Overview

overview

7

Static

static

3

FUCK.exe

windows10-2004-x64

7

FUCK.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    98s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 16:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FUCK.exe
  • Size 2.3MB
  • Sample260730-t3mkvscc68
  • SHA256 691b137ae974fdc240a22be26696ffe90468bf13fca23a0924ca71e4c9d03ab5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FUCK.exe
    "C:\Users\Admin\AppData\Local\Temp\FUCK.exe"
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Users\Admin\AppData\Local\Temp\FUCK.exe
      "C:\Users\Admin\AppData\Local\Temp\FUCK.exe"
      2⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:296
      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3856
        • C:\Windows\SysWOW64\unregmp2.exe
          "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2564
          • C:\Windows\system32\unregmp2.exe
            "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
            5⤵
            • Enumerates connected drives
            • Suspicious use of AdjustPrivilegeToken
            PID:3780
      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
        3⤵
          PID:2544
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:1512
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:4556
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3068
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2260
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:2600
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:1420
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3624
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:5292
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:5588
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:1196
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:4180
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:4988
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2516
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • Suspicious use of FindShellTrayWindow
          PID:5484
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1864
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3384
        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
          3⤵
            PID:6072
          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3752
          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5752
          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
            3⤵
              PID:4116
            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5632
            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5844
            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5484
            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1972
            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2196
            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4356
            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4384
            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
              3⤵
                PID:1228
              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                3⤵
                  PID:2900
                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                  3⤵
                    PID:5152
                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                    3⤵
                      PID:6008
                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                      3⤵
                        PID:2856
                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                        3⤵
                          PID:1196
                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                          3⤵
                            PID:708
                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                            3⤵
                              PID:4628
                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                              3⤵
                                PID:4328
                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                3⤵
                                  PID:4752
                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                  3⤵
                                    PID:956
                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                    3⤵
                                      PID:2368
                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                      3⤵
                                        PID:5892
                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                        3⤵
                                          PID:1516
                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                          3⤵
                                            PID:5012
                                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                            3⤵
                                              PID:3948
                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                              3⤵
                                                PID:4540
                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                              2⤵
                                                PID:2180
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:5544
                                                • C:\Windows\SysWOW64\unregmp2.exe
                                                  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4960
                                                  • C:\Windows\system32\unregmp2.exe
                                                    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
                                                    4⤵
                                                    • Enumerates connected drives
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4552
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                PID:716
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                PID:2788
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2072
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2016
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4184
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5240
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5260
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2176
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3124
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4588
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4860
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4340
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5732
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5296
                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                2⤵
                                                  PID:3068
                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5932
                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                  2⤵
                                                    PID:5096
                                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2900
                                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                    2⤵
                                                      PID:5256
                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                      2⤵
                                                        PID:5788
                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1280
                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                        2⤵
                                                          PID:4616
                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4904
                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                          2⤵
                                                            PID:4872
                                                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4380
                                                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5468
                                                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4760
                                                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5404
                                                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                            2⤵
                                                              PID:3632
                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                              2⤵
                                                                PID:3188
                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                2⤵
                                                                  PID:3828
                                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                  2⤵
                                                                    PID:4652
                                                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                    2⤵
                                                                      PID:4980
                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                      2⤵
                                                                        PID:4164
                                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                        2⤵
                                                                          PID:1964
                                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                          2⤵
                                                                            PID:3416
                                                                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                            2⤵
                                                                              PID:2316
                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                              2⤵
                                                                                PID:5360
                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                2⤵
                                                                                  PID:3052
                                                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                  2⤵
                                                                                    PID:2072
                                                                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                    2⤵
                                                                                      PID:5652
                                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                      2⤵
                                                                                        PID:5920
                                                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                        2⤵
                                                                                          PID:5876
                                                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                          2⤵
                                                                                            PID:2480
                                                                                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                            2⤵
                                                                                              PID:2600
                                                                                          • C:\Users\Admin\AppData\Local\Temp\FUCK.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\FUCK.exe
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2156
                                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:3464
                                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:3380
                                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                              2⤵
                                                                                                PID:900
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4724
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2132
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4344
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2452
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4428
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4632
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2464
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2784
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2736
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1920
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2496
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:436
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2176
                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                2⤵
                                                                                                  PID:5588
                                                                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                  2⤵
                                                                                                    PID:1216
                                                                                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5816
                                                                                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2528
                                                                                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3024
                                                                                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                    2⤵
                                                                                                      PID:4652
                                                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                      2⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:476
                                                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                      2⤵
                                                                                                        PID:5928
                                                                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2660
                                                                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3160
                                                                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2160
                                                                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:5004
                                                                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:5112
                                                                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                        2⤵
                                                                                                          PID:5652
                                                                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                          2⤵
                                                                                                            PID:2180
                                                                                                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                            2⤵
                                                                                                              PID:4544
                                                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                              2⤵
                                                                                                                PID:4556
                                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                2⤵
                                                                                                                  PID:3636
                                                                                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                  2⤵
                                                                                                                    PID:4660
                                                                                                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                    2⤵
                                                                                                                      PID:4632
                                                                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                      2⤵
                                                                                                                        PID:2780
                                                                                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                        2⤵
                                                                                                                          PID:1236
                                                                                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                          2⤵
                                                                                                                            PID:3420
                                                                                                                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                            2⤵
                                                                                                                              PID:3900
                                                                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                              2⤵
                                                                                                                                PID:1972
                                                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                                2⤵
                                                                                                                                  PID:4464
                                                                                                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                                  2⤵
                                                                                                                                    PID:6072
                                                                                                                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                                    2⤵
                                                                                                                                      PID:3024
                                                                                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                                      2⤵
                                                                                                                                        PID:5944
                                                                                                                                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
                                                                                                                                        2⤵
                                                                                                                                          PID:4928
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
                                                                                                                                        1⤵
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:3692

                                                                                                                                      Network

                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            CurrentDatabase_400.wmdb
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                                                                            • Size 896KB
                                                                                                                                            • SHA256 95c9fdc66ab7ba35526590219d890f76b07dc68fc8fd9440e086a44a1028cdd5
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            CurrentDatabase_400.wmdb
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                                                                            • Size 1024KB
                                                                                                                                            • SHA256 ed2b72d492ea9106fea36e9ae624279fdf3a0a2293aaa242790d3d9aa1d5b66d
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            LocalMLS_3.wmdb
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
                                                                                                                                            • Size 68KB
                                                                                                                                            • SHA256 2a09d1e0a958ef64c88e6aaaf3100375521d698978831d8982489495605e5c2b
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            WMSDKNS.XML
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
                                                                                                                                            • Size 9KB
                                                                                                                                            • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            farland.mp4
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\farland.mp4
                                                                                                                                            • Size 2.3MB
                                                                                                                                            • SHA256 856ef6d91215ce1ecba31f3995063914eee341428b4ca8ad3350eae6f98027d8
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            wmsetup.log
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 4b795bcb686d66eb4f8313199cc656e6161e4a792063225465deeeaf39abe132
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            wmsetup.log
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 1207eedbee7dc88e82f739c0654d3edaff64a11c2fb7d8f6e127de75b08e22b3
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 c113fd7f59738a6f0e971d6cc85fde16936f7e91e96a79c915339fcfe45b188b
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 d9c5e0daa63a0cdf561f3500edd3e0d12de3a6d7709a9571ebe05a4b972874d3
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 051198417c13a60caa625b52328894d03452d34af1fc2d9a27c4e9b6f274074f
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 63c01c481e750d6b8abe7bad12a796453e564b94a7e4f042a02cae29b664b08d
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 26a6895ecc2d8578670e13830d91e94d52017eb446fcf0df432867616d7ab5ac
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 85efa0fed2e87149118bf70fff8f7528e413e160366d2e620857495a46a9c499
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 1aa44ba92f85f721e71ac6897c446d0ced9b3322c0bfaaebe79ce1a5211e6150
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 b5e73848737e8cce88af87d5ac4caf0086cf78a44aa06d02fe12290200822709
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 6666fb99ab15edc845b909d277501552faa6a52768a017556191e2c78bcc2006
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 76949bf841a0a3e9a70a5194d4e1b452dc37b597b2631831b2ea4cf9328c7689
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 cacf07917cccd63f2c1564e1a97880b2762f09b488e4616591670de041d56b35
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 2e9d1af757c2c81bf24856218dcdb1872b22fab9502ac2d0f4bd67e7d29cb9f7
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 c22c314523795f2bb5f376e1cf2f2437458fdf42ba85f9fdc0333831dcbf1818
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 a978eb421a1dbdcefac9a3a5e9f4beca93b4f641a1b54112007129a4ab042e70
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 fa23c18f5a746a17978363f8753738f5f292ad38b2ff46eda7ff71371046ecf1
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 57a04e1972d124dee5217631414e43f68caee1e782d83d6e7488d003336e3878
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 fafeb5304765384a77dc83bb0f762d15e9c3308f7f8de0bbdaf8b4ff2f9f0a5d
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 87aa27982a6b9f04d575354877de4bdd3fd7114110b55204b3f7e11caa09f5d9
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 fbb7f282b4462103f7140e4a98435705bef6d32f5767746f7677862cfebc9e38
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 db136785b34b86fa28b79e0107fe189c80f5700cbbb56e0c73eb8421e568a6d1
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 ca7d58e29da09606c6ef56ce299503d8e622b7277a1e6c86e734a4db74d27b2f
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 b0293e1e9620e888f2b95d081721427e24eec217738c11a364121f2a3db39969
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 dc8293c7ae514aa88fa970cd480aafdd992e8a9ecaa8b97a9613c359eb6cff68
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 f1ed7b2742ce88296fb4447fd7c098608e92e575681828e77ce7a37ad6fb3ef8
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 f50e4280c448df20575a950bb032d47510b7e5bb8b15161d5f83392ec2a0c8b2
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 10c4fbf4dbc31a7a5152df0ed2c77710806b334601639d64c26295cdd3a1f17b
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 eb6ce01a9aa84bb3319d7d5a55883f90ae306136c32f8c86a0f760ff38263f05
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 35056ca4c4ee1ba8956df8834b047cba269de637e091be5a8782c656de498b98
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 f1626eac5a4a2ea30c35b91429e4cb99472c300f6f0b6a299956c5ed4ba7d2c4
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 8360f8c99991220c324cbdda7a8b04fc59741c4bf06e07df55dc540ee56fb694
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 220c76e2fc6e41d164287414b61de30359a787644d5d29ce49aad9047436c322
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 4c68d01b7e1f31be3955103cdaedbdd28e4346632a7b46291fe71ea98d7cfa7b
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 a1539a2b3889b3954df21dbd482f32006f885bbfd6a008c0b29b8cffd6d27cfe
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 dac21da5380e62d36e0c100a36ef8de90ac7df2e3dadc2ec9be84d9630c9535f
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 7152910d864c150aff9b7c0df793f8266cc8274010e178d404c0ccaa270b863f
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 011234e72ea00ddaf7b4cd78adb99b07b46d5d8f665d43d1ea891e101dd7e201
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 bb754a44bf64ad5a8e4ac5f13e8f04a75b954f942add062b158e670c7f8297e7
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 49076d80d9a8ab18b8e0f32496b6beb986d315274a6ac7e7725328d4a76857e0
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 65832602b6582de1c9919b46d44b8c539cefe03e24d47b5eeed6659db393070d
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 0ff7104d5677ffb12e05750cf7c30a64283b73d191f95aa27c295c7e83ab2550
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 abb5aba10c7133ab9f17bd61711dc0ebe5407ad7bb0025706ebc0daf1fd3f2ac
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 60fb52dfa0318a17ef02a146cc6cb865f5ef9ddb1c4eeb14d96db49c29e74b9e
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 d5326c14472415ca2c3ea4a1a4a9914fc53d71d10671e5e8fd9694f32107572c
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 f98e9577010f92c055a996001086193a6a2374c30d430dc1ded1de76d94bc8e9
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 d92bd07eaeccb20e0705c75d951a1a50def3d30bcf7ad36984332994dd1dbf8c
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 df2ec7a3ce309bc60b2e5ad8f08ca92c0315b8261b3540f35c75575526e5c336
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 3b1e58c3a67ddf5ba72d4c75f8fb2500b74aaf19b4c0da75f4a7191b8512e7fa
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 e4c1cf579c45f4b58b372367d64cf421b830b52ac5314456aa02861b153b7f3d
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 de266312a063fe2561bc9481e8097464cbc8840b49be9e0445f9246d379d6b2c
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 8cc88ddbfa8e5b6133b0d00eeb6c7ee794ea7309da6d3927b01149a922d5518a
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 b83cb7bd6741ba8e0c2e452c8863b983331ea70d45ee5ad0903614cb1d008cfe
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 1983d3a5a393db8e31a441d55e282037f2118ac8df2c53892e78c0d7fd98cc57
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 9161f90636151b1e9005161e34c1f0b47864eb92f72e075d9c7d65a6cf4c89d6
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 354629d1dc053c4678c23b79322b210c988832370f4edf6ce9def45f2a07b057
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 85a40add783b7a39cbfe5150689380c2945db98bdf470be80b30736a01f799c6
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 0752315e85be900971d53cd38ccf51e5d769b9416d1140fa0b65319e4e97deb9
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            U61ID8PPUV2ADXNZG01G.temp
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U61ID8PPUV2ADXNZG01G.temp
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 be1b7f3b6153896197f02cfe94acf0ad923de18a89824b71b365b11ef940414b
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            memory/296-37-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/296-52-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/296-131-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/296-147-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/296-13-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/296-14-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/296-22-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/296-40-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/716-63-0x0000000006E00000-0x0000000006E10000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/716-61-0x0000000006E00000-0x0000000006E10000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/716-62-0x0000000006E00000-0x0000000006E10000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/716-64-0x0000000006E00000-0x0000000006E10000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1420-187-0x00000000071B0000-0x00000000071C0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1420-188-0x00000000071B0000-0x00000000071C0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1420-186-0x00000000071B0000-0x00000000071C0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1420-185-0x00000000071B0000-0x00000000071C0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1512-70-0x0000000007CD0000-0x0000000007CE0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1512-71-0x0000000007CD0000-0x0000000007CE0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1512-69-0x0000000007CD0000-0x0000000007CE0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1512-72-0x0000000007CD0000-0x0000000007CE0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2132-134-0x0000000007C30000-0x0000000007C40000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2132-135-0x0000000007C30000-0x0000000007C40000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2132-132-0x0000000007C30000-0x0000000007C40000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2132-133-0x0000000007C30000-0x0000000007C40000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2156-148-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2156-142-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2156-41-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2452-180-0x0000000007B20000-0x0000000007B30000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2452-179-0x0000000007B20000-0x0000000007B30000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2452-176-0x0000000007B20000-0x0000000007B30000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2452-182-0x0000000007B20000-0x0000000007B30000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2600-161-0x00000000076B0000-0x00000000076C0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2600-164-0x00000000076B0000-0x00000000076C0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2600-162-0x00000000076B0000-0x00000000076C0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2600-163-0x00000000076B0000-0x00000000076C0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2788-83-0x0000000007A80000-0x0000000007A90000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2788-82-0x0000000007A80000-0x0000000007A90000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2788-85-0x0000000007A80000-0x0000000007A90000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2788-84-0x0000000007A80000-0x0000000007A90000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3068-119-0x00000000071A0000-0x00000000071B0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3068-121-0x00000000071A0000-0x00000000071B0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3068-118-0x00000000071A0000-0x00000000071B0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3068-120-0x00000000071A0000-0x00000000071B0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3124-248-0x0000000006DC0000-0x0000000006DD0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3124-245-0x0000000006DC0000-0x0000000006DD0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3124-246-0x0000000006DC0000-0x0000000006DD0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3124-247-0x0000000006DC0000-0x0000000006DD0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3624-217-0x0000000007A60000-0x0000000007A70000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3624-214-0x0000000007A60000-0x0000000007A70000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3624-216-0x0000000007A60000-0x0000000007A70000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3624-212-0x0000000007A60000-0x0000000007A70000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4344-149-0x0000000007090000-0x00000000070A0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4344-150-0x0000000007090000-0x00000000070A0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4344-152-0x0000000007090000-0x00000000070A0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4344-151-0x0000000007090000-0x00000000070A0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4428-199-0x0000000007B20000-0x0000000007B30000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4428-200-0x0000000007B20000-0x0000000007B30000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4428-198-0x0000000007B20000-0x0000000007B30000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4428-197-0x0000000007B20000-0x0000000007B30000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4556-94-0x0000000006FB0000-0x0000000006FC0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4556-93-0x0000000006FB0000-0x0000000006FC0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4556-96-0x0000000006FB0000-0x0000000006FC0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4556-95-0x0000000006FB0000-0x0000000006FC0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4632-222-0x00000000072D0000-0x00000000072E0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4632-224-0x00000000072D0000-0x00000000072E0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4632-223-0x00000000072D0000-0x00000000072E0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4632-221-0x00000000072D0000-0x00000000072E0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4636-128-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4636-5-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4636-1-0x00000237A7540000-0x00000237A779C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4636-2-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4636-4-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4636-117-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4636-10-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4636-12-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4636-0-0x00007FFA47CFF000-0x00007FFA47D00000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4724-108-0x0000000007BE0000-0x0000000007BF0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4724-106-0x0000000007BE0000-0x0000000007BF0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4724-107-0x0000000007BE0000-0x0000000007BF0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4724-105-0x0000000007BE0000-0x0000000007BF0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5292-233-0x0000000007DC0000-0x0000000007DD0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5292-235-0x0000000007DC0000-0x0000000007DD0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5292-234-0x0000000007DC0000-0x0000000007DD0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5292-236-0x0000000007DC0000-0x0000000007DD0000-memory.dmp
                                                                                                                                            Download