b276cf9c1ecbc836255bd17d2c

SHA512
066422f43d3d79d7c877db5cec39a729fc41349d0e7def827014fe74ceacbab7104b8e4f50b3c8d29a5bb7063ccc52097b583704fd6271c62def601f4aea7a13

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\7944C7D9DC855439078F3B91C746C875572B7CFB

Filesize
46KB

MD5
0c99babd681e796d8ce38823cb446309

SHA1
bee476f2f5f024ac1204c2c8c8f0316872d656fe

SHA256
a26b48a42225d93542cc7fa3466a9d24b769079d3ffcf531441ec14800e9fae0

SHA512
6d530bdc515d005f03b5bfc782313a9e236cfbe91b512d0b4c8ba3b4eff0591ee8967edff02983b90ab32117cd383f6fbc15e58b46eb66a9f2218217252748e0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\8F19B31730992CA4498406C26D3DE8B1247231E2

Filesize
47KB

MD5
986465de27f7d130d19738c4538f3d3b

SHA1
d8a67e5d200df19d50625576f729a97915affddf

SHA256
01899289fea3acb67193487b7cc22fec18e07171a9936f7c66171ce2f3a0a42e

SHA512
d5d1a01c639df975f0a820bf1431ae06132d97906801b815895e7fae9a1ae561506beba0264b3f1fd2dcc7754017ec5d64899ee36d0a4d122c64b2867d169dc3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\9E5EE8842370ECD3C9B228D4C85BEB9FF0CA6E1D

Filesize
27KB

MD5
5e7138d635bab7a155a62914fdd328f0

SHA1
ef4021cd24f6b9babc611cc8d48193086671c387

SHA256
7a8bf622731c6b90a72c1b8f03f9a9af703390c445ded954e9c31e14598e83f4

SHA512
59262af5e1fcfe4a7378d49fc7884da152b221faa68aed38cb31652515d7da4ad5357967d74ff11048bd472a90a68eb070c6340014d9bc5d6e9f115630bb3d68

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\A6B906EDB50BA8D6CE272AE6D516CDA3D99E8577

Filesize
49KB

MD5
349515f8f077da1f3a67b80db0551827

SHA1
bf6ec0aeb583a98accd0a4df1e7af003e2692f2f

SHA256
0ccf1d69a0a1217859499e782437c4aba7cf7a2ad72665efb4f51bf83feae645

SHA512
c0dd7bf96612078f4140ad87ca138f27fa40a7d58dab3bf0f5d7b4dfd0b088092493111688ef6df61255a5f500c8d5a608d864fe38f4f12da4053580b23ca16b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\AB16B5ECDD8848B715366931E288AC53C7B3C556

Filesize
34KB

MD5
2272628fb0145d071f146c08f2ab6b1e

SHA1
14c88078fe3ee3f6295c00b735329d0a3afeab21

SHA256
673fdb4d7add5d863c9bc71afaf94b12d483205dfac78aba9073a7ae03f7beca

SHA512
27a353cd34b0df4cac1cf0497c0fc48ebbade0a3a8d3b8f1b5be1994297799b1e16dfbef070d77d729209c4da4a76e33d3b1337cf6d0f93b4861d59424977b20

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\D3997B5E4365FF84BBECDA3D1939508B5A2ED9DD

Filesize
223KB

MD5
15029855fc176fe50fe05a60418e98b6

SHA1
69255c2ba020da2c0ad6f54fdc74182cc70ec493

SHA256
3b3b1cec70245ad8d293144b599bc437fbeb5f1654f0f37c26a81cdd2197be8a

SHA512
fc0055aa9134e219bd36cbb426c36b3b33d0fe6d5389c46954e7472ea83d59a0689c753df2eb781ab74b6f9cbdb0edcc5a36a2e6af75240a10d4e8e749670309

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\cache2\entries\DD6D5E0884B994D28229649EDDE60F441288861E

Filesize
44KB

MD5
23a070f7e06db3f9cc805362c009f8b4

SHA1
079208d9d62aac842abaf58c4274246618f8e5e5

SHA256
490bcbe35e031010b942ac1b3cb83f9cd0a80a92c5e86de07c99e05f47a70041

SHA512
7671b35b4b782e5e361fa6648e931e294e4ab0b9dfdd7294f396abd92a18156cb5c0b43612404f0e53f8af49af405c07b8fc173441aabf3d935de5032277eb0e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl.tmp

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\thumbnails\0d86652bff6491314095a22324dea964.png

Filesize
75KB

MD5
2829a0b4b482cc42cd6a88d8f22d3791

SHA1
d6bc6cce58d6912ca0e7b154931bcfa7f10e804b

SHA256
8a262659dfe5e725af5d492c013649f2acf639351476594405c4a4f7d6887119

SHA512
9d1631c1305947cc02a7b2b5dfbb931d050a46ce4d092e18b83cc921506deb9cdaa7c5a7ea16cfc604418a7d523c0de70cb892770f967dd1a309030c38f13566

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC841.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC853.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\holloing

Filesize
56KB

MD5
a57d7a8189a1586d3cce8af45c1535b5

SHA1
61f621e401f9596b6a6d6d1913c52e2135846372

SHA256
93f6e90e4be814a3e060ab0e981fff804cc79a0f335aafa505df3a60c3dbe511

SHA512
870b4d46953e65b340c34fb3b03e5c8587120b11afd2f07ea4988f842e4d710b61d46bab3b5e15ccf2c50d0e6d422a7db4f7aff6add8bde3a1fbaa6494e78f31

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\unjust

Filesize
264KB

MD5
0922970918569ee7087310d3fb0414b9

SHA1
5ebd6f86febf7f2942b35c213f91a35f2b7cf127

SHA256
c827fc5750bc4faa2d1bd9e86aba1b0129285d3488fbceb9d30a762784fa4a87

SHA512
7ff04126c965055739729bf780e8ad2934423b8799eeecaca5626a303eb0748fd10b0f44cf4ad0096649a7bca421f7eec3ece182b32d4cfe063179fa2080d4d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
373B

MD5
b3bf15354f22b70fc7c30b2754c4d863

SHA1
60ae0906c1c99f68d506ece733ffbbb49a0dbc26

SHA256
bc5c1b243f80947278fc2eaa31694888432d1a2e11960fc6826c15693e06a4b8

SHA512
7e66f9fedb3541ff72a60d6e562db7a98a4d4de1cec9901b3acd9f5a2d68ca1fd7117b76fd0781c16928b8ea19147b502d2aa0a01369be2271c81a88fcc8f348

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RFf7d56c7.TMP

Filesize
20KB

MD5
653ad6f1efc893380e3e738e6947d356

SHA1
711fb1e7c597b0d41808b50fb2bbd02b27c435c2

SHA256
f48c4b4503756e5a93e66dee144dec37c51da750215532a886acf419fbc190e0

SHA512
720bb05ea58517fedcc1f0500dcf0d2aa4b56dfbd54e00014664075d19aedf660cf8408b58344b35e6e650347717468190c5947bbe61abb477168d1c3e898efa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CVV78AR2MZEZ5CL6I53K.temp

Filesize
5KB

MD5
56bd50785531d226f9624f46cc83091d

SHA1
318b8e84b095f5383347b92b702bcef9db2f9b5f

SHA256
74bcf2aa1c440a5873775e3090e30949cffdb4ca065a8a3298d0719ae188e9dc

SHA512
6e0538b3df336c1c5a9089c342395dde3b4de5c87a7bfb81dc7cb1a2c880598d44d29ac44bb25b5ee51fdde3611d3b6af743634e300f2eb836c5a29f5f0a0aae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
13b2f504a1c99ac7b6d1a8804814067b

SHA1
cd386498d295a8bb8348e6a09421a8146b0b4b36

SHA256
c9d432c7d3ea57dfcdf6871e087ddfffe34383f9ed46582b65a1eda0678bc7dc

SHA512
3fce78eb39677e06bb4084b05ce662314449c7f663d704777da3d3c6b06d5a782c961141f0e7c3727c76714aab1e985c1b9a9c96377e6c568bdcc69431c8ed33

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\05eba8a3-0996-4e35-8da2-a9f5b0596934

Filesize
13KB

MD5
a8d773e22fc48786d50ca598d6d70289

SHA1
7d119fe23cfefbb65c47d08d2d0184fa5c1325fd

SHA256
aa9fd1964ae09ce918eedb3102453003ca57da03b25296242bdb9abcacefe535

SHA512
31320242536753b006115dc670e1f9a56613abd71a8c31355490e6cb9d742927acc69275d6289fd12651c0030cb25f3dd016bb4fda138e7c928bcb0d626e588c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\44ebbb83-d8ab-4bb6-98e7-b48b724ddce7

Filesize
745B

MD5
90eeb1845c307a42146ac00b7db5babd

SHA1
08af6c6ca5c4aa29dd3a9a06d6a44aa51816bd8e

SHA256
42843bf24d928a8dc7abf878d0db7f0a6ad11158e3dcb091508e649b2affe776

SHA512
2fefddcdf1c3ca3584b716ca76267e7aa0899e5af4ea6428d3c181626881535dc6fa1c216f999faee7dbe340eb212dc32930fa654e64629c793f8bf04942564f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

Filesize
6KB

MD5
9dc54af738baa86d03e8301c6b039483

SHA1
ceb9a46b0f362788230bc4363d61b30be1600b3c

SHA256
c67107ca50da2527b1f4ac391be78db67d338a642174501621f0b86c2f7afb00

SHA512
4b5debc8b8c69850cdb70964d89d5ab8e545fa91afd6ed8671d94d90fc88b38f3cf5f68a1f6355dd5a094788cfe93b563f8cc7b22226c2a9e0306be17a5e9cec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

Filesize
6KB

MD5
dbb734897aeedabd4747f8c0b5aba1db

SHA1
8e19d9ecaf67292c89f55c2ad6a3167707e42e68

SHA256
911cdff94d32d499d42fe4e96e316ecf42947d57a1bd6cf71b6baef4ad2adc47

SHA512
15b2ae2050819717c88c1d3e5135e976543160a9e119b1e8afae03a6189f43fdeec81082898b583fa11b47d65910dd47277536ef2a33c261a2145dee41221f06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs.js

Filesize
6KB

MD5
d8effbe4fea8006f02e480d4a50e55aa

SHA1
ae334cbde6fd901aafa992887bb1d7cdba886fad

SHA256
d8d5ac17298a8593a5f4ca6ab72db3ae8731f9409d49a714d3820ece94e8f117

SHA512
2d15276b5d4bb3826498242842dd6070de98fb0cafee8fb36e36489722b096181e3337b479a9018ec07be7c379366b189c59794ef2757c467f2e79e59aefceff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionCheckpoints.json

Filesize
181B

MD5
2d87ba02e79c11351c1d478b06ca9b29

SHA1
4b0fb1927ca869256e9e2e2d480c3feb8e67e6f1

SHA256
16b7be97c92e0b75b9f8a3c22e90177941c7e6e3fbb97c8d46432554429f3524

SHA512
be7e128c140a88348c3676afc49a143227c013056007406c66a3cae16aae170543ca8a0749136702411f502f2c933891d7dcdde0db81c5733415c818f1668185

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
efefd00d4970c16dc7d2fc434e93da72

SHA1
0603979c9b64181c4ecc1957ec141cd8018dd2d6

SHA256
da065bd450b87489ebee642d2e796339bf18d1254527db2ed7194dadbd878895

SHA512
6453edd083693a694dbbe381c855b3030c866c3658dbdac3452fc7fe5ad4194bbc7742707071681c97420feecbff0ba3d13cb2822d7c801b1c5280c04a60682d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
efc13ec0a95b42520984e9082ca4672a

SHA1
aaaaad987c925fa63b53fd270ef68c936166bccf

SHA256
8746606618dd33c33f653dfdc1e608f4fdc06a733625b1841bdbd4f6d1407e95

SHA512
e334ed5966b4d07fd92d18b363e05d754abb472f02e0ca37def00da3f76fb7e3e085113006e45c3b3e892244f8285387917326ddb3735b165b39dfbb7e3eb12a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
f78817f1c20e164278fe12d76fcfd183

SHA1
8ba6e462e02a05182fadf703fd36ab428995f102

SHA256
7569ddab359ec2bb35b162cb418d59038265462ec1cf6be5bb20b6f589c2ef09

SHA512
1566424dc293f0ad1687079763e97b18cad765b966a7bc4e3d9f2459218c1c550a9fcc98d18ba12104c93293c5c317e09a5e1f41c30c2ec8c344bed6e912ba95

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
18KB

MD5
e35ec34c11c1f8bc51a1bf65ae9f13e1

SHA1
df3012c95431b8ef00922421e54aef1da0af34b7

SHA256
58e63c268687c4bbe73d13a7258559f7d03a13038cc69964751c3217d295abcb

SHA512
c0fa8b4c2f6ecc4b115bc8d85b3993f4ec7c662e2020958c21c5285fb3d2de60dfd285f1e5bcc886834596eda2012a0a4bd9f8e2f16300d1f54e9bf304395ca7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
22KB

MD5
4caec02f419a97f894f58559cb3733d4

SHA1
f0a10ee3c1661ea5db4d996b16ea2073729fefa2

SHA256
d2e8f2cfd00a76c63c2e473e4a7bda49f5ce575d93861e649ff404faeed3857c

SHA512
0e264b32b699f323d8efab7fdb1555ffeb11ac85ff58778c21ee446eda76311c362a9c94ca9a9deffdf3dabab8e6f62fe25227eeecc4064b240da20be2e2c79b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
22KB

MD5
95b4c988a42fb82abe5481bf5b618b23

SHA1
b03f53f14c140a0734649512ca7289fda7ca7318

SHA256
a348c399b528fefe340a98b5b5e983ec008b5d9f2b730eb040b4576c89db9303

SHA512
2f374be29c81c3a25aec33f0c10ca7b8c56c0611bbdfa478772849e87ca3daf934b1e08ea0755570bbba600fe04ab8efb68a650b5ac13a218e7053b1ac64a651

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
31KB

MD5
af4ec6412b8f30f73d8e03d82045c735

SHA1
b3c98f4813dc1a78e66176fcc62bd86670394855

SHA256
57ff5733c76af0ae93f52f26ea85ddf9561e71de768128b9a257ec9fd6f3488e

SHA512
abf733e1c64ee8cdcaa2b5124a944a59790a6f0ff5f949f12a5246606cc15cbfe458f5493cab732e6a981fb5d6262be373351ef4b129b3cff9c699e7ae0e43e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
fc653ae2fd68398b1746135db6f72372

SHA1
7516dce231a924e661e5a2cf2c05889af2263d54

SHA256
b80f3335ddb36d5122ef38d47a91d4edba4320b6115057ccd204ad9ce827948a

SHA512
171e24dc32ea5433f3f34481a6183a6a1403fe489a0fcb411d107c0b85bec23a49266f943988964ed74854df9d5070ea3585033944137f975afe862a9a5e8dff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
36KB

MD5
a17048dcc16f9e8926dd5d45c4dc106a

SHA1
edc5ec6dd0175cc3ee5b4dbd26c90348cc5a9192

SHA256
d0f760b754853778960a2030183d42f990c743ba845df0737d679a283f3c26ec

SHA512
8983b4c8c713f8073cb625f66eda6943880a676529fc94ea09d9109fab5ab04bd538cd383dea1934ffaeba477ec69a4b7ee4a53d9322c6191e6491f799d1a0ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
4974fecdbcc0cd87dee3f92935bd5efd

SHA1
e77d9cb1e3d83d33f7e186d1e23908e3c6dd493f

SHA256
79be4f86d67fc0aa543d12e446a909dae78a112cdfea63adca395d1113fc09a2

SHA512
f8e40a023a515a92cdcef08b1b0cec2eeb141f5dac17f08e54d8b897dba2a97035d62155436c0b4947aa78a1b06e4bf08f187c1555c63b2e6e1eefc93ac80bdd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
39KB

MD5
5b538ab0cecc225ae9ce12c022e0b4ef

SHA1
34f7b88d215d795ddfe6a0f1c2835ff753c9e530

SHA256
8f20998f2c9e4b046c2443db0afd401b72fd47a8f0936d27750b8de55c1d4d80

SHA512
c92630b8b194c4ff9ada3fc6540fa169d1a8f12342d92986119f4c8187c3afade128296f52880dad6afab39ea3879c69ca66fc069d22ed4472b80fe0305e9360

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
4b58e9c2c2048c1e723e40985431284e

SHA1
fff8c50c02fe159c2030af91033f608acbc9e336

SHA256
e635db6891cb7b27758b496cfa82f0d76ad82e52550fa5e315bdc6b1c209093f

SHA512
c20ff26ecf095fb11a2d89240c61fd76d741a6ec34e21b462a90a3be42b33e8e0322b9746c925ab691752df7f4168de72b5e586ffaf0f2a5be3b4e67d9e26de0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
530c1efb393028cafd35639addd71278

SHA1
d6cfd53d875fd723bc2851986c9092ae24ea3f25

SHA256
d12c24f52d5f657a2b6cd8657b957d67a012e419cb15e8afac7b4250b260d558

SHA512
d03eb01b9e80f6bcd9f65cb04a33121a9a535baeb6dcb6f6b3ff18d013d4ee6b7eabd58bd404655a12b0b7891d750cd3c936493f31af7505a58b75cc329ab211

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
ce92bf45df58c1027a794b55e353b355

SHA1
4e5cd0d572d3aadd37098ea0522e84b163e8f95e

SHA256
6af2b6220d483dd8afd7b12d101e31f197612fc8a6b47629f92b14f73c6dd35a

SHA512
72f121cb50ee8963dc0087247e8ae5ef1adcc92f9bf50919870bb83557d37e1b394483c6726e09881881443a9054c4328f9185c99eaa37b9b1fbc567acd043aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
18KB

MD5
fe64b827b9dda2a344942c59e4d9209a

SHA1
9baae41cad1c6544d4b838ef88bc645e65ba9f2f

SHA256
73f0a1f07136b50d62ea1b4b17287f98f13fe62cf0e45d4c4a3726b3696f57a2

SHA512
a3b04d563b4a96f870faf5dc6e8c88c3af51313feb8e4b37b4df681ca897f391a9321d389f9bfdb97ee023f6e6944ad4021352c48d3bfd3fadf9c2a72a8682cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
27KB

MD5
361c58d1cbbd06614ffe6724c4d2b9eb

SHA1
1210c66685019547f968beacce2ebaf28408155b

SHA256
469e3240e6941ac6323627a55fc1be89fc47f2b46e67023aba3b9c2e01855418

SHA512
3137c5e5d704bf03fe660c422cb6220d364bfe188ebb3d6187dd420675ea191dbf4d17db4fc4a414a14b04958c9b3ebae4b525cca05f234f7a49d73aa7c9582d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
36KB

MD5
1d301c5ad138c4c3a3dd3f485f9f5f60

SHA1
4bd98f524da3702e98083613ec528b7c5d8d6332

SHA256
ba0e8282209ce08ffbdf26ca2e1d3f8e164b370697b16d80f58952528cae36e4

SHA512
7846e95ffed66a72b0757334d3ea1e5cad7362d8ff55e54ccac659785030a60514cf237666f16f2f0ea301e38505386c2a5b3f6f9f87dc0b9901cd6a9bdc00c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
37KB

MD5
6caaf5166673974858c3cb4685dfdff3

SHA1
9ee2b1bf927965c4f56879d6c4794c19c686016e

SHA256
81e3c17d69abe9e92cd9db7a9fad8f174bdacba290d94f9ea75067876342626d

SHA512
c7700898fa35b357d2ecdc74fbf2aa4d653e34696a486bf68ea7a94a537cf5dd5d3308a3c67c2fd969e0644d096ccaca3667ece4c483771ae8350bfce742c755

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore.jsonlz4

Filesize
38KB

MD5
49603d31acdb3fbaf372034332b48214

SHA1
1073af8649fc0109a57a3a640b3ba9318f6c62d0

SHA256
ee3139ee4dcd10aad2bf61806611891b5707df147599423b2e4faf2ef76c00bc

SHA512
b541079b09347cf2248583096d4334769ecfed7745cfcc0586f37919086f6211c36acfdcbf15a1228894041d6bfda660255e719b4c7ee40e01633467109b5f80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\storage\default\https+++ya.ru\ls\usage

Filesize
12B

MD5
0d7c6a9e2561910ba8e122030ac34436

SHA1
3c8f54740d39f88fc59cd0658d391af555719243

SHA256
464ecfa840d8524acec9ec12eb157992379b8a39b312b37cea0fb3f5a84499f7

SHA512
8417307934f76850236f25d5fc14ef1f5667d31c684acdcd7b855e3383f37a85c51dd29dd1334c3457494065e9ac22639039dc8a0746ac6686b32b79213bf5c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\storage\default\https+++ya.ru\ls\usage

Filesize
12B

MD5
28e1e5475b81c145714bad59fbd66136

SHA1
5a96f0403338ff8c751603ade841b10cc2cb30b6

SHA256
112554b855bbec2f8303a5afbd03e582b20c6b76ad3d153381a233ef5fb52d30

SHA512
fc5be3dc7777b9c8ea9fb689c93c219182f9b1a3e848c95fe260930c2f631f8db20caf76443d70b62dc2aa02d8139f3630f41cd9505146822e366564a7653347

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\storage\default\https+++ya.ru\ls\usage

Filesize
12B

MD5
5984ebe656cd0aca5bed3c092c6ba3da

SHA1
e55d7f7a9fcfa0177839dda01c38471b8559977a

SHA256
173ef2b96a42b44f1e47bc8bfabfd2eeddf1ff645b5fddf708dab5562c9722cc

SHA512
dda1118a93a9ab16e6fd6668459e09d03fea637f2bee52c1dd9a31e6330f30da0ce72f1cc8ea8eb63b8b4b40fdc25ccb9136901e4304c694b9ec07411bfabf29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
7d032527cb2a7c66daa3904df11726d5

SHA1
74ad9c4e3442f7d1c58a2a8729d6e87044638f12

SHA256
77b2700fef7daaa8608e34ca36b2a596eb59b5dd6f3d588d1ed47dbf1fe95512

SHA512
c39b58917899b40a818c6c975cacbd5e2da74d526eea6cd7eeb4416b179855299c2cc3a4a6ea1b6dce10a89ea98dc527cd39c452eece9f1dab6547dd549c8403

Download Submit
C:\Users\Admin\Downloads\107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.53uisceh.zip.part

Filesize
79KB

MD5
3bc5aa9f22c4a3c169377cf4ca5c1641

SHA1
6bb285de3d0bc0c3d1d514c37ae38e9171490add

SHA256
665065a71e90daa0297f39c433dc205302aa2f4c3de5796c90a62e63a083fb13

SHA512
396a09af75d36ab325c2c7197fcc236615c6e08e781c87dfcf9b0550bfe153405fd9cbc581f201540d9414f8aa4cc6ee5089f5d4514c666031bec2426cc892b9

Download Submit
C:\Users\Admin\Downloads\107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.exe

Filesize
1.1MB

MD5
9a0775710ce1dc0ccd5dcdd544e787df

SHA1
dd51bbf9d3e755b989cda90394a5cda32afe48f4

SHA256
107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007

SHA512
8287f6e4b4b61250bb778f0273e9db3b148247463f711f2e4a28c82663b29ac1139c22ab0640957cb47cb70e9ee5ec9fa6253542359e71ec5ed3b6890334539d

Download Submit
C:\Users\Admin\Downloads\107b3168ae866923a50047eb9bb6ca909b7c2107fb18fee91b20c329980c0007.zip

Filesize
718KB

MD5
6eb76a406f380909e539b9f67d2c04ef

SHA1
a8f54c6f461dbc742c256e94ddea03805bbe313a

SHA256
bd4d8a27d5c9482e0810e8d0e85805f29c86cfe10e5210d4ac8cbc81a62871bb

SHA512
7be7906c6c763b18cc413eea76bb4587918a7467ad786f66f5066e0f3e64c35dc56b4627951ed5971801c3f893d5ea5139ed10b1e8d8c702325f703ba86cbe55

Download Submit
C:\Users\Admin\Downloads\Geometry_Dash_v2.HHkgatRl.2.exe.part

Filesize
94KB

MD5
22b735022404a650db23296ccbd80fcb

SHA1
d1a42f2effd306dfaa5e2884f526ffd5556260b7

SHA256
aa93615c149b922dbf1b93356269e31884f6c2c41491ce81c9529d6160d4f61c

SHA512
448939144358184eeee09f9bd676838c4ddb4efc1c717d38d0e3f53382eb5e5f518b2ad4e5c44705cb20a101836c7bc8fdb75857ad7373273af929b9446db249

Download Submit
C:\Users\Admin\Downloads\Geometry_Dash_v2.ZL73Xent.2074.zip.part

Filesize
10KB

MD5
e447187851a2ecae2e58f8bceda271e7

SHA1
41e887ff4300f51765ad4054b551aafff28edf3b

SHA256
8ce3451c1b0ebfd1dfcdacb033bdb5574d721262cc58d6332e4d94782a22655a

SHA512
bedff4c9b7817014a644bf4143091dd89ebc8e22a1bffb1004f71c7acce8973db70ea06be22e6ae4dc66c45c9e5055a75c18bdca753b59c018e4b68f8af13d51

Download Submit
C:\Users\Admin\Downloads\VC_redist.XwK5lVK1.x64.exe.part

Filesize
24.5MB

MD5
223a76cd5ab9e42a5c55731154b85627

SHA1
38b647d37b42378222856972a1e22fbd8cf4b404

SHA256
1821577409c35b2b9505ac833e246376cc68a8262972100444010b57226f0940

SHA512
20e2d7437367cb262ce45184eb4d809249fe654aa450d226e376d4057c00b58ecfd8834a8b5153eb148960ffc845bed1f0943d5ff9a6fc1355b1503138562d8d

Download Submit
C:\Users\Admin\Downloads\VC_redist.dbcXJyqH.arm64.exe.part

Filesize
4KB

MD5
41fd3971e2ce37d01b281c4baa247e57

SHA1
58aabf3f5e0e1f4aaf1fbb6291b2b087a1a11e88

SHA256
7c00219ae3dce30e29a72b8459eefa4088d2984a2b6313b8bf60e24f3b827d23

SHA512
131f2bfad58bdc8fc8a458e18237f13b4e823009e56c33b9932b2c1376a6b93484b6606fd99229180347ebc9fe3465eaddcd45e369f9bdd86ea915af779d994a

Download Submit
C:\Users\Admin\Downloads\VC_redist.x86.exe

Filesize
13.3MB

MD5
8a6f4f3282236325360a9ac4413b7bc3

SHA1
cb617803813e969be73f2e0e175a67620e53aa59

SHA256
dd1a8be03398367745a87a5e35bebdab00fdad080cf42af0c3f20802d08c25d4

SHA512
2c1facb8567a052b4fa65d173b0bda64fa5fded2cddb9073b7c28507ed95414c17d2839d06d5e961617c754cda54d6134964b1aff5c9e9cdfbace71f1de2ac3a

Download Submit
C:\Windows\Installer\f7f3536.msi

Filesize
200KB

MD5
975e07089d93c2540f0e91da7e1e0142

SHA1
e65a155b9f88cabf6fc34111751051f8872f1dc2

SHA256
16547c99e9dc8602603beda79bb9099d06b2f0e06273660aaffd3193d82e8bf5

SHA512
047ca9eaf996b5b89cedf0f9e9d7544cb8700bba02e10aa90fbd283fdebb2e1ec98295569f145e0dc9bbf3dbd44f64e4d02429cbcdff7e149f2804c135ee2595

Download Submit
C:\Windows\Temp\{67D4596A-BE1D-4640-A13B-CEAB1C6DE193}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{9AE76E09-E2CE-4ABC-8617-EC527558B306}\.ba\license.rtf

Filesize
9KB

MD5
04b33f0a9081c10e85d0e495a1294f83

SHA1
1efe2fb2d014a731b752672745f9ffecdd716412

SHA256
8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b

SHA512
d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685

Download Submit
C:\Windows\Temp\{9AE76E09-E2CE-4ABC-8617-EC527558B306}\.ba\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Windows\Temp\{9AE76E09-E2CE-4ABC-8617-EC527558B306}\.ba\thm.xml

Filesize
8KB

MD5
f62729c6d2540015e072514226c121c7

SHA1
c1e189d693f41ac2eafcc363f7890fc0fea6979c

SHA256
f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916

SHA512
cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471

Download Submit
C:\Windows\Temp\{B10D4C7A-BE11-45DF-9414-43D8DA80C403}\.ba\wixstdba.dll

Filesize
215KB

MD5
f68f43f809840328f4e993a54b0d5e62

SHA1
01da48ce6c81df4835b4c2eca7e1d447be893d39

SHA256
e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

SHA512
a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

Download Submit
C:\Windows\Temp\{B10D4C7A-BE11-45DF-9414-43D8DA80C403}\.be\VC_redist.x64.exe

Filesize
670KB

MD5
3f32f1a9bd60ae065b89c2223676592e

SHA1
9d386d394db87f1ee41252cac863c80f1c8d6b8b

SHA256
270fa05033b8b9455bd0d38924b1f1f3e4d3e32565da263209d1f9698effbc05

SHA512
bddfeab33a03b0f37cff9008815e2900cc96bddaf763007e5f7fdffd80e56719b81341029431bd9d25c8e74123c1d9cda0f2aefafdc4937095d595093db823df

Download Submit
C:\Windows\Temp\{DEBCA669-AF09-48BF-AF32-BE686AD24304}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{DEBCA669-AF09-48BF-AF32-BE686AD24304}\.be\VC_redist.x86.exe

Filesize
669KB

MD5
f7aca1ef43beaa02107214482e6b51d6

SHA1
fb5cec36519b148119dec501cec92d894eb3b60a

SHA256
169b8f7025b301ffce5402c98c07f9e01bbadce52a2961175b777279f92624a7

SHA512
82cf5ebaa0a16e229b82e2dd550d7ab76409c89b4cfb7f163d1cce6d156db737ec5a09a3aa832b4076039665a6044aaeca3a6d311f8264492707ae281bbe7443

Download Submit
\Games\Geometry Dash\glew32.dll

Filesize
324KB

MD5
7399bc6fcbcfe81b6437d37d45d27e00

SHA1
254ac4f5e56cd5ce14d31f824de7949b09597c78

SHA256
1ea8aedc46418e08aeabcb91c16fb4a0ab669924dd0a6071d143f13cd932a022

SHA512
bfffdd518b1a7a4890762e38861db465e187dc197aa6b02f2644ac798e0e03e6f6b2543e24e92e3a16a82ee3d9f795ff12845caf174b2d1b5f6800d7ae1941ea

Download Submit
\Games\Geometry Dash\libExtensions.dll

Filesize
281KB

MD5
19a137530140343516b062de921cf8a0

SHA1
7bb80fec979b0f35288f5e7db00b5f78553eb433

SHA256
a7602caf28804eed07b682eacf6c9f31a0e89d5f05ba91578ca97126baa85f22

SHA512
1894cac10367705fbbcdc6cff78525566efaa950cf251c8484697e7cbba441c2892b1a88effbcb7c240c3c29061ada1e348601bef8c77f124e8e4b3081fd43c2

Download Submit
\Users\Admin\AppData\Local\Temp\is-51P35.tmp\Geometry_Dash_v2.2.tmp

Filesize
4.5MB

MD5
18cff40dd8a83d646a9c4287e8c628e7

SHA1
4b987304dbccbec6604961132745607e08e34e4f

SHA256
7ab2a0136e212180f8c4a96a5fb5f40b8f73ddbc771c40ddf56e559dd4cbf54f

SHA512
bf2d88eeef5c542700d7408f64c4761965c187f9f7112f146d518bbc62515e99a312ab8a98d05b17d8b5923a0f5e0964d2e2585a49f5718c7ba32745978f24ad

Download Submit
memory/272-2537-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/272-2501-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/272-2506-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/272-2536-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/272-2532-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/272-2525-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/272-2507-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/272-2502-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1280-3764-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1280-5172-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1436-979-0x000000001E430000-0x000000001EA38000-memory.dmp

Filesize
6.0MB

Download
memory/1436-996-0x0000000002290000-0x000000000229A000-memory.dmp

Filesize
40KB

Download
memory/1436-980-0x000000001DDA0000-0x000000001DF24000-memory.dmp

Filesize
1.5MB

Download
memory/1436-992-0x000000001F3B0000-0x000000001F44E000-memory.dmp

Filesize
632KB

Download
memory/1436-993-0x000000001F450000-0x000000001F508000-memory.dmp

Filesize
736KB

Download
memory/1436-995-0x000000001B880000-0x000000001B8B7000-memory.dmp

Filesize
220KB

Download
memory/1436-997-0x0000000002290000-0x000000000229A000-memory.dmp

Filesize
40KB

Download
memory/2292-1563-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2292-1543-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/4060-3822-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3784-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/4060-3782-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3780-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3781-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/4060-3779-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3777-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3778-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/4060-3783-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-5173-0x0000000000400000-0x000000000089A000-memory.dmp

Filesize
4.6MB

Download
memory/4060-3785-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3787-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/4060-3786-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3788-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3790-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/4060-3789-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3791-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3792-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3793-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/4060-3794-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3796-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/4060-3795-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3797-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3799-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/4060-3798-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3800-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3802-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/4060-3801-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3803-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3805-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/4060-3804-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3806-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3808-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4060-3807-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3809-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3811-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/4060-3810-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3812-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3814-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4060-3813-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3815-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3817-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/4060-3816-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3818-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3820-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/4060-3819-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3821-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3823-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4060-3824-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3828-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3826-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/4060-3827-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3825-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3776-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3773-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3774-0x00000000021B0000-0x00000000022F0000-memory.dmp

Filesize
1.2MB

Download
memory/4060-3775-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/4060-3772-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads