Resubmissions
25/09/2026, 16:25
260925-txbleast6p725/09/2026, 15:54
260925-tcl7eafd561025/09/2026, 15:41
260925-s41nfa1y4l8Analysis
- user interaction
yes - max time kernel
1228s - max time network
1762s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
25/09/2026, 15:54
Errors
General
- Target RobloxShadeHost-Setup.exe
- Size 2.7MB
- Sample260925-tcl7eafd56
- SHA256 2fce29f92f34e0c2eda45fb44dc29fda17cf6577d0163b9c8e86bbb1d704bdbc
Malware Config
Extracted
-
C:\Users\Admin\Downloads\!Please Read Me!.txt
-
wannacry
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
-
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Extracted
-
C:\Users\Admin\Downloads\r.wry
-
wannacry
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send %s to this bitcoin address: %s Next, please find the decrypt software on your desktop, an executable file named "%s". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) %s rar password: wcry123 Run and follow the instructions!
Signatures
- Family: Wannacry
WannaCry is a ransomware cryptoworm.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
- Downloads MZ/PE file 5 IoCs
- Drops file in Drivers directory 2 IoCs
- Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 19 IoCs
- Loads dropped DLL 40 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- ConfuserEx .NET packer 3 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 27 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 8 IoCs
- Probable phishing domain 1 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 12 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 7 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 29 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 38 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 10 IoCs
- Kills process with taskkill 8 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 59 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 33 IoCs
- NTFS ADS 6 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 50 IoCs
- Suspicious use of SendNotifyMessage 9 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxShadeHost-Setup.exe"C:\Users\Admin\AppData\Local\Temp\RobloxShadeHost-Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L302ZHYCIN.tmp\RobloxShadeHost-Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-L302ZHYCIN.tmp\RobloxShadeHost-Setup.tmp" /SL5="$40244,1120700,927744,C:\Users\Admin\AppData\Local\Temp\RobloxShadeHost-Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-LTF0FQHXQ2.tmp\ReShade-Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-LTF0FQHXQ2.tmp\ReShade-Setup.exe" --headless --api dxgi "C:\Users\Admin\AppData\Local\Temp\is-LTF0FQHXQ2.tmp\reshade-stage\RobloxShadeHost.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Drops desktop.ini file(s)
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {bf490744-9e71-49f7-b088-643d28428608} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27136 -prefMapHandle 2460 -prefMapSize 270279 -ipcHandle 2468 -initialChannelId {40f79319-4fc6-4ae9-8dd2-a2f25ecb5bd6} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3884 -prefsLen 27277 -prefMapHandle 3888 -prefMapSize 270279 -jsInitHandle 3892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3900 -initialChannelId {e1cdbe73-5d5e-468c-bf90-4392c642867d} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4092 -prefsLen 27277 -prefMapHandle 3892 -prefMapSize 270279 -ipcHandle 4168 -initialChannelId {490cec08-a519-46bc-aab5-7c11334a43f0} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4548 -prefsLen 34776 -prefMapHandle 4552 -prefMapSize 270279 -jsInitHandle 4556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2760 -initialChannelId {1f8071d0-b76a-4fe1-844e-df72421babe9} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 35013 -prefMapHandle 4964 -prefMapSize 270279 -ipcHandle 2852 -initialChannelId {127363e6-7c3a-4abf-9024-73af3ed20ddc} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32952 -prefMapHandle 5192 -prefMapSize 270279 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {cf7501b5-9d2e-40f4-b67f-a01c3b16bb55} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4980 -prefsLen 32952 -prefMapHandle 5396 -prefMapSize 270279 -jsInitHandle 5392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {96454408-c080-4119-b47a-2aa5f45e8fe6} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5584 -prefsLen 32952 -prefMapHandle 5588 -prefMapSize 270279 -jsInitHandle 5592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {a5d7cf6d-6454-4448-9292-274e68900efd} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6292 -prefsLen 33071 -prefMapHandle 6296 -prefMapSize 270279 -jsInitHandle 6300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6272 -initialChannelId {aa0bb168-6f5f-4d47-a6bd-86b502d47ba8} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6576 -prefsLen 35184 -prefMapHandle 6564 -prefMapSize 270279 -ipcHandle 6400 -initialChannelId {171d383a-4f2a-4a97-8015-309c2b22a8e7} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6792 -prefsLen 33071 -prefMapHandle 6816 -prefMapSize 270279 -jsInitHandle 6796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6808 -initialChannelId {6f0a0e70-c234-4c92-b16b-cd0fa788a333} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4920 -prefsLen 36935 -prefMapHandle 7548 -prefMapSize 270279 -jsInitHandle 7560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7436 -initialChannelId {0576636a-99be-4d37-8b72-9fb499a760c0} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7672 -prefsLen 40075 -prefMapHandle 7668 -prefMapSize 270279 -ipcHandle 7660 -initialChannelId {c9d5923d-9807-44d1-9f31-f5ced3f6b235} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-GBF6V3CVK2.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-GBF6V3CVK2.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Roblox\Versions\version-2366ba214ec740ca\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-2366ba214ec740ca\RobloxPlayerBeta.exe" -personalizedToken GBF6V3CVK2 --deeplink https://www.roblox.com/games/6165420832/Ragdoll-Engine --webBtid 1790351755669001 --downloadSource installer --authenticationTicket rIXkhIUHx1mIFyiGwdK8pXCUqI0v8R2RIQ_o_QF48JHxre6MxX6BbrjMjXctFBKN8_wDLedU9U2gS4C5nRpUQ0NID-1B_m0apLUu9SAJkjYEmEtgqWW3Jcq0oV9v2MniCSyoV-yVWQsPiON98nxvRTkzc6-v6XA9l2eZQDOPQYPKtSqp85vH8qyWByZ-_mtR1fPr3rtwpigGji_kUtnFbbEh_lXHuJJFrhCXU0YUuCgC9EiScqvc7AKti05qojHRSmrqNdd2uma93dE8rbHooE4RlJ1ACT2TO9-wHcGXxhaa5X1mYYkZYsc5xpmFbDQJG9QLTiZZV5LuS3HAd0bYx4WIk_sf4WrLDhfgD-B8wVLKvYEyxt_9sZVutbn4nxHq8ZLZ23LZGlF3cPLchAh5IdIeeEZBQ6kD-f6nfpaEbOmgjS20JBQ-D9W-kAzKgC_x0lvtPslJEh-hIidj7jnvgPyjXfTeaDjiJyEtKY70Use_N2LmNYvTqC3xA9Lc3Fih -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 23764⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8984 -prefsLen 36975 -prefMapHandle 9000 -prefMapSize 270279 -jsInitHandle 8836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9112 -initialChannelId {7fe2c679-337c-4722-87dd-6471257d0ecc} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9396 -prefsLen 36975 -prefMapHandle 9400 -prefMapSize 270279 -jsInitHandle 9404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9380 -initialChannelId {f2fda2ac-7222-4ba0-8d51-fb7bca2ae045} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8732 -prefsLen 36975 -prefMapHandle 8736 -prefMapSize 270279 -jsInitHandle 8728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9120 -initialChannelId {e4165ce3-e6a9-4495-aff6-efa13114136f} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9508 -prefsLen 36975 -prefMapHandle 9512 -prefMapSize 270279 -jsInitHandle 9040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9616 -initialChannelId {c5a95ab4-ef64-4843-9c10-07dff30bb966} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9400 -prefsLen 36975 -prefMapHandle 9404 -prefMapSize 270279 -jsInitHandle 9788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9780 -initialChannelId {9e849a5c-c9f6-4797-94ee-e457052a43ed} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\Downloads\Fishstrap.exe"C:\Users\Admin\Downloads\Fishstrap.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-2366ba214ec740ca\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-2366ba214ec740ca\RobloxPlayerBeta.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12896 -prefsLen 37458 -prefMapHandle 8612 -prefMapSize 270279 -jsInitHandle 9152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6160 -initialChannelId {bee8d140-a243-47ea-b6df-0028441576b5} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9968 -prefsLen 37458 -prefMapHandle 9940 -prefMapSize 270279 -jsInitHandle 21184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6156 -initialChannelId {980e6ad0-1d3b-4e61-9170-1473b0878bef} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4936 -prefsLen 37458 -prefMapHandle 21252 -prefMapSize 270279 -jsInitHandle 10132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13960 -initialChannelId {a52e7b55-118f-48e1-9249-f67ced941d8e} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6440 -prefsLen 37458 -prefMapHandle 9236 -prefMapSize 270279 -jsInitHandle 10424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7320 -initialChannelId {e89e34f4-486f-45ea-8b07-221153c9c807} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20700 -prefsLen 37458 -prefMapHandle 20724 -prefMapSize 270279 -jsInitHandle 7320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 21004 -initialChannelId {8977454c-473d-4e96-9704-d11807da38ed} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9288 -prefsLen 37458 -prefMapHandle 10880 -prefMapSize 270279 -jsInitHandle 12856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6348 -initialChannelId {ae6d0669-d902-434b-a512-ba25250a18cb} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12920 -prefsLen 37458 -prefMapHandle 10820 -prefMapSize 270279 -jsInitHandle 21248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8952 -initialChannelId {aaa78091-061d-4566-b242-54db11fc50de} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e64d79b0-697a-4d90-a613-910292cac0c6.dmp"3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 20464 -prefsLen 40696 -prefMapHandle 19772 -prefMapSize 270279 -ipcHandle 2252 -initialChannelId {418fcf38-db43-4f9b-9abc-0fd671f145f3} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4836 -prefsLen 37458 -prefMapHandle 6424 -prefMapSize 270279 -jsInitHandle 6188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2672 -initialChannelId {b12e467d-68f5-4013-bfbc-f3b08fa86b24} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19088 -prefsLen 37458 -prefMapHandle 19000 -prefMapSize 270279 -jsInitHandle 20600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13120 -initialChannelId {e96fa46f-4d3b-43fd-9350-480630e8c91c} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12984 -prefsLen 37458 -prefMapHandle 19000 -prefMapSize 270279 -jsInitHandle 9000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19880 -initialChannelId {cd365e3a-75ed-498f-bcb7-af134b3ce465} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19928 -prefsLen 37458 -prefMapHandle 20616 -prefMapSize 270279 -jsInitHandle 20604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20020 -initialChannelId {14dce065-9ee8-41c8-9dad-d820c2a04014} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\Downloads\AnyDesk.exe"C:\Users\Admin\Downloads\AnyDesk.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\AnyDesk.exe"C:\Users\Admin\Downloads\AnyDesk.exe" --local-service4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Downloads\AnyDesk.exe"C:\Users\Admin\Downloads\AnyDesk.exe" --local-control4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\Downloads\AnyDesk.exe"C:\Users\Admin\Downloads\AnyDesk.exe" --install "C:\Program Files (x86)\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --install-driver:printer --update-main --svc-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf" --sys-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\expand.exeexpand -F:* "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\v4.cab" "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver"5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" printui.dll, PrintUIEntry /if /b "AnyDesk Printer" /f "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\AnyDeskPrintDriver.inf" /r "AD_Port" /m "AnyDesk v4 Printer Driver"5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4936 -prefsLen 37514 -prefMapHandle 6172 -prefMapSize 270279 -jsInitHandle 20680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12800 -initialChannelId {8bc15ff6-2401-4725-916d-a8bbc2788ee6} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10804 -prefsLen 37514 -prefMapHandle 10812 -prefMapSize 270279 -jsInitHandle 12064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10196 -initialChannelId {29c7eccb-e6eb-4852-a633-9a45d1ef0ff1} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6436 -prefsLen 37514 -prefMapHandle 9240 -prefMapSize 270279 -jsInitHandle 5556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20672 -initialChannelId {39d5ce52-7f86-4b5b-abf7-c395ffe304f3} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab3⤵
-
-
C:\Users\Admin\Downloads\MBSetup-1.1.exe"C:\Users\Admin\Downloads\MBSetup-1.1.exe"3⤵
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6440 -prefsLen 37514 -prefMapHandle 9236 -prefMapSize 270279 -jsInitHandle 19876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10752 -initialChannelId {971d4539-8e11-43ee-88d2-671d70102031} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20512 -prefsLen 37514 -prefMapHandle 9092 -prefMapSize 270279 -jsInitHandle 1992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9788 -initialChannelId {5852c99a-fbdd-4740-b14d-1a1faeff5af0} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 18884 -prefsLen 37514 -prefMapHandle 3212 -prefMapSize 270279 -jsInitHandle 20960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19132 -initialChannelId {a8d545be-bca7-422e-a55b-82ced06b750f} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20732 -prefsLen 37514 -prefMapHandle 20736 -prefMapSize 270279 -jsInitHandle 19888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11996 -initialChannelId {57c93847-103b-41c5-98cd-c5e61657798f} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13408 -prefsLen 37514 -prefMapHandle 13412 -prefMapSize 270279 -jsInitHandle 18620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 18636 -initialChannelId {6dbeed2a-6e24-40c8-9da5-9114ea8d9c37} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13148 -prefsLen 37514 -prefMapHandle 20380 -prefMapSize 270279 -jsInitHandle 11212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5972 -initialChannelId {d6d658b3-a0ad-4df9-8367-65745932dcc2} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11092 -prefsLen 37514 -prefMapHandle 11140 -prefMapSize 270279 -jsInitHandle 12432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20412 -initialChannelId {9ff8c594-8ec6-4c18-991b-aa793e8f814c} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8112 -prefsLen 37514 -prefMapHandle 20548 -prefMapSize 270279 -jsInitHandle 20700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12808 -initialChannelId {a7869b96-7808-4f5f-97cf-163b78f5afe4} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19016 -prefsLen 37514 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 13080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4856 -initialChannelId {d659fda4-7f35-44c7-a9e2-e74afa91ea22} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6728 -prefsLen 37514 -prefMapHandle 18236 -prefMapSize 270279 -jsInitHandle 12996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20548 -initialChannelId {3869b031-eb85-48ee-9e89-c2b12f728beb} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5a540935-97e7-48f3-a48f-d8291179ece4.dmp"3⤵
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\abb73482-4cb0-4426-a901-e55d321a5cf2.dmp"3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10756 -prefsLen 37514 -prefMapHandle 10820 -prefMapSize 270279 -jsInitHandle 18292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 18352 -initialChannelId {69e1a596-ebbe-4a56-a9d9-1b0aa41a7528} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19112 -prefsLen 37514 -prefMapHandle 10724 -prefMapSize 270279 -jsInitHandle 18924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11344 -initialChannelId {47fa4783-e54d-4d10-988f-8866588abca9} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19148 -prefsLen 37514 -prefMapHandle 20852 -prefMapSize 270279 -jsInitHandle 9376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 21264 -initialChannelId {50635665-5b96-4297-b5c6-8d2a6c89861d} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\minidumps\ed075bef-3bfd-43fa-9eb7-ff095bf7a832.dmp"3⤵
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows-delete-winpe.bat" "1⤵
- Enumerates connected drives
- Executes a command shell one-liner
-
C:\Windows\system32\diskpart.exediskpart /s C:\diskpart.txt2⤵
-
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\AnyDesk\AnyDesk.exe"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\AnyDesk\AnyDesk.exe"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\AnyDesk\AnyDesk.exe"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --control1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\AnyDesk\AnyDesk.exe"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --new-install1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f4dc4fc2-ec3e-4640-8971-ec1966a9072a}\anydeskprintdriver.inf" "9" "49a18f3d7" "00000000000001C8" "WinSta0\Default" "00000000000001D8" "208" "c:\users\admin\appdata\roaming\anydesk\printer_driver"2⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{b57120aa-ebb6-a04e-ac3f-09fbf79a0cd2} Global\{8ac509a2-d043-2040-b0f4-61b42513e4c7} C:\Windows\System32\DriverStore\Temp\{dd8561b2-29a9-4741-ad34-79ea835fba52}\anydeskprintdriver.inf C:\Windows\System32\DriverStore\Temp\{dd8561b2-29a9-4741-ad34-79ea835fba52}\AnyDeskPrintDriver.cat3⤵
-
-
-
C:\Program Files\Roblox\Versions\version-2366ba214ec740ca\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-2366ba214ec740ca\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "C:\Users\Admin\Desktop\sfdasdskskfms.docx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\xd.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\xd.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\xd.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set testsigning off2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\xd.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set testsigning off2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\xd.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set testsigning off2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\xd.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set testsigning off2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\xd.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set testsigning off2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe"C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-2366ba214ec740ca\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-2366ba214ec740ca\RobloxPlayerBeta.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2036 -prefsLen 31803 -prefMapHandle 2040 -prefMapSize 271030 -ipcHandle 2128 -initialChannelId {f4da86c1-a0cc-433d-9d0c-9af5f3401904} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2392 -prefsLen 31803 -prefMapHandle 2396 -prefMapSize 271030 -ipcHandle 2164 -initialChannelId {37d9b26e-01b9-44f6-9685-b15f6e326501} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3548 -prefsLen 32362 -prefMapHandle 3552 -prefMapSize 271030 -jsInitHandle 3556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3564 -initialChannelId {ccca972f-1094-47f3-9999-7227b4094ebf} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3588 -prefsLen 32362 -prefMapHandle 3688 -prefMapSize 271030 -ipcHandle 3748 -initialChannelId {52a3e807-c0e7-4cdb-9135-75c2bc0ccdec} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4560 -prefsLen 39861 -prefMapHandle 4564 -prefMapSize 271030 -jsInitHandle 4568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4572 -initialChannelId {f2d24122-212b-4fda-95cc-1e0ee11ee8b0} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4772 -prefsLen 36623 -prefMapHandle 4776 -prefMapSize 271030 -jsInitHandle 4780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4784 -initialChannelId {e7a73f5c-54db-4311-b80c-cbe27dd05d48} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5404 -prefsLen 40017 -prefMapHandle 5400 -prefMapSize 271030 -ipcHandle 5328 -initialChannelId {dc7045cb-a46a-4c52-967d-451677256830} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 36831 -prefMapHandle 5816 -prefMapSize 271030 -jsInitHandle 5820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5828 -initialChannelId {41f73ebf-7e35-49d2-9810-fc1d39b68aaa} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6072 -prefsLen 36831 -prefMapHandle 6076 -prefMapSize 271030 -jsInitHandle 6080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6092 -initialChannelId {8b2a172c-dcac-46ce-9ca2-80bf7e84081a} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5964 -prefsLen 36831 -prefMapHandle 5960 -prefMapSize 271030 -jsInitHandle 5956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6352 -initialChannelId {35589b39-8781-4349-8b9d-9810c571b884} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6700 -prefsLen 36831 -prefMapHandle 6704 -prefMapSize 271030 -jsInitHandle 6708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6716 -initialChannelId {e56ae7f7-eecf-4233-bd94-4eb219ffca82} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4884 -prefsLen 36831 -prefMapHandle 4896 -prefMapSize 271030 -jsInitHandle 4820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6740 -initialChannelId {36c9e0eb-7430-49aa-9aa2-e01238f0276e} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424 -prefsLen 36871 -prefMapHandle 6744 -prefMapSize 271030 -jsInitHandle 6772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4896 -initialChannelId {e4663267-f377-4a3f-8333-32eb12013340} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5804 -prefsLen 36871 -prefMapHandle 6064 -prefMapSize 271030 -jsInitHandle 6772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7040 -initialChannelId {4907bbc0-d32f-4fbf-9709-02535ea08de5} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5972 -prefsLen 36871 -prefMapHandle 5968 -prefMapSize 271030 -jsInitHandle 6336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6332 -initialChannelId {41e1dfe9-6ff5-4a8d-ac5e-61db02d25cf4} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7304 -prefsLen 36871 -prefMapHandle 7300 -prefMapSize 271030 -jsInitHandle 7296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7284 -initialChannelId {d3c7a4f2-a29b-4273-bb53-4acfbb560920} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6352 -prefsLen 40109 -prefMapHandle 7512 -prefMapSize 271030 -ipcHandle 7620 -initialChannelId {307b4bde-43e1-4b1b-a59d-a82660a8c0f1} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7252 -prefsLen 40109 -prefMapHandle 7256 -prefMapSize 271030 -ipcHandle 7376 -initialChannelId {a3a6dd4f-690b-41bb-8216-57451cb2b1f9} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6892 -prefsLen 36871 -prefMapHandle 6896 -prefMapSize 271030 -jsInitHandle 6040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6836 -initialChannelId {7307808e-0639-4cf6-9b16-92644bc3fac0} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6764 -prefsLen 36871 -prefMapHandle 6696 -prefMapSize 271030 -jsInitHandle 4544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6820 -initialChannelId {6010f2b1-4c2b-45f4-9779-0570f032d140} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7192 -prefsLen 36871 -prefMapHandle 7176 -prefMapSize 271030 -jsInitHandle 7180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6828 -initialChannelId {66be802c-cbcd-4ed3-b415-070f64d0fec3} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3008 -prefsLen 36871 -prefMapHandle 8204 -prefMapSize 271030 -jsInitHandle 8000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6980 -initialChannelId {cb2e5b71-02ff-4eb1-a8a5-ad9e84cc6847} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8500 -prefsLen 36871 -prefMapHandle 8504 -prefMapSize 271030 -jsInitHandle 8404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8528 -initialChannelId {c33a24e8-60d7-445a-89fd-ebbb0b44064b} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8564 -prefsLen 36871 -prefMapHandle 8536 -prefMapSize 271030 -jsInitHandle 6980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8576 -initialChannelId {0de0d52b-72b3-4dc4-a5e4-12f838c6a337} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8736 -prefsLen 36871 -prefMapHandle 8732 -prefMapSize 271030 -jsInitHandle 8728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8780 -initialChannelId {a274eb2b-40cf-463c-af90-56f6a692662a} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9184 -prefsLen 36871 -prefMapHandle 9176 -prefMapSize 271030 -jsInitHandle 9172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6380 -initialChannelId {a98d1df7-d87a-4c05-9361-eee84f254214} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3068 -prefsLen 36871 -prefMapHandle 4528 -prefMapSize 271030 -jsInitHandle 6500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3092 -initialChannelId {8d98869a-4220-48ad-8fc3-ffc8bcac7649} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6252 -prefsLen 36871 -prefMapHandle 6236 -prefMapSize 271030 -jsInitHandle 6240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9292 -initialChannelId {8cdea6b1-eee8-412c-9e59-fa881de51116} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9488 -prefsLen 36871 -prefMapHandle 9508 -prefMapSize 271030 -jsInitHandle 9504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9480 -initialChannelId {04ddac7c-e64b-4fa2-af49-82afd0decdf3} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4836 -prefsLen 36871 -prefMapHandle 5976 -prefMapSize 271030 -jsInitHandle 1100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4760 -initialChannelId {c20a4c06-9511-4ba8-81ed-b1f689db142d} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9400 -prefsLen 36871 -prefMapHandle 6060 -prefMapSize 271030 -jsInitHandle 9260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9452 -initialChannelId {2a144609-49eb-445b-812f-720453bf7655} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5092 -prefsLen 36871 -prefMapHandle 5312 -prefMapSize 271030 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7300 -initialChannelId {3e9a9c6c-a2d3-4855-8af4-7f714fb9134f} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5092 -prefsLen 36871 -prefMapHandle 5312 -prefMapSize 271030 -jsInitHandle 6332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6792 -initialChannelId {920913d9-6a30-4f8e-8340-638a7e795247} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8532 -prefsLen 36871 -prefMapHandle 8264 -prefMapSize 271030 -jsInitHandle 6920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8592 -initialChannelId {2253dc45-07c2-4da9-bdfe-1cc5b07718d6} -parentPid 13136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.13136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab3⤵
-
-
C:\Users\Admin\Downloads\WannaCry.exe"C:\Users\Admin\Downloads\WannaCry.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 320081790353083.bat4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe f4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe4⤵
- Kills process with taskkill
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe c4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v4⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe v5⤵
-
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
-
C:\Users\Admin\Downloads\ViraLock.exe"C:\Users\Admin\Downloads\ViraLock.exe"3⤵
-
C:\Users\Admin\UyIwsMwE\kYEYwQsE.exe"C:\Users\Admin\UyIwsMwE\kYEYwQsE.exe"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /FI "USERNAME eq Admin" /F /IM NOkkgwMc.exe5⤵
- Kills process with taskkill
-
-
-
C:\ProgramData\acUccYwA\NOkkgwMc.exe"C:\ProgramData\acUccYwA\NOkkgwMc.exe"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /FI "USERNAME eq Admin" /F /IM kYEYwQsE.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\ViraLock"4⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Downloads\ViraLock.exeC:\Users\Admin\Downloads\ViraLock5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\ViraLock"6⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Downloads\ViraLock.exeC:\Users\Admin\Downloads\ViraLock7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\ViraLock"8⤵
- Executes a command shell one-liner
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\buowcQQw.bat" "C:\Users\Admin\Downloads\ViraLock.exe""8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yiogMoUU.bat" "C:\Users\Admin\Downloads\ViraLock.exe""6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HUwAIsIQ.bat" "C:\Users\Admin\Downloads\ViraLock.exe""4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
C:\Users\Admin\Downloads\RedEye(1).exe"C:\Users\Admin\Downloads\RedEye(1).exe"3⤵
-
-
C:\Users\Admin\Downloads\NoMoreRansom.exe"C:\Users\Admin\Downloads\NoMoreRansom.exe"3⤵
-
-
C:\Users\Admin\Downloads\PolyRansom.exe"C:\Users\Admin\Downloads\PolyRansom.exe"3⤵
-
C:\Users\Admin\UyIwsMwE\kYEYwQsE.exe"C:\Users\Admin\UyIwsMwE\kYEYwQsE.exe"4⤵
-
-
C:\ProgramData\acUccYwA\NOkkgwMc.exe"C:\ProgramData\acUccYwA\NOkkgwMc.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"4⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Downloads\PolyRansom.exeC:\Users\Admin\Downloads\PolyRansom5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"6⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Downloads\PolyRansom.exeC:\Users\Admin\Downloads\PolyRansom7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"8⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Downloads\PolyRansom.exeC:\Users\Admin\Downloads\PolyRansom9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"10⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Downloads\PolyRansom.exeC:\Users\Admin\Downloads\PolyRansom11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"12⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Downloads\PolyRansom.exeC:\Users\Admin\Downloads\PolyRansom13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"14⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Downloads\PolyRansom.exeC:\Users\Admin\Downloads\PolyRansom15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"16⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Downloads\PolyRansom.exeC:\Users\Admin\Downloads\PolyRansom17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"18⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Downloads\PolyRansom.exeC:\Users\Admin\Downloads\PolyRansom19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"20⤵
- Executes a command shell one-liner
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BKosQckI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""18⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WWYMcAok.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""12⤵
- Executes a command shell one-liner
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BiYEkIsA.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""10⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vCokwYEA.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZAkwccEw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yWcAEQQg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\Downloads\PowerPoint.exe"C:\Users\Admin\Downloads\PowerPoint.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\sys3.exeC:\Users\Admin\AppData\Local\Temp\\sys3.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\13237f8a-0306-47db-8714-e38283be714e_winlocker_builder_0.6.zip.14e\winlocker_builder_0.6.exe"C:\Users\Admin\AppData\Local\Temp\13237f8a-0306-47db-8714-e38283be714e_winlocker_builder_0.6.zip.14e\winlocker_builder_0.6.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\13237f8a-0306-47db-8714-e38283be714e_winlocker_builder_0.6.zip.14e\winlocker_builder_0.6.exe"C:\Users\Admin\AppData\Local\Temp\13237f8a-0306-47db-8714-e38283be714e_winlocker_builder_0.6.zip.14e\winlocker_builder_0.6.exe"2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\ccd79906-a1a1-4dc8-9ad1-3833c9333fd4_winlocker_builder_0.6.zip.fd4\winlocker_builder_0.6.exe"C:\Users\Admin\AppData\Local\Temp\ccd79906-a1a1-4dc8-9ad1-3833c9333fd4_winlocker_builder_0.6.zip.fd4\winlocker_builder_0.6.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\ccd79906-a1a1-4dc8-9ad1-3833c9333fd4_winlocker_builder_0.6.zip.fd4\winlocker_builder_0.6.exe"C:\Users\Admin\AppData\Local\Temp\ccd79906-a1a1-4dc8-9ad1-3833c9333fd4_winlocker_builder_0.6.zip.fd4\winlocker_builder_0.6.exe"2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"1⤵
-
C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"2⤵
-
-
C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"1⤵
-
C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"2⤵
-
-
C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"1⤵
-
C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"C:\Users\Admin\Downloads\winlocker_builder_0.6\winlocker_builder_0.6.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\84a9be40-3c16-4906-b757-4cafb2d6d7e6_winlocker3.zip.7e6\Winlocker3.exe"C:\Users\Admin\AppData\Local\Temp\84a9be40-3c16-4906-b757-4cafb2d6d7e6_winlocker3.zip.7e6\Winlocker3.exe"1⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "18600" "2324" "2216" "2328" "0" "0" "0" "0" "0" "0" "0" "0"1⤵
-
C:\Users\Admin\Downloads\WannaCry.exe"C:\Users\Admin\Downloads\WannaCry.exe" /r1⤵
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe"C:\Users\Admin\Downloads\!WannaDecryptor!.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-2366ba214ec740ca\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-2366ba214ec740ca\RobloxPlayerBeta.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\WaitClose.gif.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\Downloads\WannaCry.exe"C:\Users\Admin\Downloads\WannaCry.exe"1⤵
-
C:\Users\Admin\Downloads\WannaCry.exe"C:\Users\Admin\Downloads\WannaCry.exe"1⤵
-
C:\Users\Admin\Downloads\WannaCry.exe"C:\Users\Admin\Downloads\WannaCry.exe"1⤵
-
C:\Users\Admin\Downloads\WannaCry.exe"C:\Users\Admin\Downloads\WannaCry.exe"1⤵
-
C:\Users\Admin\UyIwsMwE\kYEYwQsE.exeC:\Users\Admin\UyIwsMwE\kYEYwQsE.exe1⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /FI "USERNAME eq Admin" /F /IM NOkkgwMc.exe2⤵
- Kills process with taskkill
-
-
C:\ProgramData\acUccYwA\NOkkgwMc.exeC:\ProgramData\acUccYwA\NOkkgwMc.exe1⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /FI "USERNAME eq Admin" /F /IM kYEYwQsE.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\!Please Read Me!.txt1⤵
-
C:\ProgramData\Windows\csrss.exe"C:\ProgramData\Windows\csrss.exe"1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38f5855 /state1:0x41c64e6d1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
Debugger Evasion
1Modify Registry
2Subvert Trust Controls
2SIP and Trust Provider Hijacking
2Discovery
Browser Information Discovery
1Debugger Evasion
1Network Service Discovery
1Peripheral Device Discovery
2Query Registry
8System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
MBAMInstallerService.exe
RobloxStudioInstaller.exe
RobloxPlayerBeta.dll
ad_svc.trace
service.conf
service.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
7z.dll
mbuns.exe
activity-stream.contile.json
activity-stream.contile.json
activity-stream.discovery_stream.json
3874
5661
03D74D5ED346B6A425AA45C38A54C3F6BCFF5085
044DAE598987FA8817E2D7C106C559E543CC157C
0F86D37021DDF502A75675BB9FCE7F4EFA20403A
16213B0C2A63C7CAD76721E48E44F60E6010D49D
17436953809B146EA7F4418BEB87D224816AD16E
1A6B6544335BC1F0BFA9400C702515B6BB48D276
1B1F622EE11EEDAB57B09CED0CB51E85C39CB1AD
1BDA35C72CC6D62A42D293B09B79E41CE7829704
1F4C3E20ED8549DAC4757AB3B14CCFDAA7B366E1
22997A8FC3D26F5E0546F8FFA820D706B622B9B1
2B88FEF8C260D96088CB454C66AD5EB87E07B1EC
39A05F32366BCE9BE2A878EFBEB0F8F53EF95E0C
3B7B4A81461091950A519B6E786BC8844D692141
3EDDA4487B7BB0FA688CCAD556998906EC4B89A1
40F5840451291DE16C8E7DB7784DBB592DB73BE0
41C0EFF33DE0F63759EEF070C774F9B10DC4C4C6
4A4A1D555DF73A6D0297A0CBB703516236580631
4B8F3B0F0B5AA5EEECE659347B489F0DD7540B55
4C11E373FD9A73A5E61FCB5291518B290C3C15DF
4C2F49D2D30734C943233EA57331DF6B7B760F8E
4D0BF26560573B92D154A61E4171AB970C41F0A0
5101F86D93FD07368C41627F0E0932ACA50E6632
5539A8923B6F70EE9607C817D9311962D6B8FE6B
55A5B5FA3FD356633AE9F99DB5C67976E2BCBAD9
563AB2D3D84132B08A1E84DA356B1E61BF559389
5811E00C1A6E7B83BE6DD256998C5C87FD613A64
5B5E1D9F8C66F63DE630C6044033277F08AA5965
5F0807CEE3A32B95F10EBF8790954E56E888A29C
63BB5DFDF1F2EDEA5783E8DF9B79E0F14F1FDD88
67CAC103F0904A7BF757C9630371262EC45948F8
6A71F43DCE59F661886456A0AF21433FE908ED46
6D2EE3946C922292899C051AC7EEDFF1E5A0CC0D
6D95340FE3F88B08A4C14A89003B3E0814FB17C6
6FD9D69B19345573B63EE019D8C024CD1BEF7493
71D465A57D0D68E0FFE2326839D79CCBBAAFE43F
7219EA7D154445AD764DED8ECD429439AD5237A0
7EC11FBE5DB32ED757C452EBAAAD933AC3CB5626
800CBA5955D7784C2703CABE40D564E0CC8CCBA5
83E89DE58EE9CC4AD9CB9E7941472A330BEFD5FC
93FF6F8358B90C69FC1FBD1064F65B979DBABC4F
96640DA32BB2D3EAC35FDCAA3FB7D9546C702D5C
975ADDCFB72B35D527464F836D28E31A76D7B6F5
98E7CB868A0E2CCBB49693CA594496B2A4BD01CC
9B7343B9C6005EC0E30B0AEFD3A78FB17342ECD9
A8E4E09561B11D1978EF7D20718889BCB2834E2A
AAA8679E72BDC57D5AB23AE04620A2F69F3AC00C
AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
ABF8A18AC6094E0B3AB643A9375125F1422765F0
ACADE8D9E13B2152FD03B4F9DEFB82777B069AE7
ADD55FE5995578FA602D65DBBE6B2DA650012AEE
AEDB8FE25FDF39105B0F807400B527CE05ECA0BC
B40960C6C4BC1751039BCB4769BF0D45FA34B64A
B43FD2D68B2B6C52AC26DC5CEBBD11D1CA995477
B683FBDAD0FF7912FBD434EA6CF19EEE0FC26E5D
B6CC53B0972D295D54F95FA82A5838EC5616B026
B81F84622A8CFC45DB47E23F987D96120CD34A4A
BAF2D30A99FA0711A1DBA9EABB4D23EF2E6CB199
BB23E73EA0DCCC59097C1E8EEFC946FD99DE9B28
BE2D1663446456D8DD2458F0EECC37B996D97297
C57D0FD5A41CE53EAB45D7225E61CEAE2B97DA0A
C72D2B181AAC5D23DB84DC5C38CA5A02B23B9397
D24F2BF799A0B62FF4F3D49DBFB28241FDCD38CC
D6F0689BC90011C26A86B6A2F1E5268D7827C217
E2E41CA3E48D2627D2A1C76828444D9215432E1A
E6545DF381D08A3F2B1030BA86919C6A245C1C45
EA87465A6B977981215042B94E7AB9FECDDEE708
EAAABC215A6A66CD493BC803BE38228E68EEB452
EB73E7FF0DA31744A2FBB64A65A5138D85179E37
EBFB3B33C2098C1EC65124A42520D931740B7593
ED12D7B4C36F34C6081B3048A5F57601F018A306
EF60C6275D39F2B383EDA25F41112F4DF163B1DE
F08422BF873A1F81D2E23C07D60907B29E571C39
F12438933DCAA5300F771BB2C408A2B6AB6F22AA
F15C51CDDC6930849331656B80C8ECB16CEFD740
F5EC24E809C5A5412C5973B016F77325FDD561CC
F6652CB7BEAE71881987DA0929F77F9246F92A2C
FA04745B75AD3E9334CC80CC35451B83D3C4291B
FA4925FE7D507172E72DFB165181AEF34A6EE0E9
H8TYHQ1O3xwxUrYrZCwhoS+zViXiIDWmDDVhupqFrmU=.ico
webext.sc.lz4
Microsoft_Windows_Explorer
https___java_com_help
0.1.filtertrie.intermediate.txt
0.2.filtertrie.intermediate.txt
Apps.index
AppCache134348261870714647.txt
AppCache134348262102218066.txt
AppCache134348270286049544.txt
RobloxShadeHost.exe
is-F6X6KBBMHO.tmp
is-2R2QFBKBLB.tmp
is-9LX8NJ4RB7.tmp
is-AFNI727607.tmp
is-XTVZ4BF9CB.tmp
is-2UW247HG80.tmp
is-GCHUBMDAWH.tmp
is-GVG7T9RZO9.tmp
is-JT4AIA2LVP.tmp
is-N1IF1XVKMU.tmp
is-QTF8VZG5J9.tmp
is-5MNLUZQMME.tmp
is-JHR8567G3A.tmp
is-JNSZ782CIY.tmp
is-LHIA4L87Q3.tmp
is-ORBS5QIAXH.tmp
is-OSUGMCRIM8.tmp
is-PNAASPMDA1.tmp
is-Q2N0YK8ODK.tmp
is-QVJAHPYVBX.tmp
is-U38OJ7A2IW.tmp
is-YPFI4PY521.tmp
is-AJYL4N7EMU.tmp
is-C597H6GCWZ.tmp
is-FPTPWWLAC1.tmp
is-LNLU8XYJH0.tmp
is-LR16XG6FDF.tmp
is-H0AEPWT545.tmp
is-IEMP1ZO5KJ.tmp
is-J6GTYN2U1F.tmp
is-N604UK422K.tmp
is-NBBF92I0XD.tmp
is-TX9O2OJ7QC.tmp
is-V444WEA06X.tmp
is-EXIIA9P6K5.tmp
is-FG988GVGMO.tmp
is-JX2YUZV9ZC.tmp
is-LL6H3YRJ9H.tmp
is-N37VK1KX3T.tmp
is-OWVZXC57YS.tmp
is-Q372PVUKW5.tmp
is-XU6PO79SQ8.tmp
is-LX0Y963AJ8.tmp
is-2ONXKL7URW.tmp
is-92YYC4RZ1E.tmp
is-DI1JQ76D2K.tmp
is-EG1JDIWNNF.tmp
is-GAGNCD7H8C.tmp
is-HDTFVU2S7W.tmp
is-JUEYPGXLH5.tmp
is-LGSCYVFNTO.tmp
is-MDGR169OSJ.tmp
is-O0KMZ45Y7K.tmp
is-OOAPG3ZL0U.tmp
is-OQ7VCPRWCH.tmp
is-P2PWNWDODF.tmp
is-SJIUP4KUWZ.tmp
is-T02Z5BVJY7.tmp
is-ZWY2JR4377.tmp
is-2JLYMBLEBN.tmp
is-2KEBFORFVA.tmp
is-3J66YFGA9P.tmp
is-4TYM43L10B.tmp
is-691N0KTZN0.tmp
is-8H8Y0O3HTH.tmp
is-966V3U7TPS.tmp
is-BLGKEE4R5M.tmp
is-FHG3JZ4LT9.tmp
is-FTPJ1GN5LS.tmp
is-H1X36P30KG.tmp
is-HM9F9Q0B7Q.tmp
is-QQPUVEMXUF.tmp
is-SGL38FUIWH.tmp
is-SQVWW8JBSO.tmp
is-TBZZ9QBEZQ.tmp
is-X57L4OTX9W.tmp
is-ZL1G20SVKV.tmp
is-EFV6UO77Q6.tmp
is-0IRMU1KHZ9.tmp
is-0P6E2YF1LP.tmp
is-39RT9MR6RP.tmp
is-6P13D5UPIC.tmp
is-BJO88YF6WI.tmp
is-C2X64CVW3Q.tmp
is-IOKRLPQSPX.tmp
is-J59G4BQSWY.tmp
is-JQP7SRIW5Y.tmp
is-K9W7BS2MM3.tmp
is-LCL6P5QZZT.tmp
is-PKO5NXLEC3.tmp
is-RKZR6GMAAD.tmp
is-W44WDCXH1Y.tmp
is-BAMI9T6SNG.tmp
is-DE6IFUK03I.tmp
is-EYLPKLO9H1.tmp
is-FTS5744STJ.tmp
is-HASKENG2RO.tmp
is-LKB27UZI4B.tmp
is-NE5DYAAN6X.tmp
is-RE688QWHMB.tmp
is-ZONOV7P14S.tmp
is-ZPEN2SLSV2.tmp
is-USEUGBXNM9.tmp
cAutoExposure.fx
cLetterBox.fx
cMotionBlur.fx
is-0OSE5A2IW8.tmp
is-4TIAH9L96L.tmp
is-7HACLBB1M0.tmp
is-8UQPBHLW28.tmp
is-D8B5XDNEAG.tmp
is-DAFUFMYD0M.tmp
is-DEE9TZPU1K.tmp
is-DOTOSY4XMM.tmp
is-EBVDFQDGGJ.tmp
is-FMKLUFFKLD.tmp
is-H2BJ57S82K.tmp
is-HDU1HYCE4N.tmp
is-IUT12E06UK.tmp
is-L050F4V8AH.tmp
is-LMJV18OKR0.tmp
is-LQAZ7U5EUW.tmp
is-MZSP95GYIO.tmp
is-NQPCVHSJF6.tmp
is-OO6T5WNJ4N.tmp
is-PFQUGOONQ0.tmp
is-PKC2LHB2S8.tmp
is-Q0YBOTQJRE.tmp
is-S37EO951LZ.tmp
is-SX8I5V6YYI.tmp
is-UYYXSHM29A.tmp
is-WFIDQJ9G50.tmp
is-XGG65577R0.tmp
is-YDNI8TY203.tmp
is-YEQABRS1WL.tmp
is-2D1BNZM82H.tmp
is-BMSPVLJAQP.tmp
is-BNIEIK5BIY.tmp
is-CEPCCBE63A.tmp
is-FX3YKTLC41.tmp
is-GXZ4GE2VRF.tmp
is-HCOU9V8YQM.tmp
is-HFJ6NS9QJ6.tmp
is-ODG3ELLQCU.tmp
is-P5UZBVS9JR.tmp
is-PUEKI2BDI1.tmp
is-7D8VPD05S5.tmp
is-FGRUDQ9VIP.tmp
is-G6CQNMGL57.tmp
is-I3J3J2X5TE.tmp
is-LX1KY9Q888.tmp
is-OUAFS7OWPE.tmp
is-TB57VIR9VB.tmp
is-V56DQT9DOG.tmp
is-YZ5V9ZYIMA.tmp
is-3AWBJ2XJVY.tmp
is-EOHJRR7OHK.tmp
is-7HPKVJ4ANJ.tmp
is-9F1J2FQ1PU.tmp
is-FZ6OFZGRGV.tmp
is-OWP9W3MK4Z.tmp
is-SDOGEDSKMG.tmp
is-SV1AOEUCVM.tmp
is-XMEE9C28A6.tmp
is-YK43VEHLV7.tmp
is-0CNVM8RCYL.tmp
is-0R78CZ6GFQ.tmp
is-2HRFOJ8CZR.tmp
is-2ZVGGAR6XP.tmp
is-4DNDXZW47E.tmp
is-4LODPWU7DU.tmp
is-DXGV87OSHI.tmp
is-EGN5M56A8R.tmp
is-GDE6CCBDGK.tmp
is-GXI5U6OJFU.tmp
is-H8V0Q291PA.tmp
is-IZOULCRMZD.tmp
is-MCG56H43M1.tmp
is-8AMB3JIHE6.tmp
is-LY3LU3H2D9.tmp
is-V7OW1XSLTW.tmp
is-VDR05FQ1W0.tmp
is-3UV46E4K2M.tmp
is-5C8EDZEIQB.tmp
is-AIBRFZ96XI.tmp
is-IEV1749COK.tmp
is-MF7FCF4AAP.tmp
is-N8Y4RW9ZF4.tmp
is-O8RAL329ES.tmp
is-RPYS9RUCIB.tmp
is-3T0YNIDQEB.tmp
is-CMYOP2F0FL.tmp
is-IXRP3UVTDD.tmp
is-URH92D49M6.tmp
is-9RSTJQH956.tmp
is-MSB11P0A5W.tmp
is-ZNEHEEB8C9.tmp
is-1K7L3IRM1A.tmp
is-1VF0KF8ZKR.tmp
is-5ZKD78UVNA.tmp
is-6TAK8N8GCR.tmp
is-B4S51KH07F.tmp
is-B56OTIAJT8.tmp
is-EG9XXRRZXK.tmp
is-FCJX6SOLYR.tmp
is-RDLZ06SD9L.tmp
is-TZ1O5HFR84.tmp
is-U3EU0NLF2L.tmp
is-YY56Z0RMQS.tmp
is-1MQPINVA9Q.tmp
is-36N9B9XWUV.tmp
is-4SIQQZ4A1I.tmp
is-6YJLIS77Y8.tmp
is-7YYWVFTBPM.tmp
is-9QQLZEFFSM.tmp
is-BYWVJ2Y6DX.tmp
is-D50HZLREFV.tmp
is-F8CVE8IOFE.tmp
is-G1EW5RUK3C.tmp
is-HA3ZMREY3D.tmp
is-IKFNZZNR64.tmp
is-JQIC5897AK.tmp
is-JZ6A4MS0TV.tmp
is-KLDD6AEY3N.tmp
is-KR72KR19SE.tmp
is-KSQH8ABGCI.tmp
is-KZFAHT8SKB.tmp
is-NYA6FYDK9F.tmp
is-OJIRLBYRNZ.tmp
is-OTII56FV63.tmp
is-OWADBTZ5WK.tmp
is-PHSOEFXLV7.tmp
is-PRZFX2V3IF.tmp
is-QLIOGBEEWG.tmp
is-RI0DLW5NT7.tmp
is-TLMX3134HL.tmp
is-UPE3KXIL6I.tmp
is-USVEF2NM3D.tmp
is-VGYEY68E5U.tmp
is-VQNCBBSXPG.tmp
is-VYEVV6M7SF.tmp
is-WCXG2A8KPE.tmp
is-WIG6G9QX1Q.tmp
is-WKZB2THY0K.tmp
is-X4U8LHCY5J.tmp
is-XN9KM72MI2.tmp
is-Y34A940WSX.tmp
is-YKQKKF183J.tmp
is-ZTWRR88Y68.tmp
is-14H2RLT1QZ.tmp
is-2FFP54PI15.tmp
is-2H2JPP9NRE.tmp
is-3221N7J8PD.tmp
is-42TO12SN9Z.tmp
is-APZZ05VO1M.tmp
is-BRMDNT43JR.tmp
is-CU5GDGDPB0.tmp
is-EHQX77J3HT.tmp
is-GTIZ89VP2G.tmp
is-HF0RRFSML7.tmp
is-I8TRIIFELD.tmp
is-IQHBKKDNP0.tmp
is-IYZCITUH4T.tmp
is-J0ZNHGKP0C.tmp
is-MKB5L5LN2P.tmp
is-NH0PGEQ1CY.tmp
is-PK4WSDM3Q5.tmp
is-RNBJSMN0XM.tmp
is-S7A3USVAJ0.tmp
is-SHT5CYNDC7.tmp
is-TCH89UT9BW.tmp
is-WUEN1UR2LM.tmp
is-WVO0VK4P98.tmp
is-X4U6WO4QML.tmp
is-XEQWVTE1CU.tmp
is-XF6E285LJ5.tmp
is-ZJ5LBSM76A.tmp
is-ZUH26FV7M2.tmp
is-133DUPCXX0.tmp
is-3W79V3QNH5.tmp
is-4BHNNGACXZ.tmp
is-4BR0NE4PXZ.tmp
is-4V6Z2RYQH9.tmp
is-5ORMW23AHU.tmp
is-60GL23CAVQ.tmp
is-6W95HAZV0N.tmp
is-6ZX0TB8WFB.tmp
is-7QKG97KA43.tmp
is-8FYG5J07NT.tmp
is-94CX1DP038.tmp
is-9BH1ZS47ZA.tmp
is-9EZFZ6HN1J.tmp
is-9GDSXMJB4W.tmp
is-9SRG7RQP2R.tmp
is-AUXOT87F6G.tmp
is-BQ5M6GAXC4.tmp
is-D7JB6ZYUUL.tmp
is-DWER7RKT2Q.tmp
is-EKB0XGXXQV.tmp
is-F8FBXVD03X.tmp
is-GNUGLFA9H2.tmp
is-GUM11XORBK.tmp
is-GXF994PFJF.tmp
is-H2P00FLO98.tmp
is-H5FHQVY9JL.tmp
is-I2YAMD6L5F.tmp
is-IK972ZUXA1.tmp
is-IN41YDH64P.tmp
is-JTB0G4P7NI.tmp
is-KH217AZWR3.tmp
is-L1PR9VU11E.tmp
is-L7JK37JMTZ.tmp
is-LD4WWF9UF2.tmp
is-LK0LMY20AP.tmp
is-LQEQ0NQ8E0.tmp
is-LWBA31WC6W.tmp
is-MSIAW7FFD4.tmp
is-N9FHRA750I.tmp
is-NL72UTPGAG.tmp
is-O3EWVUHCGE.tmp
is-ODSUPQY3OC.tmp
is-P0D0A378P8.tmp
is-PV16QI33XO.tmp
is-R41XMRX02M.tmp
is-RE6Q8GR02Z.tmp
is-RJV6TKCSRB.tmp
is-S3AJEYUO78.tmp
is-SUBRKNO03Q.tmp
is-SY58ABQHVW.tmp
is-SZAZMRGR3A.tmp
is-TA7HGUQZXZ.tmp
is-TL3NFDFSGD.tmp
is-TT7O0D08DJ.tmp
is-U1LW8GSIT7.tmp
is-UJBTITPWMG.tmp
is-UQCVWCQB8V.tmp
is-VKO17NV1FF.tmp
is-WEXWF1TFAX.tmp
is-WQACL42ZY8.tmp
is-WXACYTRQQ6.tmp
is-XT1ANNROFL.tmp
is-Y9MR17RV8A.tmp
is-YMAMWAH3R3.tmp
is-YQKXSRP2PQ.tmp
is-YTYHVH7VOX.tmp
is-YVTTPE3T59.tmp
is-ZXMJSPXTTH.tmp
is-570VIEMXR3.tmp
is-629OK2T7R3.tmp
is-E39ZQMB9ZF.tmp
is-FJNVQQ6ZZ6.tmp
is-L0TRPBE3CO.tmp
is-LD8LVWXBIA.tmp
is-LPCSWOWFNF.tmp
is-MJH3VK56B9.tmp
is-MR296P75KB.tmp
is-OZ8C1YCAFH.tmp
is-Q6WCOI7MZJ.tmp
is-QDBFPQ6MIN.tmp
is-TI3RE5ZNF0.tmp
is-VK00CAG9DR.tmp
is-W2ZLG5EGTV.tmp
is-WGYY7ISDEP.tmp
is-WMNJGRPZTP.tmp
LUT.fx
is-6ACECXOSJ3.tmp
is-H4HDXKBSG4.tmp
is-PEBKTULX42.tmp
is-YD57BTTUP4.tmp
is-0J3YXAWXXZ.tmp
is-323LJ2PUMX.tmp
is-5WVSMVLZG8.tmp
is-6KCD5URB0V.tmp
is-MRG3P1L45J.tmp
is-O0FJ21GRI0.tmp
is-PXHQGTHLSN.tmp
is-ULYH8GYVBD.tmp
is-7H3AG9F1M9.tmp
is-DRLDHC04O0.tmp
is-GO58NUBW4C.tmp
is-JLMUFUNQU5.tmp
is-LEEB0ZU9O5.tmp
is-R5NWLGXFZ2.tmp
is-V6Y0XU5SK9.tmp
is-X36MLYLJU3.tmp
is-2OF9TKAQBA.tmp
is-8DT7BR6H2B.tmp
is-D86OZ73GA4.tmp
is-Y2SW0VNGPD.tmp
is-2MINE0LGUV.tmp
is-7US029CUGW.tmp
is-9BJS9TYHKE.tmp
is-AUMEPW8RQZ.tmp
is-BO4CGMQFLT.tmp
is-DROOTJWTAJ.tmp
is-GX88RAH0MM.tmp
is-JXR68K0LTQ.tmp
is-MDTXIWWK0B.tmp
is-OF2I0MDKTK.tmp
is-UZB3KSZ3MX.tmp
is-4V0YWWEJUV.tmp
is-51U9SXQ5NE.tmp
is-5XSSXP1G2T.tmp
is-8FIURUT4M2.tmp
is-8PWC8YEXET.tmp
is-AJZXP425GV.tmp
is-CJYBDWZVZR.tmp
is-COVMJ5O9E7.tmp
is-CW3MT6C5AQ.tmp
is-CW7PZMKBUI.tmp
is-EQ773SYYY6.tmp
is-FBOSNCALLY.tmp
is-GD5X3FE1Y3.tmp
is-GETZZDSUO6.tmp
is-GGDLE0XR1M.tmp
is-I09GZJ7YR4.tmp
is-IRNBIHONRZ.tmp
is-JNYDH1A3NN.tmp
is-K66871LV6O.tmp
is-KFL1YBCD71.tmp
is-M675LW2RW0.tmp
is-OJLO7VDCI7.tmp
is-OMZS5JK2AQ.tmp
is-OSKUQILUWP.tmp
is-P5XK1IDED8.tmp
is-PUKXYX7E1F.tmp
is-Q3KNJWA230.tmp
is-RGRLE5UL0U.tmp
is-RH07FW8ZMB.tmp
is-SKAPHC8UGS.tmp
is-TK7N96RMXX.tmp
is-UT36KD2WG8.tmp
is-W4PB9AJBMZ.tmp
is-X7XCWFNSQ7.tmp
is-C54HYN7J03.tmp
is-2Y4NGGBKHF.tmp
is-9LYB25XF7B.tmp
is-OY0C4MY3VQ.tmp
CRTAperture.fx
is-0NGJ4WHT8B.tmp
is-1EHFWTMCOJ.tmp
is-20AX7ACQZF.tmp
is-2DW7K4HL9C.tmp
is-3VNZJMP96V.tmp
is-3XU44G2LL6.tmp
is-43BZX7843N.tmp
is-450N4O7O5Q.tmp
is-4RRD1Z7D2L.tmp
is-4T8NVN6HSJ.tmp
is-60RLORJ7QS.tmp
is-65GVW7HMEE.tmp
is-69QUJGG5ML.tmp
is-69V9S7P7LY.tmp
is-A0VR1MHTP2.tmp
is-AXGI2NSOLB.tmp
is-BK81P401U9.tmp
is-CN8L17DJQ2.tmp
is-DM43TL6K99.tmp
is-EINONIOWFD.tmp
is-ERA6G4DNNE.tmp
is-ESGXBWZZTC.tmp
is-FLEH7XAKS4.tmp
is-FWWE2LAW17.tmp
is-GW00G5OHXH.tmp
is-HNC8T1IUQC.tmp
is-HWY4IOUEBO.tmp
is-J0VE5LC2GB.tmp
is-J13DWALGJ2.tmp
is-JCB537RMZU.tmp
is-JCVNLBKG69.tmp
is-K74B68XF8H.tmp
is-KD91XTQDKR.tmp
is-KG64ON0D7K.tmp
is-KMHFJK2QIH.tmp
is-LA1Z4ZNZ1Z.tmp
is-LDCKP142YV.tmp
is-LSYKXSLHOU.tmp
is-M2WFQ57KOF.tmp
is-M3LFBMSRRX.tmp
is-M6G8FI99HC.tmp
is-MYGGMUYGW3.tmp
is-N46A7D0Y5Q.tmp
is-NA3IC8PUHK.tmp
is-ONZZCJ4LL8.tmp
is-PL51QZZO3F.tmp
is-PNLOOCM27T.tmp
is-Q9REO0RCUT.tmp
is-QM8A8FW2D9.tmp
is-R75MAK0ZL0.tmp
is-S6157853HF.tmp
is-SEIV1CG9FK.tmp
is-SXKBKT9D5G.tmp
is-T03J8LI6GE.tmp
is-T8DTZR17LC.tmp
is-UQTIF5UX3F.tmp
is-WASI5AY9I6.tmp
is-X0X5414QKX.tmp
is-XEDHH4E2L9.tmp
is-XPSNBDHDNW.tmp
ntsc.fx
is-74Z1YG037K.tmp
is-7W6EPB0O5B.tmp
is-FD6Q69FN2N.tmp
is-FOCNFVQSLC.tmp
is-LG7LAZZ1C9.tmp
is-NQIB9T7S6X.tmp
is-OHDDHBMYLY.tmp
is-S9WRH1LVG6.tmp
is-TUXOT3CESL.tmp
is-UH14TSH6EZ.tmp
is-WM51QLF50B.tmp
is-XXPI7TEA1B.tmp
cas_helpers.fxh
is-0AWXF6PEP2.tmp
is-0W1UUC2JWT.tmp
is-4RQBVWOW7M.tmp
is-5PP1B12HY2.tmp
is-7QB7SBJ98E.tmp
is-97C1F9GN3K.tmp
is-AGO4MTPKT4.tmp
is-D8CWB78OGO.tmp
is-DE38BU56YE.tmp
is-FT6OURGDXQ.tmp
is-IUJX64ZSLZ.tmp
is-MZQVK7JZIY.tmp
is-Z5EBOAPPXN.tmp
is-5E4UKY6K0C.tmp
is-77K76OMLHP.tmp
is-CJQBEUGYHT.tmp
is-HG35ZKC5CY.tmp
is-KINAKVAC8H.tmp
is-KQJHNHIMG3.tmp
is-MM9WQ4UF3Y.tmp
is-RX96X2BCUC.tmp
is-2DL3QGC3WO.tmp
is-4IW0LCDJ7F.tmp
is-580C5HOAF8.tmp
is-6JR0G4P192.tmp
is-9Y1ILOCWMI.tmp
is-EEAW4SJV3D.tmp
is-HPLPTQMETM.tmp
is-J5PLPEA4OS.tmp
is-OPJK8E9Y1A.tmp
is-X1HVXGUSF2.tmp
is-LHKMJQDAQN.tmp
is-FKY1GE6GH7.tmp
is-Z0WZP1Y4GO.tmp
is-4SFRTXTP1C.tmp
is-E3V4IB1UTI.tmp
is-O82XGI6I8G.tmp
is-4CAS1KFX0Q.tmp
is-G3B4O3XTLU.tmp
is-IK3R9KND7S.tmp
is-JP2JFWCPBJ.tmp
is-KKG9MS9SCD.tmp
is-PHCGOVCYQE.tmp
is-W10F6AAOH2.tmp
is-2VD37ESVW4.tmp
is-QYKQS1IGZ7.tmp
is-7H0G98192L.tmp
is-R2STRM6ZCH.tmp
is-UINWPSV0CM.tmp
is-91TECQBR6P.tmp
is-9TV7AJIBQA.tmp
is-DW8MGB3SSR.tmp
is-S66YD2T510.tmp
is-188Y8KYTQD.tmp
is-29MNR14B2P.tmp
is-429DYKJN3Y.tmp
is-47YG2GI6XI.tmp
is-7H2YASNZSP.tmp
is-906R00WZWZ.tmp
is-A0EZFE2RZG.tmp
is-B225IY0RWL.tmp
is-BH3GSXN7YJ.tmp
is-BJJ51RT1J1.tmp
is-E71AS9XOT9.tmp
is-FFP2VES9PU.tmp
is-GO0IOEUFOV.tmp
is-GQ9D11R5L4.tmp
is-HVSBRYSQUP.tmp
is-M9TX3RKD71.tmp
is-M9ZGQY49RK.tmp
is-NFAVP5KSA5.tmp
is-Q7QP30SYID.tmp
is-S72KCMEMZI.tmp
is-SLF7CFM1FR.tmp
is-TKQYQLZQPB.tmp
is-TVMP6RQIWN.tmp
is-V3VPIEMQJ4.tmp
is-WI5LH6M0OI.tmp
is-X87N679HMQ.tmp
is-X8UUOXN91D.tmp
is-ZBRBL0H0QV.tmp
is-8JKAB98XDO.tmp
is-AFO5RDWK4N.tmp
is-BYO28D7Z3Y.tmp
is-E5S8YG3W1R.tmp
is-2S18MJSRFR.tmp
is-I0E0U6CME9.tmp
is-00RQVLEET7.tmp
is-3AC90YD4EJ.tmp
is-8XK61H1YT9.tmp
is-AZ3H1H1BK4.tmp
is-D3YWJGRJCV.tmp
is-DX9LFASAPC.tmp
is-ECGPW9G2O7.tmp
is-HZPORW7EUT.tmp
is-I10RLF3VXX.tmp
is-J5RXRJ1NJZ.tmp
is-LWECY72F1U.tmp
is-QJLCLG4QO1.tmp
is-RFT07SKMLE.tmp
is-ROBAD0UUQV.tmp
is-V5AUAGAWLC.tmp
is-WDJR2CGH43.tmp
is-YPBMEVVGHV.tmp
is-545KVXJJPS.tmp
is-7P41HRY95S.tmp
is-8CKBJC4DQP.tmp
is-BC4PPOW9EH.tmp
is-DXV00GL2MI.tmp
is-IOJPHNLMA8.tmp
is-PLVG6NGL4I.tmp
is-S2HYD3LR6H.tmp
is-U39YT19JYZ.tmp
is-VFLP7H94RH.tmp
is-0K1UWRKJR7.tmp
is-46JX3UI9T0.tmp
is-8P7WU1AW18.tmp
is-B7ZCNQ7ZLO.tmp
is-DCZ1FGYATP.tmp
is-DMJIL1LC13.tmp
is-LMTXNA61ZT.tmp
is-MZVFGJ08EO.tmp
is-PTSN76HEK6.tmp
is-RNTATFJA81.tmp
is-SYXMXWKZLJ.tmp
is-ZLWUKY83RP.tmp
is-AFK6JJWQW5.tmp
is-GCNIF23K5P.tmp
is-NXSNUIUFUT.tmp
is-UJCR1ZPC4L.tmp
is-VXCHM9GIF3.tmp
is-4PH84LEDXQ.tmp
is-5LWHQ8YNWQ.tmp
is-A8IX2U6EGJ.tmp
is-EDD595VEV1.tmp
is-QELR0XTBCB.tmp
is-TYWKZM3SYM.tmp
is-3LT2LYDY4V.tmp
is-636I2L7IWT.tmp
is-6HG824TSFI.tmp
is-6MAL9FZ95T.tmp
is-6VEWGASXEP.tmp
is-78ZO93NM8Q.tmp
is-7MQH05SYPO.tmp
is-7T5LE1SAR9.tmp
is-7XDUMT36XM.tmp
is-9NX5IKQFQC.tmp
is-9O3MDEVT81.tmp
is-BP3DDBBL4T.tmp
is-BW4EAXAQJ6.tmp
is-E7EY0Z8XYF.tmp
is-FY6WGQP4SR.tmp
is-GVYALHPJVF.tmp
is-HY8MN7JUOM.tmp
is-I9ZVJDTLI9.tmp
is-IJMXEWN9UA.tmp
is-JSUVYWAPHE.tmp
is-JXC90U412D.tmp
is-MZY21QAO5W.tmp
is-NIBV1PNNUT.tmp
is-P9V1YEJD12.tmp
is-PM4PFGZ7GU.tmp
is-POICS04QZ0.tmp
is-T0S54THR0T.tmp
is-UCLN90381E.tmp
is-XSY6PEURZX.tmp
is-XXKJCX3E4L.tmp
is-4N5O61LFFU.tmp
is-BH7XLIC3YQ.tmp
is-EZ1QBDIMMB.tmp
is-F1MRP0VC55.tmp
is-HHIRGWBX7T.tmp
is-OE0T4TF5PA.tmp
is-1CG961GGCE.tmp
is-41RSSRDHA1.tmp
is-8JN06F18GS.tmp
is-B0RCMY20V6.tmp
is-GMRVQC9AGR.tmp
is-MH1T1U5KOK.tmp
is-S3F9QTEDDY.tmp
is-XPVEYXMTPK.tmp
is-HSSBVX1VZD.tmp
is-YEJO9KR63V.tmp
is-P5L1NJJULZ.tmp
is-0LNKX3JGEK.tmp
is-HE6SOPCKB2.tmp
is-MYLOXDDRV7.tmp
is-SZ4PF92UUW.tmp
is-045NHOL4Q3.tmp
is-0ZFXJI74LV.tmp
is-5U09F26FA2.tmp
is-8YCOAZMWHK.tmp
is-BG6MZR788P.tmp
is-EE9ERJPAX7.tmp
is-EILS7YXC4C.tmp
is-FQ12XTKSXP.tmp
is-IEL0UXJ2OC.tmp
is-JRLRV5IWE8.tmp
is-LM1IAEXELE.tmp
is-NICJJLDOQY.tmp
is-R39V38G8RH.tmp
is-RO1ONDC5KQ.tmp
is-V7NE513ZUG.tmp
is-VI5EIXP6LZ.tmp
is-VWD67YEWJX.tmp
is-YYWOJY65T0.tmp
is-ES0Z4OIINC.tmp
is-O6S132GKVU.tmp
is-JT9VPQNKOG.tmp
is-40Z5M84QMM.tmp
is-Q7MXLSCRES.tmp
is-XVGJ03YFRO.tmp
is-A6T6AWRJAR.tmp
is-FBYLS93SF8.tmp
is-JLAVBUOLOL.tmp
is-VG696C6RJD.tmp
is-8H0D950TNF.tmp
is-DWSZJGHSFK.tmp
is-D5DXERQ3PL.tmp
is-HG2NGWYIYO.tmp
is-6IRUXTZWIC.tmp
is-GDQT9LXO0K.tmp
is-GUJQQDWZZR.tmp
is-HYUMXE6P3W.tmp
is-SNCWJE9MFW.tmp
is-U9R4K4FWZA.tmp
is-49IUO43UFR.tmp
is-BE6ZH866BU.tmp
is-LH65U84RC6.tmp
is-MZH2GI4NU1.tmp
is-OV0W9W2HTT.tmp
is-SVE25NX7M6.tmp
is-TZ6T6DTSLB.tmp
is-Z0OYV9YV45.tmp
is-4RS9HEURGQ.tmp
is-8H5KC82D2E.tmp
is-PHLI5D75TI.tmp
is-Y3T828N5QH.tmp
is-3SF6I2MDTX.tmp
is-BNK77GRPSF.tmp
is-F394WZF5QO.tmp
is-QA81JOKE6E.tmp
is-RHFWVA99XH.tmp
is-HZNKXYR67K.tmp
is-NN7B8Q2Y8M.tmp
is-PQMT42MSG4.tmp
is-QMAKYJQ9L1.tmp
is-QPVEIQS9H6.tmp
is-2TDSEQ17BR.tmp
is-376OXLDG5N.tmp
is-39RCSLNLUO.tmp
is-39Z34ROPBS.tmp
is-4MOCH1KBLK.tmp
is-5D56XJ8USP.tmp
is-5MJS6150YU.tmp
is-5MKL95IL3N.tmp
is-5WS161ELU4.tmp
is-CDU2MW44FE.tmp
is-FPCJQKAA9R.tmp
is-G0AU0Z6D0X.tmp
is-II7QH8K4CY.tmp
is-L2R4SI0JFX.tmp
is-N0NVIJ4300.tmp
is-NAZ47WSQ6A.tmp
is-OC6L85LLL3.tmp
is-S757H71IWN.tmp
is-SAG3AW98JV.tmp
is-SIS01XMHBP.tmp
is-TDICPYA9KZ.tmp
is-VKAQVE9TNU.tmp
is-XIH6TCP3Q3.tmp
is-1GFN3TTL2I.tmp
is-KMCBAGTLF6.tmp
is-KY6TR0X811.tmp
is-BIJIE17NDK.tmp
is-CFPA76IXN0.tmp
is-FBID1MLNH7.tmp
is-HQ99MXC8F4.tmp
is-LVTQFKANGH.tmp
is-O9OII0CC3F.tmp
is-TYP3Q1KGWF.tmp
is-25XKG000L2.tmp
is-DQZROPKG4B.tmp
is-N9JY9I702K.tmp
is-YGAP3PNRQX.tmp
is-24WX0MME3V.tmp
is-9PM9MWT3GP.tmp
is-O5JV1LTEQG.tmp
is-RWR20J6V3H.tmp
is-ZP7E98JF0K.tmp
is-EGOF7PNMMV.tmp
is-M77AH7OVVS.tmp
is-4QJ56JVSD8.tmp
is-23LH5WUGMI.tmp
is-1YGXJ1IX6N.tmp
is-LXGEJJ6PL8.tmp
is-ZKM6KV1S5S.tmp
is-16KFPIK23Z.tmp
is-1DIVEASS1E.tmp
is-HFEZ2AP52B.tmp
is-VKS84S9WG6.tmp
is-YF8E3HBA9O.tmp
is-2ARTUFG4BY.tmp
is-B2OIVDBTPD.tmp
is-CZUD9V8WHX.tmp
is-F0KQLEOWHL.tmp
is-064ICOFIAB.tmp
is-KRRW2XYDBE.tmp
is-PAG2VOLMY1.tmp
is-9L828RLR0I.tmp
is-BG4N5I67AL.tmp
is-DSMB87O2EL.tmp
is-KERNXNQH7H.tmp
is-VPONLBUTV2.tmp
is-XBVZ5PP36U.tmp
is-8V5A4WCIQD.tmp
is-KSOB7EYCTR.tmp
is-RGE4NPZ4VB.tmp
is-SB045YN7VL.tmp
is-3LOILSQAMJ.tmp
is-3SJ9J0QX16.tmp
is-4PB3BMWHME.tmp
is-5KKP05JHJA.tmp
is-64JV3LNLC5.tmp
is-AEGQKPN0HU.tmp
is-JCLD3G7TCX.tmp
is-L2XRDYCQQU.tmp
is-M87GDUEYD2.tmp
is-P0X8J0YF4X.tmp
is-UI4EZF2TUO.tmp
is-VQZ35EERVX.tmp
is-YF8LT2X088.tmp
is-3YFH76KD92.tmp
is-E6Q3MH5AVD.tmp
is-EOX21T36FY.tmp
is-Q25ZMCY7OU.tmp
is-R62L96403X.tmp
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
cacert.pem
md.cp310-win_amd64.pyd
md__mypyc.cp310-win_amd64.pyd
libcrypto-1_1.dll
libssl-1_1.dll
python310.dll
select.pyd
unicodedata.pyd
b9be8402-5155-4126-9b83-20110730bed1.zip
buowcQQw.bat
file.vbs
RobloxShadeHost-Setup.tmp
EffectPackages.ini
ReShade-Setup.exe
_is7z.dll
pd80_gaussnoise.png
StageDepthmap.png
fognoise.jpg
.gitattributes
NTSC_RetroArch.fx
FXAA.fxh
lilium__font_atlas.png
TriDither.fxh
CustomNegative.png
mmx_bxdf.fxh
mmx_camera.fxh
mmx_colorspaces.fxh
mmx_debug.fxh
mmx_deferred.fxh
mmx_depth.fxh
mmx_fft.fxh
mmx_global.fxh
mmx_harmonics.fxh
mmx_hash.fxh
mmx_input.fxh
mmx_math.fxh
mmx_qmc.fxh
mmx_sfc.fxh
mmx_texture.fxh
1_catmullrom_5tap_dx0p000_dy0p000.png
2_catmullrom_5tap_dx0p000_dy0p000.png
3_catmullrom_5tap_dx0p000_dy0p000.png
ui_box12_mask.png
NeoBloom_LensDirt.png
neutral_lut.png
preset-downloads.ini
preset.ini
preset.ini
ReShade.ini
ReShade.ini
ReShade.log
dxgi.dll
mozilla-temp-41
mozilla-temp-6334
tmpaddon
tmpaddon
ad.trace
ad.trace
service.conf
service.conf
service.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
index.dat
index.dat
40371339ad31a7e6.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
75fdacd8330bac18.customDestinations-ms
e64d79b0-697a-4d90-a613-910292cac0c6.dmp
e64d79b0-697a-4d90-a613-910292cac0c6.extra
e64d79b0-697a-4d90-a613-910292cac0c6.extra
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
SiteSecurityServiceState.bin
broadcast-listeners.json
store.json.mozlz4
store.json.mozlz4.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
events
pageload
070111f4-b254-4a9b-898e-7805866768c6
0f580e0f-2877-45e1-a773-4551e3cc08e6
1a604b36-e8d2-497c-ad13-cd49530d2ac2
200e2886-5088-4f93-bb49-25ec4456e50b
20b5b9e8-04fe-4788-94d9-487b47826c92
3299e994-ad54-4ce9-ab47-9b66af7d24d4
339002a3-7ef2-4f34-8755-13c8ddcdaeec
3836587e-5557-4364-a8f3-85a332d533e3
39e83948-528d-4274-9ae1-3c42880836a2
3f7b4aed-d5f4-4f47-9184-d71112e9a4d6
45506a61-d519-4365-97ea-cf1755e58f5c
4a6ad09c-81bc-43ca-9f4e-51b5d622fd24
4d7261dd-ecb9-4083-9cef-2b42d337c00d
4e324f21-3cd4-4afe-8dc1-2b4195ae5648
4f7ed1fe-7765-4d38-a509-cb9af00b739d
5087b71a-0eb1-4b62-b20e-6cb4ffcdd3ae
51b85a70-6d1d-434e-a20a-f0f23c978ef9
54f93f73-5841-48ca-802b-13fb775f3136
58cab9bd-c10e-43e2-b0ce-792df85a1af6
5900eed0-0c85-4539-906a-2862c4ae634b
605de3c3-935c-491a-8064-0ed28c0a203c
62084659-37cb-4ee9-99c6-e93d47049486
64a8e303-9e43-4b93-8496-7ac8f77e291f
6b3807a4-6e9c-4ef1-af25-0412e252d86c
73681e2c-4bfe-41ba-a8df-c07b2b35a987
7547f3b2-8d6e-4d13-b6b3-84426193de10
759f663a-2af3-4e29-bfa4-e00ec0f62e5b
7fd403d1-e752-4c89-b326-3657e52806e8
80645565-349f-475d-a246-61e4e5859671
815ebd96-84b9-4a02-878b-8e848b62f340
84978135-6f69-4f2a-abf0-5b1ec3b1fd58
8556ef2b-c56b-4755-be4e-194f5251e09f
90ecfd3f-e06e-42e3-92ad-a97833db20fd
917a514c-88f5-4e75-ac26-062304786575
91a8bf3a-8714-4333-aa42-68b39679d87a
93f3714c-1ff4-407c-a0ec-57fa08c1fa49
943562dc-c9b9-4d78-b608-18ac98195a0b
9b3a83f9-46de-4ac4-a895-39c50d9a9c3a
9e0d3738-ec7b-4ccb-8074-6e72077dc1c9
a33f4530-6d89-413f-aa06-9bfe13c43f53
a9dcbdd1-1743-4101-bd25-c917ec9fba61
b2d74539-1cf6-4dfb-a115-9dbafb532b14
b71f582e-d376-459c-946a-a58e33b6a661
b8dec830-d71b-4e01-9454-550f3987d953
b9c7f66f-56c2-47b5-a782-b922bc2f6d47
bde13238-f1ff-4f5e-a1eb-cce0bfd199d6
c62d01fa-79a8-4a04-aab3-2300d3e6134a
c8402995-0f2e-491d-b56b-0430281ad420
cac0c1e4-4122-46bf-815b-703bd1378ac4
d7ca8a8b-d37f-491a-8013-cbd766b1c06a
d7d0495b-5cb8-4dcb-8012-9c5a097b9587
d84b1e07-de61-4c23-840e-7e65b7113b27
d8da1801-8a98-4d5d-a240-136d2a9bfce9
db451dc7-cdd5-49cc-8f3a-7d2f7c809561
e004ff59-5225-467b-9518-35708aebfadd
ece16055-f4a4-41f5-9661-ce47bffe30a5
ed8796f5-b4c8-4bbb-9ea6-5aa353235daa
f1f4be67-f3e5-4c32-a39e-d53c44e94aaa
f5db6c41-6c45-4f27-905a-7a249cf844ae
f5eb0ae0-f3fe-4e1c-a058-7773a653e8d8
f9e5abe9-8ebe-468a-919d-745b75352463
fe4fbcfb-ee36-431a-964f-16fa9bd3e65f
ff4dcd40-675c-4d6b-a4fa-55b702e86e4a
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
places.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
sessionCheckpoints.json
sessionCheckpoints.json
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4.tmp
sessionstore.jsonlz4.tmp
data.sqlite
3140325527hBbDa.sqlite
3140325527hBbDa.sqlite-wal
3140325527hBbDa.sqlite-wal
3140325527hBbDa.sqlite-wal
3140325527hBbDa.sqlite-wal
usage
3870112724rsegmnoittet-es.sqlite
!Please Read Me!.txt
AkUs.exe
AnyDesk.exe
Fishstrap.NqMJGKvL.exe.part
GsUE.exe
MBSetup-1.1.exe
MQYU.exe
OsEs.exe
PolyRansom
PolyRansom.exe
PowerPoint.exe
QwAE.exe
RobloxPlayerInstaller-GBF6V3CVK2.wEmLkMqZ.exe.part
SIEU.exe
SUos.ico
ViraLock.exe
ViraLock.exe:Zone.Identifier
WUgM.exe
WannaCry.exe
WogQ.exe
Ycsa.exe
aAge.ico
aQEC.ico
cAIo.exe
cUoI.exe
cgck.exe
gcapi.dll
iAMc.exe
kIYQ.exe
m.wry
oAgo.exe
ogks.exe
qQAE.exe
r.wry
t.wry
u.wry
ugsu.exe
winlocker3.AHaikOTE.zip.part
winlocker_builder_0.vaxGJO_N.6.zip.part
memory/1100-58170-0x0000000000400000-0x0000000000439000-memory.dmp
memory/1100-58159-0x0000000000400000-0x0000000000439000-memory.dmp
memory/1424-6601-0x0000000000EF0000-0x000000000133B000-memory.dmp
memory/1424-6015-0x0000000000EF0000-0x000000000133B000-memory.dmp
memory/1424-10388-0x0000000000EF0000-0x000000000133B000-memory.dmp
memory/1424-6247-0x0000000000EF0000-0x000000000133B000-memory.dmp
memory/1424-15263-0x0000000000EF0000-0x000000000133B000-memory.dmp
memory/1424-16889-0x0000000000EF0000-0x000000000133B000-memory.dmp
memory/1424-13257-0x0000000000EF0000-0x000000000133B000-memory.dmp
memory/1424-5-0x00000000038C0000-0x00000000038C1000-memory.dmp
memory/1424-9376-0x0000000000EF0000-0x000000000133B000-memory.dmp
memory/1424-11-0x0000000000EF0000-0x000000000133B000-memory.dmp
memory/1424-12-0x00000000038C0000-0x00000000038C1000-memory.dmp
memory/1424-7482-0x0000000000EF0000-0x000000000133B000-memory.dmp
memory/1424-5997-0x0000000000EF0000-0x000000000133B000-memory.dmp
memory/1756-16890-0x0000000000090000-0x0000000000181000-memory.dmp
memory/1756-10-0x0000000000090000-0x0000000000181000-memory.dmp
memory/1756-0-0x0000000000090000-0x0000000000181000-memory.dmp
memory/2156-58185-0x0000000000400000-0x0000000000439000-memory.dmp
memory/2156-58179-0x0000000000400000-0x0000000000439000-memory.dmp
memory/2236-58005-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2416-25480-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/2416-25498-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/2648-25743-0x0000000000BD0000-0x0000000003188000-memory.dmp
memory/2648-25469-0x0000000000BD0000-0x0000000003188000-memory.dmp
memory/2760-58247-0x000000002AA00000-0x000000002AA24000-memory.dmp
memory/2760-58250-0x000000002AA00000-0x000000002AA24000-memory.dmp
memory/3456-25538-0x0000000003F70000-0x0000000003F8B000-memory.dmp
memory/3456-25930-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/3456-25542-0x0000000003F70000-0x0000000003F8B000-memory.dmp
memory/3456-57058-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/3456-25896-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/3456-25541-0x0000000003F70000-0x0000000003F8B000-memory.dmp
memory/3456-25499-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/4820-45584-0x0000025445700000-0x0000025445A4D000-memory.dmp
memory/5960-58140-0x0000000000400000-0x0000000000432000-memory.dmp
memory/5960-58282-0x0000000000400000-0x0000000000432000-memory.dmp
memory/6332-47057-0x0000000010000000-0x0000000010012000-memory.dmp
memory/6744-57331-0x0000000000400000-0x0000000000432000-memory.dmp
memory/6744-57317-0x0000000000400000-0x0000000000432000-memory.dmp
memory/7272-57337-0x0000000000400000-0x000000000042E000-memory.dmp
memory/7272-57848-0x0000000000400000-0x000000000042E000-memory.dmp
memory/7544-57321-0x0000000000400000-0x000000000042E000-memory.dmp
memory/7544-57821-0x0000000000400000-0x000000000042E000-memory.dmp
memory/8492-6044-0x0000027D9E480000-0x0000027D9E4AA000-memory.dmp
memory/8492-6045-0x0000027D9E8A0000-0x0000027D9E8A8000-memory.dmp
memory/8492-6046-0x0000027DB95E0000-0x0000027DB9618000-memory.dmp
memory/8492-6047-0x0000027D9E8B0000-0x0000027D9E8BE000-memory.dmp
memory/8492-6049-0x0000027DB97D0000-0x0000027DB97E2000-memory.dmp
memory/8492-6050-0x0000027DB97F0000-0x0000027DB97FA000-memory.dmp
memory/8716-57885-0x00000183452E0000-0x0000018345D7C000-memory.dmp
memory/8716-57903-0x00000183462A0000-0x00000183462A6000-memory.dmp
memory/8716-57901-0x0000018360340000-0x0000018361356000-memory.dmp
memory/8788-58152-0x0000000000400000-0x0000000000439000-memory.dmp
memory/8788-58145-0x0000000000400000-0x0000000000439000-memory.dmp
memory/9284-57068-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/9284-29675-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/9284-25779-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/9384-25913-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/9384-25626-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/9384-51235-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/9384-30700-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/9384-57066-0x0000000000DD0000-0x0000000003388000-memory.dmp
memory/9396-58153-0x0000000000400000-0x0000000000439000-memory.dmp
memory/9396-58162-0x0000000000400000-0x0000000000439000-memory.dmp
memory/10636-25049-0x0000000000BD0000-0x0000000003188000-memory.dmp
memory/10636-21949-0x0000000000BD0000-0x0000000003188000-memory.dmp
memory/10636-25472-0x0000000000BD0000-0x0000000003188000-memory.dmp
memory/10636-21540-0x0000000000BD0000-0x0000000003188000-memory.dmp
memory/11092-58204-0x0000000000400000-0x0000000000439000-memory.dmp
memory/11156-21951-0x0000000000BD0000-0x0000000003188000-memory.dmp
memory/11156-21621-0x0000000000BD0000-0x0000000003188000-memory.dmp
memory/11168-21950-0x0000000000BD0000-0x0000000003188000-memory.dmp
memory/11168-21688-0x00000000080D0000-0x00000000080EB000-memory.dmp
memory/11168-21692-0x00000000080D0000-0x00000000080EB000-memory.dmp
memory/11168-21691-0x00000000080D0000-0x00000000080EB000-memory.dmp
memory/11168-21619-0x0000000000BD0000-0x0000000003188000-memory.dmp
memory/11168-25473-0x0000000000BD0000-0x0000000003188000-memory.dmp
memory/11216-30503-0x000001D0AB520000-0x000001D0AB540000-memory.dmp
memory/11216-30485-0x000001D0AB500000-0x000001D0AB520000-memory.dmp
memory/11216-30518-0x000001D0BD8D0000-0x000001D0BD9D0000-memory.dmp
memory/11216-30591-0x000001D0BD650000-0x000001D0BD750000-memory.dmp
memory/11216-30502-0x000001D0AB540000-0x000001D0AB560000-memory.dmp
memory/11952-30712-0x00007FFC8BA10000-0x00007FFC8BA20000-memory.dmp
memory/11952-30715-0x00007FFC8BA10000-0x00007FFC8BA20000-memory.dmp
memory/11952-30669-0x00007FFC8BA10000-0x00007FFC8BA20000-memory.dmp
memory/11952-30714-0x00007FFC8BA10000-0x00007FFC8BA20000-memory.dmp
memory/11952-30672-0x00007FFC892E0000-0x00007FFC892F0000-memory.dmp
memory/11952-30667-0x00007FFC8BA10000-0x00007FFC8BA20000-memory.dmp
memory/11952-30713-0x00007FFC8BA10000-0x00007FFC8BA20000-memory.dmp
memory/11952-30670-0x00007FFC8BA10000-0x00007FFC8BA20000-memory.dmp
memory/11952-30671-0x00007FFC8BA10000-0x00007FFC8BA20000-memory.dmp
memory/11952-30668-0x00007FFC8BA10000-0x00007FFC8BA20000-memory.dmp
memory/11952-30673-0x00007FFC892E0000-0x00007FFC892F0000-memory.dmp
memory/12816-58167-0x0000000000400000-0x0000000000439000-memory.dmp
memory/12816-58178-0x0000000000400000-0x0000000000439000-memory.dmp
memory/15980-57849-0x0000000000400000-0x0000000000434000-memory.dmp
memory/15980-57339-0x0000000000400000-0x0000000000434000-memory.dmp
memory/17388-57351-0x0000000000400000-0x0000000000432000-memory.dmp
memory/17388-57361-0x0000000000400000-0x0000000000432000-memory.dmp
memory/18512-57348-0x0000000000400000-0x0000000000432000-memory.dmp
memory/18512-57338-0x0000000000400000-0x0000000000432000-memory.dmp
memory/19188-58144-0x0000000000400000-0x0000000000439000-memory.dmp
memory/19188-58130-0x0000000000400000-0x0000000000439000-memory.dmp
memory/19200-58287-0x0000000000400000-0x0000000000434000-memory.dmp
memory/19200-58141-0x0000000000400000-0x0000000000434000-memory.dmp
memory/19768-58197-0x0000000000400000-0x0000000000439000-memory.dmp
memory/20700-57328-0x0000000000400000-0x0000000000434000-memory.dmp
memory/20700-57822-0x0000000000400000-0x0000000000434000-memory.dmp
memory/21092-58191-0x0000000000400000-0x0000000000439000-memory.dmp