Overview

overview

10

Static

static

1

EICAR.txt

windows10-ltsc_2021-x64

10

Resubmissions

23/03/2025, 19:10

250323-xvmsfa11gt 10

23/03/2025, 18:49

250323-xglyzsvn17 8

23/03/2025, 18:23

250323-w1gb6str12 8

23/03/2025, 18:13

250323-wtvk8azwcy 8

23/03/2025, 18:01

250323-wlzvzatlz3 10

23/03/2025, 17:38

250323-v722saywcy 10

23/03/2025, 17:35

250323-v53kjayve1 10

23/03/2025, 17:27

250323-v1pswasnw2 10

23/03/2025, 15:05

250323-sf8n5sylt7 8

23/03/2025, 14:52

250323-r8x8faxrx9 8

Analysis

  • max time kernel
    998s
  • max time network
    1185s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-de
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-delocale:de-deos:windows10-ltsc_2021-x64systemwindows
  • submitted
    23/03/2025, 17:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    EICAR.txt

  • Size

    68B

  • MD5

    44d88612fea8a8f36de82e1278abb02f

  • SHA1

    3395856ce81f2b7382dee72602f798b642f14140

  • SHA256

    275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f

  • SHA512

    cc805d5fab1fd71a4ab352a9c533e65fb2d5b885518f4e565e68847223b8e6b85cb48f3afad842726d99239c9e36505c64b0dc9a061d9e507d833277ada336ab

Score
10/10
wannacrydefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealerupxworm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Wannacry family
    wannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Downloads MZ/PE file 5 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 60 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 5 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 4 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 5 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: LoadsDriver 10 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 39 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\EICAR.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:556
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5288
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Downloads MZ/PE file
      • Drops desktop.ini file(s)
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27100 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {33178509-c573-4782-8552-3e07dd7c5caa} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:1824
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27136 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {51dd115b-4823-4ae4-a8de-cb2455f8fc73} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:5876
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3832 -prefsLen 27277 -prefMapHandle 3836 -prefMapSize 270279 -jsInitHandle 3840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3848 -initialChannelId {588af00c-0d2f-4bb9-8024-a129f3c3f8b9} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:4588
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27277 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 3984 -initialChannelId {3f81b3ca-2c97-4db5-989d-8330a803bb90} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:5092
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3168 -prefsLen 34776 -prefMapHandle 3292 -prefMapSize 270279 -jsInitHandle 3296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3052 -initialChannelId {a7df9d51-63a3-401d-9c8d-6775ff1fac55} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:3784
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5100 -prefsLen 35013 -prefMapHandle 5104 -prefMapSize 270279 -ipcHandle 5068 -initialChannelId {93ec43e6-bad8-4a25-ae4b-ce162ddce5d3} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:6044
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5212 -prefsLen 32900 -prefMapHandle 5216 -prefMapSize 270279 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5236 -initialChannelId {98a1d999-8b7b-4613-ae59-cb551b8d1066} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:3460
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32900 -prefMapHandle 5252 -prefMapSize 270279 -jsInitHandle 5256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5264 -initialChannelId {58447d70-3d8c-42d6-80e0-259605986aad} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:2584
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 32900 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5676 -initialChannelId {4fa68e57-4bd4-4aac-ae96-1b68c2aa88a7} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:856
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 22000 -prefsLen 36931 -prefMapHandle 6972 -prefMapSize 270279 -jsInitHandle 2712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8172 -initialChannelId {f6ecdea2-4b9b-4f6a-90e2-66fa9e2ea337} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
              3⤵
              • Checks processor information in registry
              PID:3996
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15536 -prefsLen 36931 -prefMapHandle 15540 -prefMapSize 270279 -jsInitHandle 15604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 22336 -initialChannelId {fb7872b0-ff2d-4bc1-b011-73d2fa5b7b7f} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
              3⤵
              • Checks processor information in registry
              PID:2812
            • C:\Users\Admin\Downloads\Bezilom.exe
              "C:\Users\Admin\Downloads\Bezilom.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5632
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 21112 -prefsLen 36971 -prefMapHandle 21100 -prefMapSize 270279 -jsInitHandle 21132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7516 -initialChannelId {dc591f77-2d64-4d9d-b6ad-684f9b1ac12b} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
              3⤵
              • Checks processor information in registry
              PID:1512
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16036 -prefsLen 36971 -prefMapHandle 17420 -prefMapSize 270279 -jsInitHandle 15868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 26136 -initialChannelId {75488210-8316-4b26-9935-2921c47236c0} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
              3⤵
              • Checks processor information in registry
              PID:4216
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15536 -prefsLen 36971 -prefMapHandle 15540 -prefMapSize 270279 -jsInitHandle 2816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6924 -initialChannelId {c8fb16cf-ad7b-4036-b7d1-1ea1150cb34e} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
              3⤵
              • Checks processor information in registry
              PID:4628
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9580 -prefsLen 37027 -prefMapHandle 26080 -prefMapSize 270279 -jsInitHandle 21144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15592 -initialChannelId {b796dc0d-0240-47b4-8f75-f550d6442e41} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
              3⤵
              • Checks processor information in registry
              PID:5512
            • C:\Users\Admin\Downloads\WiresharkPortable64_4.4.5.paf.exe
              "C:\Users\Admin\Downloads\WiresharkPortable64_4.4.5.paf.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3228
            • C:\Users\Admin\Downloads\HitmanPro_x64.exe
              "C:\Users\Admin\Downloads\HitmanPro_x64.exe"
              3⤵
              • Executes dropped EXE
              • Modifies system certificate store
              PID:2484
              • C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe
                "C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe" /update:"C:\Users\Admin\Downloads\HitmanPro_x64.exe"
                4⤵
                • Executes dropped EXE
                PID:2492
                • C:\Users\Admin\Downloads\HitmanPro_x64.exe
                  "C:\Users\Admin\Downloads\HitmanPro_x64.exe" /updated:"C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe"
                  5⤵
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Impair Defenses: Safe Mode Boot
                  • Unexpected DNS network traffic destination
                  • Enumerates connected drives
                  • Maps connected drives based on registry
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  • Checks SCSI registry key(s)
                  • Modifies system certificate store
                  PID:3948
            • C:\Users\Admin\Downloads\Mantas.exe
              "C:\Users\Admin\Downloads\Mantas.exe"
              3⤵
                PID:1632
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:5660
            • C:\Users\Admin\Downloads\WannaCry.exe
              "C:\Users\Admin\Downloads\WannaCry.exe"
              1⤵
              • Drops startup file
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: RenamesItself
              PID:2132
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c 23891742751638.bat
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1992
                • C:\Windows\SysWOW64\cscript.exe
                  cscript //nologo c.vbs
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:644
              • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                !WannaDecryptor!.exe f
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2396
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im MSExchange*
                2⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1364
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im Microsoft.Exchange.*
                2⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:6040
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im sqlserver.exe
                2⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2104
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im sqlwriter.exe
                2⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3328
              • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                !WannaDecryptor!.exe c
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2108
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c start /b !WannaDecryptor!.exe v
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1068
                • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                  !WannaDecryptor!.exe v
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2176
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2796
                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                      wmic shadowcopy delete
                      5⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2040
              • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                !WannaDecryptor!.exe
                2⤵
                • Executes dropped EXE
                • Sets desktop wallpaper using registry
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4760
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:5980
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\!Please Read Me!.txt
              1⤵
                PID:5808
              • C:\Users\Admin\Downloads\Bumerang.exe
                "C:\Users\Admin\Downloads\Bumerang.exe"
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                PID:3524
                • C:\Windows\SysWOW64\ddraw32.dll
                  C:\Windows\system32\ddraw32.dll
                  2⤵
                  • Executes dropped EXE
                  PID:1328
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 360
                    3⤵
                    • Program crash
                    PID:456
                • C:\Windows\SysWOW64\ddraw32.dll
                  C:\Windows\system32\ddraw32.dll :C:\Users\Admin\Downloads\Bumerang.exe
                  2⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5944
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1328 -ip 1328
                1⤵
                  PID:1184
                • C:\Windows\system32\taskmgr.exe
                  "C:\Windows\system32\taskmgr.exe" /4
                  1⤵
                  • Checks SCSI registry key(s)
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4276
                • C:\Users\Admin\Downloads\WiresharkPortable64\WiresharkPortable64.exe
                  "C:\Users\Admin\Downloads\WiresharkPortable64\WiresharkPortable64.exe"
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2492
                  • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\Wireshark.exe
                    "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\Wireshark.exe"
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks processor information in registry
                    • Suspicious behavior: AddClipboardFormatListener
                    • Suspicious behavior: GetForegroundWindowSpam
                    PID:5824
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\androiddump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\androiddump.exe" --extcap-interfaces --extcap-version=4.4
                      3⤵
                      • Executes dropped EXE
                      PID:3748
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-interfaces --extcap-version=4.4
                      3⤵
                      • Executes dropped EXE
                      PID:4804
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe" --extcap-interfaces --extcap-version=4.4
                      3⤵
                      • Executes dropped EXE
                      PID:1128
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe" --extcap-interfaces --extcap-version=4.4
                      3⤵
                      • Executes dropped EXE
                      PID:928
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\sshdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\sshdump.exe" --extcap-interfaces --extcap-version=4.4
                      3⤵
                      • Executes dropped EXE
                      PID:5684
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe" --extcap-interfaces --extcap-version=4.4
                      3⤵
                      • Executes dropped EXE
                      PID:1016
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\wifidump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\wifidump.exe" --extcap-interfaces --extcap-version=4.4
                      3⤵
                      • Executes dropped EXE
                      PID:5680
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-config --extcap-interface ciscodump
                      3⤵
                      • Executes dropped EXE
                      PID:5800
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump
                      3⤵
                      • Executes dropped EXE
                      PID:1320
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe" --extcap-config --extcap-interface randpkt
                      3⤵
                      • Executes dropped EXE
                      PID:1136
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\sshdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\sshdump.exe" --extcap-config --extcap-interface sshdump.exe
                      3⤵
                      • Executes dropped EXE
                      PID:4368
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe" --extcap-config --extcap-interface udpdump
                      3⤵
                      • Executes dropped EXE
                      PID:3688
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\wifidump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\wifidump.exe" --extcap-config --extcap-interface wifidump.exe
                      3⤵
                      • Executes dropped EXE
                      PID:5228
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\dumpcap.exe
                      C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\dumpcap.exe --log-level MESSAGE -S -D -L --signal-pipe 5824.dummy -Z 2012
                      3⤵
                      • Executes dropped EXE
                      • Checks processor information in registry
                      PID:5660
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-dlts --extcap-interface ciscodump
                      3⤵
                      • Executes dropped EXE
                      PID:1844
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe" --extcap-dlts --extcap-interface etwdump
                      3⤵
                      • Executes dropped EXE
                      PID:2020
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe" --extcap-dlts --extcap-interface randpkt
                      3⤵
                      • Executes dropped EXE
                      PID:392
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\sshdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\sshdump.exe" --extcap-dlts --extcap-interface sshdump.exe
                      3⤵
                      • Executes dropped EXE
                      PID:4784
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe" --extcap-dlts --extcap-interface udpdump
                      3⤵
                      • Executes dropped EXE
                      PID:3900
                    • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\wifidump.exe
                      "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\wifidump.exe" --extcap-dlts --extcap-interface wifidump.exe
                      3⤵
                      • Executes dropped EXE
                      PID:2284
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        4⤵
                          PID:4804
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-config --extcap-interface ciscodump
                        3⤵
                        • Executes dropped EXE
                        PID:1920
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-config --extcap-interface ciscodump
                        3⤵
                        • Executes dropped EXE
                        PID:1016
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-config --extcap-interface ciscodump
                        3⤵
                        • Executes dropped EXE
                        PID:1932
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-config --extcap-interface ciscodump
                        3⤵
                        • Executes dropped EXE
                        PID:4488
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-config --extcap-interface ciscodump
                        3⤵
                        • Executes dropped EXE
                        PID:5392
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-config --extcap-interface ciscodump
                        3⤵
                        • Executes dropped EXE
                        PID:1900
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-config --extcap-interface ciscodump
                        3⤵
                        • Executes dropped EXE
                        PID:3872
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-config --extcap-interface ciscodump
                        3⤵
                        • Executes dropped EXE
                        PID:5672
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-config --extcap-interface ciscodump
                        3⤵
                        • Executes dropped EXE
                        PID:5136
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\ciscodump.exe" --extcap-config --extcap-interface ciscodump
                        3⤵
                        • Executes dropped EXE
                        PID:2344
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe" --extcap-config --extcap-interface udpdump
                        3⤵
                        • Executes dropped EXE
                        PID:2928
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe" --extcap-config --extcap-interface udpdump
                        3⤵
                        • Executes dropped EXE
                        PID:3704
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe" --extcap-config --extcap-interface udpdump
                        3⤵
                        • Executes dropped EXE
                        PID:4248
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\udpdump.exe" --capture --extcap-interface udpdump --fifo \\.\pipe\wireshark_extcap_udpdump_20250323175034 --port 5555 --payload data
                        3⤵
                        • Executes dropped EXE
                        PID:3756
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\dumpcap.exe
                        C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\dumpcap.exe --log-level MESSAGE -F pcapng -i wireshark_extcap2868 --ifname udpdump --ifdescr "UDP Listener remote capture" --signal-pipe 5824 -Z 2872
                        3⤵
                        • Executes dropped EXE
                        • Checks processor information in registry
                        PID:5044
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe" --extcap-config --extcap-interface randpkt
                        3⤵
                        • Executes dropped EXE
                        PID:3352
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe" --extcap-config --extcap-interface randpkt
                        3⤵
                        • Executes dropped EXE
                        PID:1360
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe" --extcap-config --extcap-interface randpkt
                        3⤵
                        • Executes dropped EXE
                        PID:4724
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\randpktdump.exe" --capture --extcap-interface randpkt --fifo \\.\pipe\wireshark_extcap_randpkt_20250323175059 --maxbytes 5000 --count 1000 --delay 0
                        3⤵
                        • Executes dropped EXE
                        PID:2460
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\dumpcap.exe
                        C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\dumpcap.exe --log-level MESSAGE -F pcapng -i wireshark_extcap2856 --ifname randpkt --ifdescr "Random packet generator" --signal-pipe 5824 -Z 2852
                        3⤵
                        • Executes dropped EXE
                        • Checks processor information in registry
                        PID:3728
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump
                        3⤵
                        • Executes dropped EXE
                        PID:760
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump
                        3⤵
                        • Executes dropped EXE
                        PID:4636
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump
                        3⤵
                        • Executes dropped EXE
                        PID:3020
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe
                        "C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\extcap\etwdump.exe" --capture --extcap-interface etwdump --fifo \\.\pipe\wireshark_extcap_etwdump_20250323175413
                        3⤵
                        • Executes dropped EXE
                        PID:5072
                      • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\dumpcap.exe
                        C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\dumpcap.exe --log-level MESSAGE -F pcapng -i wireshark_extcap2792 --ifname etwdump --ifdescr "Event Tracing for Windows (ETW) reader" --signal-pipe 5824 -Z 2812
                        3⤵
                        • Executes dropped EXE
                        • Checks processor information in registry
                        PID:2900
                  • C:\Windows\system32\taskmgr.exe
                    "C:\Windows\system32\taskmgr.exe" /4
                    1⤵
                    • Checks SCSI registry key(s)
                    • Modifies registry class
                    PID:2628
                  • C:\Windows\system32\mmc.exe
                    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s
                    1⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    PID:4276
                  • C:\Windows\system32\vssvc.exe
                    C:\Windows\system32\vssvc.exe
                    1⤵
                      PID:3352
                    • C:\Windows\system32\taskmgr.exe
                      "C:\Windows\system32\taskmgr.exe" /4
                      1⤵
                        PID:4176
                      • C:\Users\Admin\Downloads\Fagot.a.exe
                        "C:\Users\Admin\Downloads\Fagot.a.exe"
                        1⤵
                          PID:5024
                        • C:\Windows\system32\taskmgr.exe
                          "C:\Windows\system32\taskmgr.exe" /4
                          1⤵
                            PID:5088

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Windows Management Instrumentation

                          1
                          T1047

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Event Triggered Execution

                          1
                          T1546

                          Netsh Helper DLL

                          1
                          T1546.007

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Event Triggered Execution

                          1
                          T1546

                          Netsh Helper DLL

                          1
                          T1546.007

                          Defense Evasion

                          Impair Defenses

                          1
                          T1562

                          Safe Mode Boot

                          1
                          T1562.009

                          Indicator Removal

                          1
                          T1070

                          File Deletion

                          1
                          T1070.004

                          Modify Registry

                          3
                          T1112

                          Subvert Trust Controls

                          2
                          T1553

                          Install Root Certificate

                          1
                          T1553.004

                          SIP and Trust Provider Hijacking

                          1
                          T1553.003

                          Credential Access

                          Credentials from Password Stores

                          1
                          T1555

                          Credentials from Web Browsers

                          1
                          T1555.003

                          Unsecured Credentials

                          1
                          T1552

                          Credentials In Files

                          1
                          T1552.001

                          Discovery

                          Peripheral Device Discovery

                          3
                          T1120

                          Query Registry

                          6
                          T1012

                          System Information Discovery

                          5
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Lateral Movement

                          Collection

                          Data from Local System

                          1
                          T1005

                          Command and Control

                          Web Service

                          1
                          T1102

                          Exfiltration

                          Impact

                          Defacement

                          1
                          T1491

                          Inhibit System Recovery

                          1
                          T1490

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\activity-stream.contile.json
                            Filesize

                            4KB

                            MD5

                            fd83cec12358cca410ecc5e014b2d53b

                            SHA1

                            6b799ba6842fc8e3e609a7cd795372bb0d097d85

                            SHA256

                            d4241e494363931c3dc9ffbdd23e5257fd9ecdb3e20d5e06f07c79e9e038284e

                            SHA512

                            15e162d18522a3db23af4c2f83cfae935bb84694dfb5b70da794f42f0861f262d4761a0452322ce4f3d21f24ff6cb874c7cb1f4380a6e0adafc6c9798254c0ac

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\5ACB46A5A72DCA2C675A19F9DCC5C68E4EEE16B7
                            Filesize

                            34KB

                            MD5

                            7190c1e722511b8ca83b02fcaa1e02a8

                            SHA1

                            574436b6d35d40b28484321d43cdfbe8475fa5f1

                            SHA256

                            1099381ef26a1120048d2d3e28f11aa8cccf1e93f114d0771ee6e697ce8bc437

                            SHA512

                            95270b7c8045227df3de967f6eedc78da108ba728a99ff475a3b759338dd47354db2d0a07bb7beb48f26b8400d0e2b72d0b722a5632f85043bf5141b8f50fabf

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\5B23235D54208C34AFF88FC6F18585FD8A8F8FAD
                            Filesize

                            32KB

                            MD5

                            123356699272cece10a000793045756e

                            SHA1

                            5ac1338985854d71f27966dc9632b383849f7a37

                            SHA256

                            c51f466b3a84126f6b8aa8c254dfa909e73e95ebe87393facf41410128e4722b

                            SHA512

                            2a79d276f81b65357078ed5fa4876829f1813067ffe4e9ce2c4ecd4ab15e82bd5b17bbf2351f318e5731730f1e251d8ff693c66d7798cb6998afba19029b6d3c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\8D11864F69B6D9276086D87F1C72386DC26A1DF7
                            Filesize

                            47KB

                            MD5

                            2a23ffc8aea5136f3ed970b5cbd67089

                            SHA1

                            c618ca46673f06370e81f778dc0bd3e9d3cd997b

                            SHA256

                            703f301bc155a5451be737480674636ba6a1b05516d4b8c2a75837e5315dc269

                            SHA512

                            1d10140b76ff552e7a6c3f6424d5d9f5558cdb6ed82385e7c5e2b87fd1c1a9069d2ee66330f74fa67f00bb36f3b39fb1414102854b1903bc220b9643df2f5c16

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\956C138E7E189A8F1B675B499ED2D87604EE6E73
                            Filesize

                            47KB

                            MD5

                            b19c87316cd1e93cc132a2d968d75540

                            SHA1

                            0f860d23ed6798f3ad744c5193a8b81dff2c2af9

                            SHA256

                            13f8431c74bfd42c76adc0f263fafadcc64735e286abe2f2a649b7f0f865bd33

                            SHA512

                            3c208f55afc9078120509e182bef54f2759a84e63071fd00ef59e1e5ace444a78587471fcc11592ffacc6f94397a645b3db5317eff291187263430c33436c768

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\97AFFA25C9ED84269BA5F8059413E057B9831B3A
                            Filesize

                            41KB

                            MD5

                            5339619ff714acafeba654dc68ad23bc

                            SHA1

                            37069718762fb1c73d51d47f69677cc2fc38fd7c

                            SHA256

                            2035fa4168156c9da266feca27c3dabc41316e01d6974e776ac22683707ed785

                            SHA512

                            ff4bb4d36da5eb08b80d3ae260ef344f6465f98208c788c71ff67b3364d9345dd046550e3ee3b3db9ae018a2d40c473868fac6a34fc57a3e7616241ad80b03b0

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD
                            Filesize

                            13KB

                            MD5

                            7f171b1742e228a0e1aaa374cbaadebb

                            SHA1

                            c7982c7001168bc89d830737f25c23ce8e89bc2f

                            SHA256

                            ee635372c3445056b79f3643bd4055dbed879d4aa407cb6e58720af1f37e8b42

                            SHA512

                            3eb4d47b80e81538dfa6ad9aee93c73b6214ab85bb43357eff89b73284d9b7cdc97831b07c90854eaa9a58d87cb1a157463a8ba771c0330f23e2aca77d30b076

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\3df11d57-6031-47f4-b7f6-522fa6e37982.zip
                            Filesize

                            3.6MB

                            MD5

                            eee2a159d9f96c4dd33473b38ae62050

                            SHA1

                            cd8b28c9f4132723de49be74dd84ea12a42eef54

                            SHA256

                            52c720ca9b1d7649214694bc46a9ea0cf2ee3091e1ac717633ee06b6e2864384

                            SHA512

                            553c8b347e1654ca256dd4b760deb669cf394763419c972bb60a555006525afed2cff53b2516e8b239bc4bb35afd5429bd89611303143e7e65b901c0f5c2cc07

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe
                            Filesize

                            13.6MB

                            MD5

                            0cdabd52f745074bd258c99e68876117

                            SHA1

                            8913cd6a807e3807c697b1be4a8014712805fd1e

                            SHA256

                            221ede5696634b6f2be0bfa6a5ea531bf93d78b7113facf34185ce305891d66c

                            SHA512

                            65ac5603863f0799b2ee2f0560f0d11013b1c906236bdd0ba11467ff2bb9bd95a86f7cb6e7374347265559cf34b2d9ba6563f14f2c729fa586d38ac5dbcb7505

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\nse83FA.tmp\LangDLL.dll
                            Filesize

                            5KB

                            MD5

                            68b287f4067ba013e34a1339afdb1ea8

                            SHA1

                            45ad585b3cc8e5a6af7b68f5d8269c97992130b3

                            SHA256

                            18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

                            SHA512

                            06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\nse83FA.tmp\System.dll
                            Filesize

                            12KB

                            MD5

                            cff85c549d536f651d4fb8387f1976f2

                            SHA1

                            d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

                            SHA256

                            8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

                            SHA512

                            531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\nse83FA.tmp\modern-wizard.bmp
                            Filesize

                            603KB

                            MD5

                            4df53efcaa2c52f39618b2aad77bb552

                            SHA1

                            542de62a8a48a3ff57cf7845737803078062e95b

                            SHA256

                            ee13539f3d66cc0592942ea1a4c35d8fd9af67b1a7f272d0d791931e6e9ce4eb

                            SHA512

                            565a6ba0c9afc916cf62dac617c671f695cd86bd36358e9897f1f0e1a23a59d3019a12349029e05bf91abfb7b213ef02fc5c568a2bfcde0e3896e98cbcfa623a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\nse83FA.tmp\nsDialogs.dll
                            Filesize

                            9KB

                            MD5

                            6c3f8c94d0727894d706940a8a980543

                            SHA1

                            0d1bcad901be377f38d579aafc0c41c0ef8dcefd

                            SHA256

                            56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

                            SHA512

                            2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\nse83FA.tmp\w7tbp.dll
                            Filesize

                            2KB

                            MD5

                            9a3031cc4cef0dba236a28eecdf0afb5

                            SHA1

                            708a76aa56f77f1b0ebc62b023163c2e0426f3ac

                            SHA256

                            53bb519e3293164947ac7cbd7e612f637d77a7b863e3534ba1a7e39b350d3c00

                            SHA512

                            8fddde526e7d10d77e247ea80b273beae9dde1d4112806f1f5c3e6a409247d54d8a4445ab5bdd77025a434c3d1dcfdf480dac21abbdb13a308d5eb74517fab53

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\nsy7474.tmp\System.dll
                            Filesize

                            11KB

                            MD5

                            bf712f32249029466fa86756f5546950

                            SHA1

                            75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

                            SHA256

                            7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

                            SHA512

                            13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\nsy7474.tmp\newadvsplash.dll
                            Filesize

                            8KB

                            MD5

                            55a723e125afbc9b3a41d46f41749068

                            SHA1

                            01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c

                            SHA256

                            0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06

                            SHA512

                            559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\nsy7474.tmp\runtimedata.ini
                            Filesize

                            86B

                            MD5

                            a46d1a5d71b1a776067a34687c289b03

                            SHA1

                            d78c63066091bb6cf40ebfcf0b42f36d00888ce5

                            SHA256

                            e854615e9ce7d33626cf14c6b833a7f25b3629e79aa997cf527cc53a0433075e

                            SHA512

                            ea5c45719b2e894b3d448900583e8645b6830c80dcd7cef64db9b594eaee9150edd19dfc554e221e0997f0f01ebd5303a49f2d64b454b575fde2de97674b253c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                            Filesize

                            502KB

                            MD5

                            e690f995973164fe425f76589b1be2d9

                            SHA1

                            e947c4dad203aab37a003194dddc7980c74fa712

                            SHA256

                            87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

                            SHA512

                            77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                            Filesize

                            14.0MB

                            MD5

                            bcceccab13375513a6e8ab48e7b63496

                            SHA1

                            63d8a68cf562424d3fc3be1297d83f8247e24142

                            SHA256

                            a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

                            SHA512

                            d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                            Filesize

                            19KB

                            MD5

                            92911facaa2e06ba96b5dd9b502d0467

                            SHA1

                            bfe4066ad7711ad5d84d32eee8dd4b0e4e09b052

                            SHA256

                            199f7010ebd6416b49ba05200d47aa50d05a00e4eef034b902cb853aac80f3dc

                            SHA512

                            9d7da80790914dc8a4cc145c0bf6869e4a9aa9885f5136d91337339ebdabcf3d73017019d7cccda3df71f6dd920877f614352743ce0320ff625480613d2ce49e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                            Filesize

                            20KB

                            MD5

                            ef197598749f1d0dee7a3965f76ef4f1

                            SHA1

                            eb3d7047b20d7d7c6d80c207e95339dfb29c939b

                            SHA256

                            5c743b7a51c7c51d8808bc6af22e655990f91f5c9af77a8581725d533df38bba

                            SHA512

                            4960c423bb9581bca11bb45b046952b823890f8cd896c03add04f2166c6f1a59e57fadafb6ec0f58a2ff2092912d0873876c02855cfa25975bd8a80abdf81844

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                            Filesize

                            19KB

                            MD5

                            486abd9a6ad4add476231aac7c264529

                            SHA1

                            5f0f9b90900075160fe037e064db6c939814f450

                            SHA256

                            18d49b0dc640a794e0659f402b01131e5e17f660e83acbb0bf0e8aaceecaed2a

                            SHA512

                            d2c00b065a8eaae55cef7f241674551e30503fce39f3daf136c2dd875fbcda635c54d27bdcc61a842492ae0f9ed857123f2019b7e5f681f87a28b7510f051845

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                            Filesize

                            19KB

                            MD5

                            9b817202a920b3788e38be6eaa4d7853

                            SHA1

                            ff88c107435305c6f736debdb9eb58e5ba6a2a28

                            SHA256

                            14f58252b2495513bdfb508fe526823856dbdbc4ba2ae2323859de1b0a04fcce

                            SHA512

                            c7dd466fdfce8cdad45cb0269fbaac8293cd44523feeccc85518be1066563c0802765341027763bce5b0d534a5e8811abceadcae4d01505e2f6c3b926c70f6b6

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                            Filesize

                            19KB

                            MD5

                            8c38ba93cf2d7152d433e606929f40c8

                            SHA1

                            74f85bbc2aad43ba670523e189a660201328d4c5

                            SHA256

                            d77fbbf86a3daa1de08ec363bb6592153b81562645e6dfaa783728da46e1fb1c

                            SHA512

                            16f852d088acd94086947c406f3614f0052f2dc874067abd39afc3fb96e84335a7637e28b794a13dcf6b4f1a83bc4715eb920ef8bc8b7c126edf6a780601215f

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                            Filesize

                            20KB

                            MD5

                            3f322b9ec07009938d3c11b88f385a00

                            SHA1

                            6f2c6200f07c3aba7fea9249d09c31b6c0aa5370

                            SHA256

                            bd3a67986146a92b97b6a19e5a8e75b2727b18f099d8eb13ab2534389bc26ae4

                            SHA512

                            ae99471c097193b64593c581aa956911dc66036f55aaed8d64cbd11ae61e157211479bfd26cf07913a9112d7e42afae7790a0b830c08044141c9ee16935cdf62

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\AlternateServices.bin
                            Filesize

                            7KB

                            MD5

                            a0bc39e77578f0af2795d40da371d7a7

                            SHA1

                            4ada4d69fdbe0c5672695dee88130bdf86c1dde0

                            SHA256

                            74ae174d2340c11ac265a2e0ca370a94694a9e5a7857746fc7eb2a93627bd9ec

                            SHA512

                            86f3fb10a7e8466e078b5e2bead4337766a951334621311ae85c9da73464115dde7380dda077a51192f3b32d21d3c8d673e0b66a45154b754f9fa1c813a7778c

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\AlternateServices.bin
                            Filesize

                            10KB

                            MD5

                            f04062392114eded0a7329e083d419d9

                            SHA1

                            ea69b4c45cb7a65bb7050c6c9576aede3ae28181

                            SHA256

                            240ab84b886e6eff37516cad32b5e84af009b318f86a0d47e47916937b027b1a

                            SHA512

                            96e3b5d0ec75307870572bc401f127055ea84d558a154efabe1659e4d35943f17032da9f103692a124497a6f5a6e320466a5e9f4db5dfa498d16c151db063c77

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            119KB

                            MD5

                            14b414fc628af94e60a57df7d6102d6f

                            SHA1

                            6a79f2c7189f902106ea521bbecf6f63569adc3f

                            SHA256

                            49a510a5dba38f6001dd6b11a0bf76f300a1af5e6818263c56dba9ace5befab7

                            SHA512

                            3a736540e8e7302c39adcefaa1439007ea4039dd7d9a372e91051588c2e2e356d707b896c21b8f7091f6872bdb3e5384cc10c7b34b537720f50c5826c4b4941c

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            26KB

                            MD5

                            b51af28810e41d69e756e71882ff9d9c

                            SHA1

                            32204484d0fe8b14691838fe822f4d574a19c461

                            SHA256

                            038ea116f7d9f6993886b200b2a9990d6e347db196ab6ecf34ce4fa54c86c1ff

                            SHA512

                            288cbf118770da00067d5d97c3c17bb47308688e8451fa49f50ae83da524f694237fb0b9d766c64e6b1670173c835ad851e027b1be6371176b717c7f88d6dcc9

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            119KB

                            MD5

                            db79e4ff46f3b63930a9d2a157ea183b

                            SHA1

                            8512097e8a87713a18981c16d080ec12818a73b1

                            SHA256

                            6ee9a986021c8f31f9a6dbf3ad1a48a419cb8382ae18c0388309041c09776665

                            SHA512

                            dee04684a346845907ddd4edb663edbe1df09108856039c450697d8bf16f5093c4728f2b07cbaadc816af3434534bdb377b813f0a005cd9737d67fed9c64cd56

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            0996fca12285cf4e15721769bddb4bd7

                            SHA1

                            bd6e36f7309ee0f439e562278f2690a90cb4e19d

                            SHA256

                            f7f0982595e9eb1497b96b29b76d86bf02fa4ec08163b0d9ef86cd7b30d7fc0d

                            SHA512

                            a2745f2a7b63eb3aaf1138ee9458789e2e32539d1bb30c1b499bc6736260f2da7fce2bf2abdd4ce52f22a6b7dca62d610ca43c4f7bd7bd7dee7fc2a15867505e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            26KB

                            MD5

                            ac27798ff5b7fc3b04fcb1829c283da6

                            SHA1

                            fa5f7d247954ab65eecf4aaf3c9ad88661b593c4

                            SHA256

                            d3abd840158386a8494fa93afbb01105d069a017536ce3a2f1fb25db88c55d15

                            SHA512

                            4f67e6581a6403a7a16e3b3330aa6c567eb84ee8c7410dee549e00cf1293b1f152ff72d5d42d78bcea541f2e92a7b9e5d1435a4dc30e6308266e7d584f5b3018

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            c9abeb255577261f41af9ce97b18d149

                            SHA1

                            b8e034eb3a13e81df2a26e598713ffd5a02beec5

                            SHA256

                            366ed267157b6c688bf13fb52ec4e905018c85538ddc809dd7f2bcd90719f57c

                            SHA512

                            d0e537426a7ab2cd99c2341c6f2e03d9cb007eabac43974a0c4becf4312a5ba8f107251dd963a5fe69cfa6f7b171ac6f13e31d6d01f8054a3fab4a4b62bfb243

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\events\events
                            Filesize

                            1KB

                            MD5

                            9a0e287009efefccf8c0f8517786a7eb

                            SHA1

                            cadd55267de8299d47dc31c743813846b911c129

                            SHA256

                            76e21424bb2781e99af3332b6c2cc71c98dbcbd9db271b42aba967ad25c11c31

                            SHA512

                            35f9e247b48c0901ad44bc92371a12fa86730956d8ff81bb5a321b34081be0dec2ec39102e5f41416c905cba12d4260e7a41b6e8ae05021392b20aa44dcac796

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\events\events
                            Filesize

                            4KB

                            MD5

                            d086a1b9171abd52fa78cad79bacb100

                            SHA1

                            f2af873be82469850e02e4aa7c65826ce9cb7b63

                            SHA256

                            1d72e3c54439c1661a713fcebdc105b18a5e99813ebcb3805eb1807391145021

                            SHA512

                            f34972e0e16da4dc4f7eb90e2e04261eeeaa4b01e80dbfc5b95c85d0e8664d1e3972c85e168f1acd1270c699c64a65bcfda43a3a4379918732c7bdfc4baf6b59

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\15d11b29-f38e-4c7c-b601-928080c58ffe
                            Filesize

                            235B

                            MD5

                            17e52259d6a66d1ad0994788f658c2d4

                            SHA1

                            af2acf1ed4caadf16696d4222c9b8674873d8b31

                            SHA256

                            436c8c811f62c532cf824c3a6da0894fc1a811bd563522bcf5575912583eb576

                            SHA512

                            58c07e18f4503fc0bae577eac8aefff9b6b378f5a2f477589b4eea1a7d08b3971ef3a80a97e0242bf694a888a902dbc38db0c1c29ca88814c835120804058e51

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\2e81d38b-31b8-4a6f-bc86-cedca2d1585a
                            Filesize

                            883B

                            MD5

                            b97e641d3fdd7d67d9439d93d64ec902

                            SHA1

                            bd2c50db133727d7319c18e5911a79f56f1ca9e7

                            SHA256

                            724a5f1491451e4e689cef76f07a1a05c1098b831f7cac00c0259d8b6884c702

                            SHA512

                            6b0d42979797ce49e740a00b8811ab00be0e55a87a10465b55d19cdb6f147141fe6c20a76d14388b8cc7be7d5303273b8933f3d84fd41c066d9c82daa9e951c2

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\344f49b6-4a21-4069-b6b2-1566f08798c7
                            Filesize

                            2KB

                            MD5

                            b02d8323bf77a663b8791f57393e6029

                            SHA1

                            61e7ce35b40242a51f7bf5cf9d7d570333fcfcea

                            SHA256

                            67a3cd5e540b7c3b1772f1300282cf783f8a5328275eb506860c2a6960ec6d4c

                            SHA512

                            626d3bf903b60059f472ab802d1b575424385dfdc1255919307d04557372dd2207fa56d46bb5dcb697fccd2d1dab1a6755a181270a210bb88a50761809c6e8d7

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\3f310a20-c1da-48e4-99e8-9807a3629926
                            Filesize

                            235B

                            MD5

                            325c78d41d22b46832e14fd018073a9f

                            SHA1

                            834e867782f6cf04868adbba936468621c94cb8b

                            SHA256

                            348126bb316f7f90a710e600992155eae327e65213c8bcb2bae04bd40c6f71b8

                            SHA512

                            16323195c30e3847d3eaa8615935715eb00cfb997b39403a1858a2ef721131be7c0dc8e314c91a3004b51f03f947223f935dda86776628b4ea35408d353458a5

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\b94e6c08-bd2d-4de3-a1d5-01ee6166f014
                            Filesize

                            886B

                            MD5

                            b83fc6488900d632da3b6eeb6f93df59

                            SHA1

                            df4c449749d528ff55a06f9efd8aca721c04c1af

                            SHA256

                            1b923fa009552aea57081481cac3e77d9cc945415cacff491dcab40c55c0620f

                            SHA512

                            72bd50df6cc5075c78687ec3ddc4d8cb1d19b79a93359c8300b7981b431d2c70139f1851eaf1e39dff805bcabda0df801ba6431240ee45db207dc58391cbcdfd

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\f6eebabb-0a6c-470e-a899-031c6171df7f
                            Filesize

                            16KB

                            MD5

                            7f221cdcec3ad5abc18c77c5b1c1ed98

                            SHA1

                            32505010e6edd8d42a3b7e7a52a1eac46f387338

                            SHA256

                            17886735947926d536642b344d45d5613ceeec466b1f163b952645335f7d8921

                            SHA512

                            1f8cbf93227d1db778b659c3f37c914abcd5faffcdfec76c7e2e4fdee7eeaf66e0b8de1b3e31aef17347fc7e878c2ee83d80c871c2fc7d3c922a440e1519e91d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                            Filesize

                            1.1MB

                            MD5

                            626073e8dcf656ac4130e3283c51cbba

                            SHA1

                            7e3197e5792e34a67bfef9727ce1dd7dc151284c

                            SHA256

                            37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

                            SHA512

                            eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                            Filesize

                            116B

                            MD5

                            ae29912407dfadf0d683982d4fb57293

                            SHA1

                            0542053f5a6ce07dc206f69230109be4a5e25775

                            SHA256

                            fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

                            SHA512

                            6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
                            Filesize

                            1001B

                            MD5

                            32aeacedce82bafbcba8d1ade9e88d5a

                            SHA1

                            a9b4858d2ae0b6595705634fd024f7e076426a24

                            SHA256

                            4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

                            SHA512

                            67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
                            Filesize

                            18.5MB

                            MD5

                            1b32d1ec35a7ead1671efc0782b7edf0

                            SHA1

                            8e3274b9f2938ff2252ed74779dd6322c601a0c8

                            SHA256

                            3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

                            SHA512

                            ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs-1.js
                            Filesize

                            12KB

                            MD5

                            4d49887654306fbaf193848401cfcdd1

                            SHA1

                            cc2bee4d778866712ad63b3082b1242a31dbaf65

                            SHA256

                            e6c6e23446f813f0722b66a8b0ae65c32803168764ea0aee2e893483d9b9406b

                            SHA512

                            8cd787f72e589227b0369d83fde89433d167c7d8a3cc27dfc6b77f903646faadb5127f7365735051ba2fa86d898990346386652b5c9dad0bd673e53a6152278f

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js
                            Filesize

                            6KB

                            MD5

                            27ed9c73b7e10a95509a17a73a6012f9

                            SHA1

                            b4fad0cca245cd8a983bece3e7f4975a0f6eeb61

                            SHA256

                            07b88775ae97d09cb8ccc3442fadf0d21313e13aa6515438aac9aab4fa890551

                            SHA512

                            3e54dedc448aec23c98bef4b322d39f870ee67efb9af86b7c5a47181bfb26aaa1b724e245f763aaf5d867a169f4f7529bb605406e7c45a4fcbca5f27de3a39e1

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js
                            Filesize

                            7KB

                            MD5

                            edc03e91c2c7314001d34c354b20c8b4

                            SHA1

                            9fb4eb61fb8867e09f40cbb82a6726d3948bd422

                            SHA256

                            61651ba5286983e93a88bedac322138bc44f02168b46fea5fc03dda43e5884ac

                            SHA512

                            88a1da9ed80dfb96ca0f7c4bf800d1a7326df5a658dc715267b24a0763ddcff3055093fcfaf0888505f010d18d41173037a75438803b6c3c0c13fcd53faf1794

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js
                            Filesize

                            8KB

                            MD5

                            6295f855d7892991a5ed63f7409859cb

                            SHA1

                            e20184c35d725e62e3a16eebd15b22180f72828c

                            SHA256

                            dabe0c9ad5eefe04510fd59e4c0a55aa46fab965b4f3b9b5a24a4509b43efb75

                            SHA512

                            05e052acbe5352b7882d0c15b832074cbfadc52e42dfce742f98bb01060372db7f8b8402e8969e723245ec5ec40abadcfe89a78d903e15e95a5c497ecc542019

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js
                            Filesize

                            12KB

                            MD5

                            f1f793e6d766370b92d61539d31836c8

                            SHA1

                            02bdcef410797d51b68f6c57062f2d14fecce958

                            SHA256

                            e0ef64e76ab5b12951cfda75badbdfff6be2bf364dfa2c02d21e61e17882f430

                            SHA512

                            502ba06b8bdb572b1db4c14616d457d2f9f034db9137f0156a196495100df64db8ae641b418bdb895bfffa659c3f28b4ea63ef9a80638a8319304b486dcabc56

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js
                            Filesize

                            12KB

                            MD5

                            369ce48be1305d40135b6ef36131b945

                            SHA1

                            ee09b343849d17146d15704dbdc0b5707331a5ae

                            SHA256

                            a5ee45c4bbe4f7f241c6b6ee25dada95e631301f27ccdce9394ca31a2d776b73

                            SHA512

                            c7ef2684bfe16a791eab7ccad2edb688258c5ae9400b25a9d35684386ad52896eff9a1e42edee7744d4b39ea52c35c92dae09572dba7277647b9a95e1dd1644f

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js
                            Filesize

                            6KB

                            MD5

                            ca5126efe984c3c6103b5b9b14122159

                            SHA1

                            11ba955d43b3402f8a86c7795303627ba2b50799

                            SHA256

                            f8fe9370163a159f916e8c0662574f9c1c5ef0b14604d3368859f8de4e192ab0

                            SHA512

                            38e7e7edda70eedf5aa4c07ccc04fb41d337b2ebb2120c70546b77cd3fdcb328c9f016c13670cff265fa9593ce3c414b14f80d8dd3b1491a21967b81bdf2f67a

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            4KB

                            MD5

                            eeb4fcc671ff606d3f4a477784b15e3e

                            SHA1

                            13ae8d04aa915abc035e92799d6125c8750a95c8

                            SHA256

                            3badeb19f62fd816c48172751211b8369e9b8286d0f00843cb2d7cc00ab6219d

                            SHA512

                            f2fc7e7c50a88828cd05cf26f66bdabae52deb4f7a8d3e0760aedb54aeccefd65e2094930aa2b7ebd34ec1eebdff60b36a5c0c079b0be52d7f30f3dc8cedd8a0

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            6KB

                            MD5

                            7693630816b74925c65525b7b6077f7b

                            SHA1

                            604711bd08b511a24853d5c893a5d4ddd91c3292

                            SHA256

                            a775cb4ec40b5028975ba814f98a622b6680f31f9fa7aaf91e5347b9b3259dc5

                            SHA512

                            90aea7276261009f7f811a9c0123a9f5112237ad5d1aa8bc008518423b39cd04629cadffa8995dad1f48118a7050664d0dc5ef3f509dac5a784491dabc5506ab

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            6KB

                            MD5

                            86f1b98d211870730f57ad228fb37c5c

                            SHA1

                            86c060f10f9b53d9b6724a432de7f23d2641e7fe

                            SHA256

                            2120d86f7308865218500e85bded536b3c2a1a437ed4404d7b22c470f2875a89

                            SHA512

                            459ff49db4bc71867cc2a21c8e8b370d4530604f475a828c1e4e5576a09e696aa16977c7c9b2dec33f98eae9237c5d61436c30d1d35c40c9adb6b9a904774ce2

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            6KB

                            MD5

                            7a35a9bac6301dc384c6d3eb1e1a5c59

                            SHA1

                            a39dd6d8d6809a902dece757ed93588d48fb296c

                            SHA256

                            a5dc545579e374a37b48ebc36ef6615064e4f34801bdd519affd489fe53cf4c2

                            SHA512

                            726a018b0d2ca0c0366dba3e4e0facb496afa3d9994ee05ef9bdfff89aabcaf01ad7d877ebaba1ee3d53aef3cd0103b87251b99d1a750172990ef4f32cecb5db

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            6KB

                            MD5

                            bf1bf8451df1b34b66e57bc11cd3def7

                            SHA1

                            66225af73286743ceb0bd17399ac64658c28aefb

                            SHA256

                            545421d208950a84aba02877c5458ff1848d699a7ef27e5646c8fc2c7dcfec27

                            SHA512

                            b41e1f78dccc64c67f5aacb087a8386d918cfe1c72a657826847a7d34455f64a6b0fcba73fe33b8e820bc98f707b1333a2d5a615f716ef2aaaa2314662cae62f

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            14KB

                            MD5

                            044e5bed3083c81c93ba4047f5db84c6

                            SHA1

                            6e72dabd9d18990f1e137176b4b5098962ee2736

                            SHA256

                            b0fa35f96bc295e4c043e6fb95594156389cda9c9a42b51836d637ca7dccb337

                            SHA512

                            987aa1dbe00df953d03e8959c2ae91f23695bf4e304827b040b2c3c9ff4b9e66cbc188da10e3ec55b524f9420661b7985cc4768814cdd71893b26003545f065b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            14KB

                            MD5

                            fc924b960de58742301705d9a655649c

                            SHA1

                            f8eab49ba442451e108b96c77aaab9173eada3bf

                            SHA256

                            a5f704e1c2632b1bc4d59b24f626180f5dc63ac59baeb2342fbd69f4bf6bbdd7

                            SHA512

                            272452a84af82c3fe5a790a37b8482a4798ffd5997b45b194709300ef242195cfb17eaf10c1dd2fbe5d721a9c4fde1ff18cc9f5ca3ee3038ee5ec0284c38c230

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            12KB

                            MD5

                            d20e5979f32651846be5313239a01c8a

                            SHA1

                            6d58b5e276e120361e59a69cb83f6ba8119ea1fa

                            SHA256

                            722a18652b60069e6661af1685d076e7512b69676bd65d150f03c4d4d143b29a

                            SHA512

                            93f2f5572acdb8cc7106569c5bef5317f5dea20367efd8a71d247e9b01944a69770f9bc286effbbcfab8772d4142955654cf97a03d7a2b758947f2df7ce8d7e5

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            14KB

                            MD5

                            f9186a88d6f905f8c1b8125cf2fccdb5

                            SHA1

                            cc41866c979fba8f63e3639d9b1b5e820f4f5a81

                            SHA256

                            cffe7bfe12867630cf8845e1c0c41b3123b65faca0f075f723f8479d5c619894

                            SHA512

                            6d82444e9be49230516439ffc8f7ba60ed15d05d1be1356571f4545f586ec56e45fa2733aecab6282767995e0280828c6995882f1a7870b3c4ab4faeb926074e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            14KB

                            MD5

                            e9da55de7d800c7e329e33cda8c545f7

                            SHA1

                            64301f7397ad13d9d95012a989e287a49501f3ca

                            SHA256

                            fd5d6ccc6333b1afc57cbc0323cd955e3be0c298a89597336f5d4f4c22a32cca

                            SHA512

                            3f439ac3e12390fffe1e2d9c277c38eb774168f18cb02ad015e3ddc6118cadb153ddfd1d0e7038c0dc7f4429bbda885c1a58c56f73c9dbf3600804d9f5c3125b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            6KB

                            MD5

                            61065a77f3ae45c933909f88eb442aea

                            SHA1

                            52cdd470ef3a7e244e92b529c7086af4ebb11d50

                            SHA256

                            efe6d72376e16aea0790a669edae465f13e358b166ef23d938f0c3cb33f82c59

                            SHA512

                            25f90b2e994dce179c599ed83948b11c4d8539b8845010de58083e96da81dc9e10aa66275911035d26931293cdb46716151d5e914618f5d6667cfa68ef6e8766

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            6KB

                            MD5

                            8aac397b65b92fa1d64ab3270f46eaae

                            SHA1

                            5e11dbdc219189e285e81adac6191710238f2c15

                            SHA256

                            fc698146781148e5eb8b5028a02f3f9b853dc06b6c53964cea26ccb41a2c2dc2

                            SHA512

                            5c84ab7eec61d9b6b60620df71689fe9baacedc84976993f51e7cabb7bb54c737b6e1ac6f0af5981231aaaf1a4e28dcf6c0415512cbda67753aa3c76462bff47

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            6KB

                            MD5

                            99ab0232d50a35ab0773b999900c5a35

                            SHA1

                            b7559e56c909d75594782dc3d6578108bbf3c007

                            SHA256

                            61462e470cdd273c54c7113184bbc7946e88c3c7b9b230a3f8bf6c4959636f87

                            SHA512

                            6643588605565ec689b450bbe116d4ce327743672d233aaf4f7b87cb238d61e222979302c4a30591fce1e5d20731cdc8955ee1a57394452b38be8924af253b57

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            6KB

                            MD5

                            8afafb7eef41cdc3f03048c9f23c4431

                            SHA1

                            5b853eb49c8682206afd2099b0a2dc4b52ac0a47

                            SHA256

                            9e511f83f0ef2ba2765d211d5025cf7d32b0f8f8b126e84ce6356944b743d81a

                            SHA512

                            e253943239ffd8d173a68c26d92131ed04299f412a3cc34e9b6dad9164367ae5b9e7438a2531b4cba96a55d6b0760616bfbacc72355440107d46971c731f09d7

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            12KB

                            MD5

                            ab236b35ba647e924e410a8d922a1218

                            SHA1

                            c8a4fc2e609fcdddc6f049888b1fc05c1778a403

                            SHA256

                            adad905a17e5cb5831f4457d3ddfac4411f22f2ac00d08a1ff397ec92460c354

                            SHA512

                            aded0738b9a36c2c3e67bd8bcace942226892145f243e876404158a84d873e3d2cbd23c34b3995681d5ccf2aed06031a919cccacde42c02899e4ea854d57a138

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4
                            Filesize

                            14KB

                            MD5

                            a4574fabeb051accb6e39b4c5c953ba9

                            SHA1

                            841bc17a1222431142e2841ac00292dd051a6020

                            SHA256

                            752c42cd1701be03cc85ffe10ec6e20cf82c70b4701210b465da73713374c7dc

                            SHA512

                            f562e1a26dc5f849d6e849687a86d028eb45b1db71d55e706db143d3b2b5f7cf52735dc8c85658823729b8268b5d80e2a600f4598c3e4142637aa2a973f55060

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.jsonlz4
                            Filesize

                            1KB

                            MD5

                            04062d9ece06f37d0ef824271d441bcf

                            SHA1

                            19d7b1680ee95b5eefedf49a53adfbaae0748521

                            SHA256

                            050418b5eda3b868361cf513d6b6a39ec7950ef23611e9f28a0f3f0f73f735ef

                            SHA512

                            272239e4d9b1a4ecf2a22463c2c5eaa9afa6ce7431a383fbc699e4d0d0f3e825e563468628dda9f130994835a2b74d7396cac713cba0eac263b2f4d83cab04ad

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                            Filesize

                            1.9MB

                            MD5

                            4b58b5f4f17b0319925a053b13487ad8

                            SHA1

                            49638e435433688cfcaeccda93544adbb9b8a913

                            SHA256

                            21fb93ed539d7848e9bd1e332721a0365f64a100ac1716d0b790b514a595b45d

                            SHA512

                            62f180c082e90d39df67f96a065752c70b7ce425d007059c8e63da2d2cb3ae182f28bec2c3a441bfad9c069966679250a02a17f3e73f8bc2684b4652311206c8

                            Download Submit

                          • C:\Users\Admin\Documents\sweet.jpg
                            Filesize

                            23KB

                            MD5

                            58b1840b979ae31f23aa8eb3594d5c17

                            SHA1

                            6b28b8e047cee70c7fa42715c552ea13a5671bbb

                            SHA256

                            b2bb460aa299c6064e7fc947bff314e0f915c6ee6f8f700007129e3b6a314f47

                            SHA512

                            13548e5900bddc6797d573fcca24cec1f1eefa0662e9d07c4055a3899460f4e135e1c76197b57a49b452e61e201cb86d1960f3e8b00828a2d0031dc9aa78666a

                            Download Submit

                          • C:\Users\Admin\Downloads\!Please Read Me!.txt
                            Filesize

                            797B

                            MD5

                            afa18cf4aa2660392111763fb93a8c3d

                            SHA1

                            c219a3654a5f41ce535a09f2a188a464c3f5baf5

                            SHA256

                            227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

                            SHA512

                            4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

                            Download Submit

                          • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                            Filesize

                            236KB

                            MD5

                            cf1416074cd7791ab80a18f9e7e219d9

                            SHA1

                            276d2ec82c518d887a8a3608e51c56fa28716ded

                            SHA256

                            78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

                            SHA512

                            0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

                            Download Submit

                          • C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk
                            Filesize

                            590B

                            MD5

                            451c30983664a9e6386f56d7428f1895

                            SHA1

                            22c339a4c686232b2c061b33832fb6464db111d0

                            SHA256

                            9343856f102d55713d418de84873c6f44dd1449d1bfc54a27f20fa2be5423a38

                            SHA512

                            60631cd368c7cc3f8baf103a9c6c217813561860a33a70e4a907dba2a55bcb04034138f947829e9029746ccda355caec51c7dcd9471e1ba717345524f70e383e

                            Download Submit

                          • C:\Users\Admin\Downloads\00000000.res
                            Filesize

                            136B

                            MD5

                            45ebbe92a7d944b95fdc629f041e430b

                            SHA1

                            3f115e299ecf4bcfeed27536eb6b92b7c89b9fe0

                            SHA256

                            737ebc7391c5de958d9231d002065b3255a3e78c7bdc6440da86cef129fbe397

                            SHA512

                            d7e8e3b358afd0ec2d36ff3e9a63722f09811cefb7e76a069931fed4d9d679bde4055264aa3159254833513f17103db9a49ac4e1793a93e4317314c4eb54c8ab

                            Download Submit

                          • C:\Users\Admin\Downloads\00000000.res
                            Filesize

                            136B

                            MD5

                            259960a3e7b0045527b93ee360e89961

                            SHA1

                            f7fb45319b2414ded10895cb3e6586536bf29f2c

                            SHA256

                            94ad940b09d0e63982d30786b939f6390bed7cb2fae9985a5ea10c4dde784108

                            SHA512

                            1b90feb5c1eed2e316888f06afa00863ef8ac396eff2168426efb85b7451d0a2ae57c0b0c4ddc2cf83c58ade58852f6b17f433a4db59c93b83e97e457de24375

                            Download Submit

                          • C:\Users\Admin\Downloads\00000000.res
                            Filesize

                            136B

                            MD5

                            f77a19a27ff62a55b5cf464c96ec5d14

                            SHA1

                            092d5f618989954f319fcc9a2d731bb5c52bf453

                            SHA256

                            20b2b80bb228c5a9450ebb0303deefd08a7274f0daea80fe76e38b148053f8ad

                            SHA512

                            c2b6206ff5a781a82f915e7dd417f39cf213b08e48d2791d0c88dd10eee2c04b6e1b71f7b303aa55f1fa7bd854918281af52f7c1307f195fc8a743685386b69e

                            Download Submit

                          • C:\Users\Admin\Downloads\23891742751638.bat
                            Filesize

                            318B

                            MD5

                            a261428b490a45438c0d55781a9c6e75

                            SHA1

                            e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

                            SHA256

                            4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

                            SHA512

                            304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

                            Download Submit

                          • C:\Users\Admin\Downloads\Bezilom.exe
                            Filesize

                            28KB

                            MD5

                            8e9d7feb3b955e6def8365fd83007080

                            SHA1

                            df7522e270506b1a2c874700a9beeb9d3d233e23

                            SHA256

                            94d2b1da2c4ce7db94ee9603bc2f81386032687e7c664aff6460ba0f5dac0022

                            SHA512

                            4157a5628dc7f47489be2c30dbf2b14458a813eb66e942bba881615c101df25001c09afb9a54f88831fa4c1858f42d897f8f55fbf6b4c1a82d2509bd52ba1536

                            Download Submit

                          • C:\Users\Admin\Downloads\Bumerang.exe
                            Filesize

                            4KB

                            MD5

                            0447366545adfa485ad3014da2ef9ad5

                            SHA1

                            70bd1a6f4fa30394295f70305c712a332745f52a

                            SHA256

                            45a0f14ccc04d8edd3d3a03ec63585b7b9d5571c51d601242dd88b84f7d92daa

                            SHA512

                            285330df8f190c4d25b59f5c8ff38d25f66f85e89be0e74059288669790d516223734e4582d3ee2e8c410cb86058f79ccbc6d9df607ccfe4951ef473e2651aac

                            Download Submit

                          • C:\Users\Admin\Downloads\Bumerang.lS6Cr92c.exe.part
                            Filesize

                            26KB

                            MD5

                            b6c78677b83c0a5b02f48648a9b8e86d

                            SHA1

                            0d90c40d2e9e8c58c1dafb528d6eab45e15fda81

                            SHA256

                            706fce69fea67622b03fafb51ece076c1fdd38892318f8cce9f2ec80aabca822

                            SHA512

                            302acca8c5dd310f86b65104f7accd290014e38d354e97e4ffafe1702b0a13b90e4823c274b51bcc9285419e69ff7111343ac0a64fd3c8b67c48d7bbd382337b

                            Download Submit

                          • C:\Users\Admin\Downloads\Fagot.ZKQ3Yzey.a.exe.part
                            Filesize

                            373KB

                            MD5

                            30cdab5cf1d607ee7b34f44ab38e9190

                            SHA1

                            d4823f90d14eba0801653e8c970f47d54f655d36

                            SHA256

                            1517527c1d705a6ebc6ec9194aa95459e875ac3902a9f4aab3bf24b6a6f8407f

                            SHA512

                            b465f3b734beaea3951ff57759f13971649b549fafca71342b52d7e74949e152c0fbafe2df40354fc00b5dc8c767f3f5c6940e4ba308888e4395d8fd21e402b3

                            Download Submit

                          • C:\Users\Admin\Downloads\HitmanPro_x64.Sc3emqo7.exe.part
                            Filesize

                            13.6MB

                            MD5

                            10dc710dd495e9078ce79b26e18591e0

                            SHA1

                            aef434d6b77158dd2accd746bbc727bbc3367adc

                            SHA256

                            be5389a28e952d7ab2d9447c1bdb8eb7d11b24cb02e4b18da367715c2acfdd15

                            SHA512

                            959c5cb47b9d1c21ddfe2eaac14e0c99c758aab85036705c072525e70255957abc97412ab0ceadd2adbebc1b176699614f71bf50689cf9ff97891e6216a15dc5

                            Download Submit

                          • C:\Users\Admin\Downloads\Mantas.qzQjFIPv.exe.part
                            Filesize

                            40KB

                            MD5

                            53f25f98742c5114eec23c6487af624c

                            SHA1

                            671af46401450d6ed9c0904402391640a1bddcc2

                            SHA256

                            7b5dec6a48ee2114c3056f4ccb6935f3e7418ef0b0bc4a58931f2c80fc94d705

                            SHA512

                            f460775308b34552c930c3f256cef1069b28421673d71e3fa2712b0467485861a98285925ae49f1adea1faf59265b964c873c12a3bb5de216122ac20084e1048

                            Download Submit

                          • C:\Users\Admin\Downloads\WannaCry.2hpPO9Y_.exe.part
                            Filesize

                            224KB

                            MD5

                            5c7fb0927db37372da25f270708103a2

                            SHA1

                            120ed9279d85cbfa56e5b7779ffa7162074f7a29

                            SHA256

                            be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

                            SHA512

                            a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\AppInfo\Launcher\WiresharkPortable64.ini
                            Filesize

                            282B

                            MD5

                            205c7a933e1ae0c468eb07992842d02d

                            SHA1

                            bebd7c0cb1d8c8b51f58701c87be239a202010af

                            SHA256

                            31e648f31b2fcdf0d93a7168520e6de903e337445d4cc3dcea373e68717418a2

                            SHA512

                            5d28aa90281e65151376fbdd09cf18f5923abe10a5ff8cc4ba140845495bd26d0515a45cda685cb8a6b18a63f151fb6639c42f880dafd5ca2a39da919e4b0000

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\AppInfo\appinfo.ini
                            Filesize

                            646B

                            MD5

                            6b7190a68399dc1ead405b34f8ead5f1

                            SHA1

                            d8ab5a3840d9f781cfb03f5f3742c5216f0dd0d1

                            SHA256

                            a71346b8097a46e6f99fc9491f26df0e8b3a7c5bdc75a3bd31babe0f5de055fa

                            SHA512

                            a0a914e4a552de3807d4db0d4afecfef3f7082373c2e1e0a9e7a23d4ae3a97ae850e4c28c3f8265fbea9ad9967a52e2cdd720deafbcb6675339c5dca239302b2

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\Qt6Core.dll
                            Filesize

                            5.5MB

                            MD5

                            9e1e3d2e45493eeb00bd80f66a1180e9

                            SHA1

                            bfff651034909d5e8846d59583600c554d89bf27

                            SHA256

                            d6a3503cfcaf464cfa99ac34c81256f3d0ec44c77a7f8c1c37bb7f116872fb7d

                            SHA512

                            bce890d270df0629261acccd9eb39d935e00f93a0b63b69d2cad492c1e13edf3ec73ce2a2363eac82fc5f4e98f886f24788539009c2466cd3ad5a839766ad063

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\Qt6Core5Compat.dll
                            Filesize

                            813KB

                            MD5

                            b4c68e7e4cc5a36186ec29038f7acb16

                            SHA1

                            f052d11aaa65a2b86d6393102748e5342f4cf9bf

                            SHA256

                            63b9606bcd6942ca245b6d08276a6c0cb9586dd22b025737ff25b93204d6e0eb

                            SHA512

                            68af8f1938933a0775f7fe6ea20fe4f8e5020dc18b2a66c24af8b2f9cb986da9c1602b3d1baf7570cc9b6b5da5a01241acce7d948ea1e32ff63f97dd9a527e05

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\Qt6Gui.dll
                            Filesize

                            7.7MB

                            MD5

                            1813d6970143bc22ede73e19739496b4

                            SHA1

                            9a71391d96d18cd4ba5a7e9f1ff614dafa9933e0

                            SHA256

                            f01a483a831cd89764d043280e46014b658878d09a33b4c74bfbd8cd0ce4e31a

                            SHA512

                            7211e9b2418c00c31c3b07fbe6644032ee86ab111582ae7295c9b2e973e6d512a0b080d5c6b7e354a9e0d1a1e43fcc727df65cb4e3bcbec84dcdfe7ca9a9ab97

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\Qt6Multimedia.dll
                            Filesize

                            748KB

                            MD5

                            a7c4f760d23a6e1c7d77c408fea0ba4a

                            SHA1

                            dde45ae6caa45a1b76bb81151e0cf805a4d5e3de

                            SHA256

                            c5b02fc4377667a09f3f7f694e2c82dd623373e70c2e3b900f7daaee1b6a7dfe

                            SHA512

                            c07d8a8f0454896ecaabea169b66e91618d2664b7a895fc8ab19834d823fe7f12e75f40f21b5c1407f97fc14c6d79b4a2775cf29163670571d7e458a9c247d4f

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\Qt6PrintSupport.dll
                            Filesize

                            383KB

                            MD5

                            70ea3dd72b3f1d309e7b792ca2a8ad32

                            SHA1

                            e8cdf928a40988d34ec1b8495ce5f8ac810f18f6

                            SHA256

                            39d61bca1bc1099648f948284c27e4a721049e438f17b404db7a802bf828880d

                            SHA512

                            62871ea8ef4c2f914fa31313faf2291233967074df4865bd395c70d54bbfbc466035cbe64150118ef45be99bff93a1086930f4a67b0f3f640375322d99308eab

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\Qt6Widgets.dll
                            Filesize

                            5.7MB

                            MD5

                            c0655090dead7a1588a5b8bfa2c357a5

                            SHA1

                            d7376558b8c2bfef53c815eb517fbc25cd4e9c2a

                            SHA256

                            8c970bb730a7bbd920bb26c56adf58111240e831f6a64bd1b7a5991762c0753b

                            SHA512

                            fd7242643896bd538ae0d069516cd51d0cd73b6a474554520220461671a6924e9bea306d5a56b8a1b577451acbd1775fb57a0bae1c5ae2ad5f2c0834f02f519b

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\WinSparkle.dll
                            Filesize

                            2.3MB

                            MD5

                            e85720360e17eca575bd26c88dc07d9f

                            SHA1

                            fff1f2eb33c248d346f517f0b80601a1caae3e9f

                            SHA256

                            502cfc4c0ee16ffb28e2796b352714b8eb52c12efea4edca143b2a9f26c3e406

                            SHA512

                            ae9215acf0b0dd53dfb64349d01d00f1fd0b69d2a0b253cfe2dd68cd2cd53d6f8e6037541c462d23dd62917f9bde7422a06d19d3b5146d165db2d780dbb02f81

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\Wireshark.exe
                            Filesize

                            9.6MB

                            MD5

                            8d7a29a1db7ace411caac04f85eac08d

                            SHA1

                            68fc63c7ce01a34b7db777211f709dbb4e42138f

                            SHA256

                            deaa123634c3f75bb7738e0e281e198480e665f3dd7c4525a86ddd289181201a

                            SHA512

                            f37f787dd67be71008c6ec7ad66a5fb5f9a81428c925528f9c0496b7ad45345e193470036fa15bae43d03ad268adfd19c96acb39d7c85012e88967daadc32af5

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\bz2.dll
                            Filesize

                            84KB

                            MD5

                            2b76a0e7b6d733e1e46ec262bf414ae0

                            SHA1

                            abb51c78b8ba6ae3545ec53ac875fda7d2474be1

                            SHA256

                            fd06f2fd1d7986351a051d37bd975adfc8398e06a0f70ae864137b66e0a207f8

                            SHA512

                            dc8c70c6b1366fdecd4fecc0410fbbcf02d5acc03f67f50aaf186aabda32c81dbef137a4b372241a9116360a2d57c4df7a3f167fa16bf57c5cc77d7939485157

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\gmodule-2.0-0.dll
                            Filesize

                            30KB

                            MD5

                            369061b4b4a64e45e5196bec672817fa

                            SHA1

                            06487078922fcfdf4bbdeb40c7dd74a834fed879

                            SHA256

                            06b29f1606208b50f227e532e432aed1259119229d7c97790a2752cc766638dd

                            SHA512

                            7294df1e73e229437f0c1f72989dc24805329b9969c2af2bcd6509c29ad55627ca2580a24735e03da235e6954cb733e5d79de9dc73348aa21f286b36b9adb383

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\liblzma.dll
                            Filesize

                            192KB

                            MD5

                            6d6c8e7e6d5a045e80cf137813276124

                            SHA1

                            3a30ddf3f81332f6d009f286548200991db460d5

                            SHA256

                            ae93d752c6b47647b6ec8491a04ec33e191bebe22455b5d428212a915fc281dc

                            SHA512

                            2af6cd206c2b03b8d6aa5fa60bfcc94c8b821445c0cc70cd1dbbb67c6257e5932d54497b609b6ede0ec56a5fc36fbd38d29f78b43d7f58a02c04063ef0ae3fad

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\libspeexdsp.dll
                            Filesize

                            110KB

                            MD5

                            c9022885f44d1b14385816679db5d95a

                            SHA1

                            487053ef7652e33f96703f365b94b80d94d4d0c7

                            SHA256

                            e95569b67f35603b05443c9e14571d0d819df3bc6f7b61bfd93dbf0c69c676ca

                            SHA512

                            0f1924efea8ea36fea22959ddbb035d5f48a4aa54d281156d701f8088698e12ce747fb1668fc5b1a06e5141a1a2f482e6dcc54e4498a660d9c908f7272f9983e

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\App\Wireshark\zstd.dll
                            Filesize

                            651KB

                            MD5

                            234d110214e57322d7efcbd278fa79bd

                            SHA1

                            f8b3489fcad60e1bbb729260cc331d1b6e6f99ae

                            SHA256

                            c6e41d5a0c49deaaa93927b9c0c66f5a9ebbdc8352096f036aba6afb8f124d66

                            SHA512

                            82d7f19215e9a58f87ac032877b5f6a5bfb2991438396b0c02d900681d6e3f9b8cf90b21995d54018d9042f2d61c7c1bc37ad8781e724f4da51c06b8b221e4ba

                            Download Submit

                          • C:\Users\Admin\Downloads\WiresharkPortable64\WiresharkPortable64.exe
                            Filesize

                            405KB

                            MD5

                            abc58dd0fcb73f8bea21a8ee2e008b68

                            SHA1

                            3bb122d85a00a2e9b2c3e6d5751a019fff894b98

                            SHA256

                            6518d4406fad6c0c6f0f4260d115a6e2f3edd1c9388e1b8a26c549bfbe78def7

                            SHA512

                            78b9989dbdf8fe2af350c1b81be34dac5b772f9a03c51c492d66ec20b7c335fa010dcda59e1c4dd0b36ece728c943f917f139513311450580d196037c9c44d59

                            Download Submit

                          • C:\Users\Admin\Downloads\c.vbs
                            Filesize

                            201B

                            MD5

                            02b937ceef5da308c5689fcdb3fb12e9

                            SHA1

                            fa5490ea513c1b0ee01038c18cb641a51f459507

                            SHA256

                            5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

                            SHA512

                            843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

                            Download Submit

                          • C:\Users\Admin\Downloads\c.wry
                            Filesize

                            628B

                            MD5

                            7aa98bb1e32a74c07b24f5e9c4a0a453

                            SHA1

                            26fbb00b29822dff9667e215e9229f44e00ef429

                            SHA256

                            29c7ad73871adfb6cc5acd72f9b36403cc189cca95466dcef19505d3578bdce7

                            SHA512

                            3211da6958f0719106ebe51f7f2e83f0c2574782e0c1fda63b70a996405db89531ec390c9bda17f14e7d04d393e381d24ec1e7023e214b3e93836353223b9053

                            Download Submit

                          • C:\Users\Admin\Downloads\m.wry
                            Filesize

                            42KB

                            MD5

                            980b08bac152aff3f9b0136b616affa5

                            SHA1

                            2a9c9601ea038f790cc29379c79407356a3d25a3

                            SHA256

                            402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

                            SHA512

                            100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

                            Download Submit

                          • C:\Windows\SysWOW64\ddraw32.dll
                            Filesize

                            22KB

                            MD5

                            f1ac5c806ed1e188c54e0861cbf1f358

                            SHA1

                            b2a2895a0eae5e2ef8d10ed0f079d0fcfea9585a

                            SHA256

                            87b7d23ab8720f1087d50a902244cbbdc25245b29da9bfa54698a4545b82afc4

                            SHA512

                            ddb61b46a71db7401984e1917f0ef1498883cff76f0a98ff8d65acb08b6d7181511ca57a1e23c7482fc9d26afcf48b662896375b80eff4b2e0d08b7b55d9b98f

                            Download Submit

                          • C:\Windows\System32\drivers\hitmanpro37.sys
                            Filesize

                            41KB

                            MD5

                            55b9678f6281ff7cb41b8994dabf9e67

                            SHA1

                            95a6a9742b4279a5a81bef3f6e994e22493bbf9f

                            SHA256

                            eb5d9df12ae2770d0e5558e8264cbb1867c618217d10b5115690ab4dcfe893c6

                            SHA512

                            d2270c13dc8212b568361f9d7d10210970b313d8cd2b944f63a626f6e7f2feb19671d3fcdbdf35e593652427521c7c18050c1181dc4c114da96db2675814ab40

                            Download Submit

                          • memory/1328-7973-0x0000000000400000-0x0000000000410000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1632-10442-0x0000000000400000-0x0000000000413000-memory.dmp

                            Filesize

                            76KB

                            Download

                          • memory/1632-10347-0x0000000000400000-0x0000000000413000-memory.dmp

                            Filesize

                            76KB

                            Download

                          • memory/2132-6578-0x0000000010000000-0x0000000010012000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/2628-10166-0x000001CDA17A0000-0x000001CDA17A1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/2628-10158-0x000001CDA17A0000-0x000001CDA17A1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/2628-10159-0x000001CDA17A0000-0x000001CDA17A1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/2628-10165-0x000001CDA17A0000-0x000001CDA17A1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/2628-10163-0x000001CDA17A0000-0x000001CDA17A1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/2628-10164-0x000001CDA17A0000-0x000001CDA17A1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/2628-10162-0x000001CDA17A0000-0x000001CDA17A1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/2628-10161-0x000001CDA17A0000-0x000001CDA17A1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/2628-10157-0x000001CDA17A0000-0x000001CDA17A1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/3524-7963-0x0000000000400000-0x0000000000410000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3524-7972-0x0000000000400000-0x0000000000410000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4176-10452-0x0000022ADD540000-0x0000022ADD541000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4176-10451-0x0000022ADD540000-0x0000022ADD541000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4176-10456-0x0000022ADD540000-0x0000022ADD541000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4176-10457-0x0000022ADD540000-0x0000022ADD541000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4176-10458-0x0000022ADD540000-0x0000022ADD541000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4176-10460-0x0000022ADD540000-0x0000022ADD541000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4176-10459-0x0000022ADD540000-0x0000022ADD541000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4176-10455-0x0000022ADD540000-0x0000022ADD541000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4176-10453-0x0000022ADD540000-0x0000022ADD541000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4276-8032-0x000002C10C8E0000-0x000002C10C8E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4276-10175-0x000000001DE30000-0x000000001DE76000-memory.dmp

                            Filesize

                            280KB

                            Download

                          • memory/4276-8034-0x000002C10C8E0000-0x000002C10C8E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4276-8033-0x000002C10C8E0000-0x000002C10C8E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4276-8042-0x000002C10C8E0000-0x000002C10C8E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4276-8041-0x000002C10C8E0000-0x000002C10C8E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4276-8040-0x000002C10C8E0000-0x000002C10C8E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4276-8038-0x000002C10C8E0000-0x000002C10C8E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4276-10176-0x000000001E200000-0x000000001E382000-memory.dmp

                            Filesize

                            1.5MB

                            Download

                          • memory/4276-10173-0x000000001DAD0000-0x000000001DBD4000-memory.dmp

                            Filesize

                            1.0MB

                            Download

                          • memory/4276-10174-0x00000000055A0000-0x00000000055AC000-memory.dmp

                            Filesize

                            48KB

                            Download

                          • memory/4276-10190-0x0000000020CA0000-0x0000000020E2C000-memory.dmp

                            Filesize

                            1.5MB

                            Download

                          • memory/4276-10188-0x0000000021040000-0x0000000021568000-memory.dmp

                            Filesize

                            5.2MB

                            Download

                          • memory/4276-8039-0x000002C10C8E0000-0x000002C10C8E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4276-8043-0x000002C10C8E0000-0x000002C10C8E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4276-8044-0x000002C10C8E0000-0x000002C10C8E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5024-10542-0x0000000000400000-0x0000000000463000-memory.dmp

                            Filesize

                            396KB

                            Download

                          • memory/5024-10547-0x0000000000400000-0x0000000000463000-memory.dmp

                            Filesize

                            396KB

                            Download

                          • memory/5088-10538-0x000001FBEF4E0000-0x000001FBEF4E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5088-10532-0x000001FBEF4E0000-0x000001FBEF4E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5088-10540-0x000001FBEF4E0000-0x000001FBEF4E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5088-10539-0x000001FBEF4E0000-0x000001FBEF4E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5088-10537-0x000001FBEF4E0000-0x000001FBEF4E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5088-10536-0x000001FBEF4E0000-0x000001FBEF4E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5088-10535-0x000001FBEF4E0000-0x000001FBEF4E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5088-10533-0x000001FBEF4E0000-0x000001FBEF4E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5088-10531-0x000001FBEF4E0000-0x000001FBEF4E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5824-9994-0x00007FF6DF5F0000-0x00007FF6DFF94000-memory.dmp

                            Filesize

                            9.6MB

                            Download

                          • memory/5824-9993-0x00007FF8B3210000-0x00007FF8B37D1000-memory.dmp

                            Filesize

                            5.8MB

                            Download

                          • memory/5944-7979-0x0000000000400000-0x0000000000410000-memory.dmp

                            Filesize

                            64KB

                            Download