17c5b8ecfd7ff396a320bbbfea302eaff648213fcf2ec6bc1a79b6055d708f74

Resubmissions

29-05-2023 14:48

230529-r6nwzscg4w 10

29-05-2023 13:55

230529-q737maca99 7

Analysis

max time kernel
274s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2023 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Size

194.9MB
MD5

86ca28bd1b44e23b240f66b3255a9066
SHA1

bc6f1d376fec8322419e17349d5dd1c17eeef2b9
SHA256

17c5b8ecfd7ff396a320bbbfea302eaff648213fcf2ec6bc1a79b6055d708f74
SHA512

3190166615f616302b8dc799330b0e060d6afae1b534a4fc4dac62264df4d366b370c85b74fa3942ea32c9640fb8a05f81c86ebd3d96cd460c087b33286a2ef4
SSDEEP

3145728:ohXbmla2GI8jx4lVSLXFJLKMuNSOZd891ZT1BFSl7MlFroahoXYns:cqXxl8/LxusZ9hal7MlFroahoXT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

DWSIM.exe

pid process

2304 DWSIM.exe

pid	process
2304	DWSIM.exe

Loads dropped DLL 16 IoCs

Processes:

DWSIM_bin_v844_setup_win7win8win10win11_64bit.exeDWSIM.exe

pid	process
1948	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
1948	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
1948	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
1948	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
1948	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
1948	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
1948	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
1948	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
2304	DWSIM.exe
2304	DWSIM.exe
2304	DWSIM.exe
2304	DWSIM.exe
2304	DWSIM.exe
2304	DWSIM.exe
2304	DWSIM.exe
2304	DWSIM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f5d5d186-a1c4-43f5-bb2e-94f0fdd18fb0.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230529155922.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 49 IoCs

Processes:

DWSIM_bin_v844_setup_win7win8win10win11_64bit.exemsedge.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwxmz\ = "DWSIM.SimulationXMLZIP"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXMLZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\DWSIM\\DWSIM_XML.ico"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwrsd2	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.DataRegressionCase\shell\ = "open"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXML\shell\open	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXML\shell\open\ = "Open DWSIM Simulation"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwxmz	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXMLZIP	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXMLZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\DWSIM\\DWSIM.exe\" \"%1\""	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.DataRegressionCase\shell\open\command	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwxml\ = "DWSIM.SimulationXML"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXML\shell	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXML\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\DWSIM\\DWSIM.exe\" \"%1\""	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXMLZIP\ = "DWSIM Compressed XML Simulation File"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.CompoundCreatorCase	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.CompoundCreatorCase\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\DWSIM\\DWSIM_CSD.ico"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.CompoundCreatorCase\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\DWSIM\\DWSIM.exe\" \"%1\""	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.DataRegressionCase\shell	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.DataRegressionCase\shell\open\ = "Open DWSIM Data Regression Case"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.DataRegressionCase\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\DWSIM\\DWSIM.exe\" \"%1\""	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwxml	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXML\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\DWSIM\\DWSIM_XML.ico"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXML\shell\ = "open"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXML\shell\open\command	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXMLZIP\DefaultIcon	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.CompoundCreatorCase\ = "DWSIM Compound Creator Case"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.CompoundCreatorCase\shell	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.CompoundCreatorCase\shell\open	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.CompoundCreatorCase\shell\open\ = "Open DWSIM Compound Creator Case"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.CompoundCreatorCase\shell\open\command	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.DataRegressionCase	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.DataRegressionCase\DefaultIcon	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXML\ = "DWSIM XML Simulation File"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.CompoundCreatorCase\shell\ = "open"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXMLZIP\shell	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXMLZIP\shell\open\ = "Open DWSIM Simulation"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwcsd2\ = "DWSIM.CompoundCreatorCase"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.CompoundCreatorCase\DefaultIcon	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXML	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXML\DefaultIcon	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXMLZIP\shell\ = "open"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXMLZIP\shell\open	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.SimulationXMLZIP\shell\open\command	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwcsd2	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwrsd2\ = "DWSIM.DataRegressionCase"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.DataRegressionCase\ = "DWSIM Data Regression Case"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.DataRegressionCase\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\DWSIM\\DWSIM_RSD.ico"	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DWSIM.DataRegressionCase\shell\open	DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

3756 msedge.exe
3756 msedge.exe
1148 msedge.exe
1148 msedge.exe
3664 identity_helper.exe
3664 identity_helper.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe

pid process

1948 DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DWSIM.exe

description pid process

Token: SeDebugPrivilege 2304 DWSIM.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

1148 msedge.exe
1148 msedge.exe
1148 msedge.exe

pid	process
3756	msedge.exe
3756	msedge.exe
1148	msedge.exe
1148	msedge.exe
3664	identity_helper.exe
3664	identity_helper.exe

pid	process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

description	pid	process
Token: SeDebugPrivilege	2304	DWSIM.exe

pid	process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

DWSIM.exemsedge.exe

description	pid	process	target process
PID 2304 wrote to memory of 1148	2304	DWSIM.exe	msedge.exe
PID 2304 wrote to memory of 1148	2304	DWSIM.exe	msedge.exe
PID 1148 wrote to memory of 4128	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4128	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4904	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 3756	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 3756	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1016	1148	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe
"C:\Users\Admin\AppData\Local\Temp\DWSIM_bin_v844_setup_win7win8win10win11_64bit.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1948

C:\Users\Admin\AppData\Local\DWSIM\DWSIM.exe
"C:\Users\Admin\AppData\Local\DWSIM\DWSIM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dwsim.org/downloads
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd9f6246f8,0x7ffd9f624708,0x7ffd9f624718
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2546311951386805981,10482562381232398204,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,2546311951386805981,10482562381232398204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,2546311951386805981,10482562381232398204,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2546311951386805981,10482562381232398204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2546311951386805981,10482562381232398204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2546311951386805981,10482562381232398204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:2736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6615b5460,0x7ff6615b5470,0x7ff6615b5480
      4⤵
      PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2546311951386805981,10482562381232398204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2546311951386805981,10482562381232398204,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2546311951386805981,10482562381232398204,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2546311951386805981,10482562381232398204,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2546311951386805981,10482562381232398204,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:1028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\DWSIM\CapeOpen.dll

Filesize
1.3MB

MD5
f6e67e945d22fe42add7fc356779efc5

SHA1
5e7d3f4137787eb20f5c77ccbcf98ed651927008

SHA256
dc2c04f9a0ccc93c1e8420fe1ab6cead57988c878ca1efdf6e05be268e8656d6

SHA512
b21099d06cb82d6749bfae988a9438d53f715d2d09496474571a75f2422218d2d245c4f6a4a998f91422b045546046ef1139d0268c704274ce2f84e2d1314d67

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\CoolProp.DLL

Filesize
12.0MB

MD5
247792824f75e25bdf7301ee19a01e1f

SHA1
dd1da38d1939e10198461775e0439637e14788ac

SHA256
8acc625c8b85fd283b3a6a7fbfa44154aadbf4f16dc991ff73da9396deb2d28c

SHA512
7f75e828ac1f19f758d05db2fd2b14adb1ebb598ae3a7d7c0b8f1ccb094981e3e51307b535a418c1e62dc5955d4a16aa507b410db533ad7154e19c287ff0ca65

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\CoolProp.dll

Filesize
12.0MB

MD5
247792824f75e25bdf7301ee19a01e1f

SHA1
dd1da38d1939e10198461775e0439637e14788ac

SHA256
8acc625c8b85fd283b3a6a7fbfa44154aadbf4f16dc991ff73da9396deb2d28c

SHA512
7f75e828ac1f19f758d05db2fd2b14adb1ebb598ae3a7d7c0b8f1ccb094981e3e51307b535a418c1e62dc5955d4a16aa507b410db533ad7154e19c287ff0ca65

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\Cudafy.NET.dll

Filesize
3.4MB

MD5
dcf3b806873fa652ccb17370e0ffb25a

SHA1
729e86521daf654a60569d7e83ef848a51b5474a

SHA256
70e66302a0cae967ab2c27c00674fb15ee61caa68a209c7092c5c66b332e7b0e

SHA512
3ab1ba2178605ef571725150749f91fa8d831a3803ac7a60f03bbce5b9263c06c67de62813dbe7c49003811916d506d3ca8ed7206b38cf319132c40c3f423223

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.Drawing.SkiaSharp.dll

Filesize
47.3MB

MD5
fb37ff061bdfe7594a97bb2c829f0f46

SHA1
559e6bd627ed39d0e9b3d368fd00304899cfcc7c

SHA256
162506b4d3155bdd96ffa0ff80266196b46c640475ef9c3568bb14d345c1ab0e

SHA512
ce42479593985dc03437d9bf3b5cfcd51432d94aca9f94fad04894e05b776aa77fb4a645963f7390111fc9aff9cb2db7e774216d0c3ebef100a00e5c456f3b75

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.DrawingTools.Point.dll

Filesize
8KB

MD5
2c21fae3f25eea3f83fe270044b5519a

SHA1
ce7646295a859d4ecfe18bab66f727b9a7ba16f1

SHA256
934f1fdb91060a009f13f26ad4a998ed20c5eff8b06a5eb9bb26ce633df7a574

SHA512
b87c80c7e108e422282e56038c1e8e13a989021f3da467861c7131d5e34d68193a16b7098ddc119c984f4674eab98277e9d8977cde0c367c8ae72ac70e6b7365

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.ExtensionMethods.Eto.dll

Filesize
153KB

MD5
04f9147f0930106434a46c4c16190d4e

SHA1
5d76f60cef33a4c7042d89917deb2f00b1f48cc7

SHA256
a39164e9bf3930b509319e8afad526ac3b633c308f836ea51ffc642f44e80ed1

SHA512
a5497819c5bb9a9cf6b2cfc534a1c2f3095dd1a49e28b96f454509168daa74a9829cede7ac1a7254532201a0fadae76c46fe5aaddabdaa76c30314f3a37df668

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.ExtensionMethods.dll

Filesize
38KB

MD5
a97e53eb4c5549fdc7350fd692bbe063

SHA1
dc5802869642fa69460c943a5adc7600eacd63e2

SHA256
0ecb8d7cde4aa75f33d7cf503558e6636db22fe3d017d74f539039ae392b4866

SHA512
d25b5a54323b4c355f561aeb41af44c6003428cc5f5f9a4e63d5497c6c5cd493e60a89c49c100bdd21914069568c7c27eb995ba4b70a4424bbd5be3b84ed045b

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.GlobalSettings.dll

Filesize
31KB

MD5
51166da6bb4d846d5627ed86c7a1de59

SHA1
05820b6b7e505e66fdc8025918b2a267e58f1414

SHA256
42d78fbbb780e800e5c476ad027abcc66685b9a0236778d4f46fd9580f732282

SHA512
9eb6d7ef4fdd5e63696b4f6baf988ffc5c87cf9be20780bb763eb88ef19129fbefcf1fce46ef56e55bf2e28db64dc8b076d832d26627c8460e25d3b217f93f92

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.Interfaces.dll

Filesize
119KB

MD5
a4a7839acde10d61a28497a2b44fe2d1

SHA1
b4df0767c7f8b975c96a9f2f80d2e37ebbfb8bd9

SHA256
25ff1262f1ffff2205f43d81f69c416b0bf3d1f2398605c91f3aee37a6ca429f

SHA512
5c5757c1e7b92dcb1bf737477f604df4fb9c293d298a76948c44525ede59e9a8f36e4e0137c6f2461021d09993aa321e453158d99b79e9cdcb571a05e04a08eb

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.Logging.dll

Filesize
6KB

MD5
50bf779d6ad024aa95b6492a70ce220d

SHA1
3028fed3744168b621640696ab26d4184ae5b58d

SHA256
03508418bf51f3799031421fb3edb04e0ecc719b32dfe5fc541a5cb3ae04e8d9

SHA512
1197e83b2bdda8ba07503d0b309a3110e3061faa140d0f00d22a8ace3330e0a9bbd479e596ddba6c85198a090730045b49e3a142b4e7bf5921e4ba8bf65a8f44

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.MathOps.SwarmOps.dll

Filesize
82KB

MD5
6713aad681d5f3d686b80b52ef9b64b1

SHA1
d46f6a2c2e94431608c46dc6564a5b1ab1e3c0ce

SHA256
b158cba747d030bd031ba9f7a56c9fc73bc802d8fe6d5719a5f56f1816454ebd

SHA512
3ac75f90beb0fda8e8ed225a82b2ee2fe859c28e4e276d835b2f70f61c8e650012179128d92914f2b9151b34009293dcde974eb6f92727ee8fa284abe9f96f78

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.SharedClasses.dll

Filesize
351KB

MD5
f1602c71d8eab5df1bdb69ea346bcc2d

SHA1
963e28a5c715f6648bd43da20a04011173a6c659

SHA256
29d0aec90c35f3ee065b052643d36b31b5f8ef9e12538fc78dfd942c0ff3fda6

SHA512
9139ec89d79aaaf34c5554697717386deb2696e13f10db52aae3ebf6caecd9dd1438f076b6d40a6fa060606249710078858a7682753430427ae2693c9599b8ab

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.Thermodynamics.AdvancedEOS.GERG2008.dll

Filesize
86KB

MD5
0875aa1cad0708385828e31502921ced

SHA1
2a3734b5d0fd90743b53e6b0125e1df8cb69f35b

SHA256
a03d9b78cb55a42ba6596c4f5630c5ef88c91735e2cc0b6f67590b97c9d9a16f

SHA512
564af0a97eeec472e2266ee4004db5098ebfbf905801b30d8d57e7d581320d9c277663a5c570386a75272f16d78ebd468e25f0e11c5fdd55e086dc34ae0bd5e4

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.Thermodynamics.AdvancedEOS.PCSAFT2.dll

Filesize
111KB

MD5
a936d50d6abed49d6c1b8f68d400b807

SHA1
88c37b32858d4bdb30e73e5250f4c056587dfa73

SHA256
8108f7254560df25f25168d0d849dfc674f76e64e05f5cc5e8f49209d895e5b0

SHA512
0d93e93e5ffa53d0092f8b5154ec830a77359488014af059588b030d9af6f91a8cfedbbbf57346f4febf24f760daa797c0b9ee8f0e38224c0d7caa9bd9f8a8c8

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.Thermodynamics.CoolPropInterface.dll

Filesize
88KB

MD5
2a660e3039e5cca89f49379cec90309d

SHA1
87a1a9b3c19bae5bcf0645fe89b219cd84b8808a

SHA256
4ef9d8100c4009026dcb07fe8a1367aa29f8ddebe7deae1b805cc9045cf63af7

SHA512
6939a13747e6ec5d65a8b1cbfc7709c43f6c643b0550d928a9cf74b2422eb9dc43f0e233e5e2b7ca0ffd13300100244415d062cd83bd18343bccb611d25ef9a3

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.Thermodynamics.dll

Filesize
18.6MB

MD5
bd1d1f2e7483fe4f0cebbf62ae5ca342

SHA1
1ba569db008f0155429deff888b7af46048590a7

SHA256
152502f2c33da3e94eceb831e78beeeed856d98f98506d6edeb485afaa7cf69d

SHA512
5604adf5e903dd98fbacf461767155b42a467575ca58b0a47001659559dea489db2d97b72dbf9de5ba63c65c10955815c9b5be4341ac6b8ff82697bc4d60881a

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.UI.Desktop.Shared.dll

Filesize
142KB

MD5
b569253d2403673fb1508e0bd9cc121a

SHA1
2a7a0d196699d73012c15e0de621d57e437cf10f

SHA256
421213ae1fd9094c7ecfa3a7c844a05e00752358deef0f2ff252ef1ba7de5c35

SHA512
cddab0cf982235abec3fd912496668285e012453ce7f0a583d3122b990fcae24bf0fe41efb49ab3ebad4ba0a82bef9e34bd32f84a41382dff1fa8b99b5e7d46b

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.UI.Desktop.WinForms.dll

Filesize
19KB

MD5
a3decc3ea6e8c3b3f539afd593e4d190

SHA1
47c23fe13b6ca396c413ef4a2f568327b95b866e

SHA256
2ef92bcd40f14f4a481ea53923a4feeb3b5c3ce73f951bd2a3b564679ade3e08

SHA512
edc516cced7ef7cd842befef2b899d2e1b59d4bb07c034bc7fe10c4129629c8de4200164557778817f8217ca8455b49f63a0c41fe713ee71b5ae0c83d0bf7636

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.UI.Desktop.exe

Filesize
104KB

MD5
b67668712f1140056649114946547508

SHA1
bbf897e76fb1cf0d902c6c8dea3a1809b45f07ae

SHA256
9c4569451b5564d19799a5f05205ccc697898346a0369da34c9d4cf18b1fc275

SHA512
9aad504c9208a831c9723d03fd5dd74af18742e89eee73c77dd8d89f8ab4276093c0e616c34f56d38230e41faba2804a3fc68a6141922ae6e884195e31a5a6d6

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.UnitOperations.dll

Filesize
6.8MB

MD5
18e66ffacdb6ae09e9eb94cc23195d70

SHA1
3b2b16f6a1ab8d5e8b8ada5be897e4b10da7b989

SHA256
cd6b5332051c64cbf973c1474adbd7dd97c4692c59c2d483704f3b5a28a1ef37

SHA512
738ed2f176a73a30c0404538c61f97177545a424dd7c499070287a728fb83d5d6d0b2ca1bd96da2be5fb8235b291fe69b8ee370d8f45a5b14dc049c2c41c0c46

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.exe

Filesize
24.2MB

MD5
ddb93d12d6707422e0ea4b3023fee155

SHA1
41bb03c4cc89c2d683f0224c16a507425bf4b8c0

SHA256
89abbff8f27feb05b51c31afd0c0c2569d432fa9644408e702a195a9b9aea16c

SHA512
ed8c5fb0246857652471764ee0b5599816f1eb9e5d491a4291f1f3d9be9da524f2c31ffd55d45cbbcc4e4290fe26e1ef51f8cd3d3abf7587a2e07ea37be0056c

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.exe

Filesize
24.2MB

MD5
ddb93d12d6707422e0ea4b3023fee155

SHA1
41bb03c4cc89c2d683f0224c16a507425bf4b8c0

SHA256
89abbff8f27feb05b51c31afd0c0c2569d432fa9644408e702a195a9b9aea16c

SHA512
ed8c5fb0246857652471764ee0b5599816f1eb9e5d491a4291f1f3d9be9da524f2c31ffd55d45cbbcc4e4290fe26e1ef51f8cd3d3abf7587a2e07ea37be0056c

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.exe

Filesize
24.2MB

MD5
ddb93d12d6707422e0ea4b3023fee155

SHA1
41bb03c4cc89c2d683f0224c16a507425bf4b8c0

SHA256
89abbff8f27feb05b51c31afd0c0c2569d432fa9644408e702a195a9b9aea16c

SHA512
ed8c5fb0246857652471764ee0b5599816f1eb9e5d491a4291f1f3d9be9da524f2c31ffd55d45cbbcc4e4290fe26e1ef51f8cd3d3abf7587a2e07ea37be0056c

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.exe.WebView2\EBWebView\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.exe.WebView2\EBWebView\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\DWSIM.exe.config

Filesize
15KB

MD5
ca5cf667e521feff43da13ddca7602f1

SHA1
2a9fd4da7fcddc1100993bcf573a617c0e8f5308

SHA256
049b2637294efaf6f2ce420b07e25c148c20db818415417c1e52eba53ae6ad85

SHA512
6a78105f848f6d569a8a1a5119ec88e855d14c7d0ce5b3b1405f0db9beb6c551555d87ef5913527cc1f01d76c05614faa5209577cde5ad352bcd8c0befcf8006

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\Eto.OxyPlot.dll

Filesize
5KB

MD5
16194722d012dd4ead2344edae422434

SHA1
6124684ee8fdd81268e81b955181016cd0136cad

SHA256
800cab4634587e46b4afe02f2d23dd7c682e68059c8f378afb6430dd9a0421e3

SHA512
e22025657e827c957726e2260a0a2cc50e573105d1b2bb894f41102d0e143294ea25b6d0dc9f1fa2a915f054b09083805136251d07ae31707aad64b24f6a5420

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\Eto.WinForms.dll

Filesize
1.1MB

MD5
d4bd58b0a7af3b404e17eb91efc7b1ef

SHA1
2d1d8d3aa77a848ebfd91491dd83fed376c5c7a2

SHA256
9cbdd8a1adba94216f975b556d90c2c1b04f18e7e8ff408f25af817df9e49f51

SHA512
806c07b357b94164c3e2e6c1ca0054c41c1d4074a358a48b2392e835eae0e2f18cf8f7df1ef27cecaf7297be5abe907b636600719562727a87b3a90f693a08ef

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\Eto.dll

Filesize
689KB

MD5
a47e51081690bb104b77ff10d0125d2c

SHA1
11951f401d161b69e206e3dfe39b1443eb9f57a2

SHA256
d4b5ab16874dbb268aaeeda9807850ac03cefb8ce18f0b8496d9a4a2b580f9a4

SHA512
a308b47679f06f497a79fc18eb476c58aee3a34c3e384af1fbaba9275b944298e8fae22c6fb5449e7e5459d3b22b2f72c31ed4c44739787dcf085ed2ed9b4adc

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\FileHelpers.dll

Filesize
204KB

MD5
847bc05daa3ccc4b3fc671bdf189c94a

SHA1
7ce1c0a78bb9f0f304586e3ddf3b0e1ff6ac686e

SHA256
e0961e3a44c278a85e94b11f25358ccfc91e3e28989cc515cc0fdc5941491179

SHA512
5361e578745db91a6f47ca95aaef1df22a2a78c7fe8a6c92bd8641e6a6132dca4f0803552ddcddfda1cae406a44a7bbcacf4eab16bd0f70b16b954884e248ba0

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\Infralution.Localization.dll

Filesize
18KB

MD5
3ea4e755a5e57a4f2c3abf2150656b50

SHA1
078167e74399646007083a6f96131327b272d76a

SHA256
6e5ea1637ff18e29f0afd0220d96276eed642822e9f68ffe1dae4baf84346a56

SHA512
ded30a7efacfe50d182dac8d668c797a9284dd286faf0cc08b531b5ee3093431c56c1725a72e9511a8dcfe6e4ccfc27770d6cd9423578dfa264bd203d8f54675

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\IronPython.Modules.dll

Filesize
782KB

MD5
7d7e5c377db293f15f18e6477f1fdf86

SHA1
5614cdf8b402a0007ade8a1f7b65c7d6f4855f9c

SHA256
3781f592a071b0164f5a80e5c646f85919ee37d8994ccaefbb8b27c4aa40e438

SHA512
29779103335ebbb7b10fe3b67d26144555aadcf5f5abafd2a0338b837a2e95e0cbac7c077d4640e36dc6ec0d5b129ad5ff700063a7bf5765e60ecfa116a830c2

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\IronPython.dll

Filesize
1.7MB

MD5
01237b52e4ab707d907441c1e98b2bc2

SHA1
8b67f28212618dcf2345d2188cb6282d0b50a8d9

SHA256
2d8129b8ecd23441b0d0c4a8a31ff3a22c70d52bfeb8b33d81f9e00015cb2cab

SHA512
c269135ccbe80c64e021646881726e85e545816c02897f0b051655b6cea4fcab76358ab12f1e0babcccd19d1676bcf63c0975a5e31bd25a79d8dfe2fd6acb044

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\Microsoft.Dynamic.dll

Filesize
827KB

MD5
8d333e6d23265bad395ed390019f4909

SHA1
babde7cdcb8299af87010c81fd5e0f1605b8f87f

SHA256
998b825a1f0d0c2ac23cf9aa21d7091f51e1818811033fdfc91091708b456199

SHA512
0db1fa2bc1049378e6b994ad600a5cbb11298da8d79960666870812fede9966e914fb4ab1e544e58f9ad71e6c98d8cb87c29ad0b73642a8ad6b43691bce6aa2a

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\Microsoft.Scripting.dll

Filesize
138KB

MD5
5c6b1ce77254f31c6ca5365d0a111e12

SHA1
c4614c71a1bdab4f6fb181b88cacc1f9d300c39a

SHA256
0deca047f5556d3fd1bb6a73654acf23b632463e8be1ed8b1157f3b5ee4186b2

SHA512
ab7eac9f477bde7d3fa4831367070fc9924f18d47a022a0b977fc0285111f6d82a6fc0937076e356f1d10526876206a008fbb81dee25623a4d45e3942139462b

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\Microsoft.WindowsAPICodePack.Shell.dll

Filesize
530KB

MD5
6d8deb7be7360761fd43ec9ddcaa0811

SHA1
b45482a37b381de2a0293b6be48c4cdef04aebff

SHA256
aa5d80cdc0da52970031309b457e3e3fd505bb1ac13fb79801d15bfbb4a700b2

SHA512
c400812dcdec40e4bce3ebfd1a3d472dbe27fb5bccd22e198f870f418c003d121135fa82e6699c581167f48393cacfc4876eb2e50f51104bcd9d322a5641f75c

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\Microsoft.WindowsAPICodePack.dll

Filesize
103KB

MD5
56e013e924822c9d02329b15b03ede73

SHA1
085dacfcd1ffa398b795d096833d16367b0d2886

SHA256
7b88388b8367f0d873d0e3b66f533869c24e346fb6f0b2c6c783f931cc9a1631

SHA512
ea0020ee32e0c7e7323f5858a462bf762f65013509012147430f0d8f665eb86f534d2491ca9f737c15bf6f995a8d3e0172537129a0dc8628cf7bf0d0f48457d1

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\Newtonsoft.Json.dll

Filesize
695KB

MD5
715a1fbee4665e99e859eda667fe8034

SHA1
e13c6e4210043c4976dcdc447ea2b32854f70cc6

SHA256
c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

SHA512
bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\Scintilla.Eto.Shared.dll

Filesize
56KB

MD5
ad89384f760b94c5a1ce94a4cfa391ae

SHA1
1c6c5441884f8bf415650f8f695098b4d3bfa576

SHA256
16fcfb70a4b57fc32ba2c21d66925d265719dc88eb445f050547eabcd5560cab

SHA512
1f85986e065e1ce4353e4f9ecf636aa0c1e4f223d18c6ed6406eac4507abf5b154d59cce380f536bf4c003d2f424802da4d990c73aed8934b156ba7701916363

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\SkiaSharp.Views.WindowsForms.dll

Filesize
17KB

MD5
2baca601894346b44fa5a7d1f73d84d1

SHA1
6c7b311e566eeb4f18db0c6abd7d3e6cc3aa133b

SHA256
a1f92dc68dfff9f7bfa29ee73c20e97375b50994c4135b9a95ffe3ff123b7422

SHA512
7bc559b184840aca6d7bff714158df57fb50c8852a5a978452b3625a9171a9a30a1e0cf11ee773c650cbdd5199e7257d61398d7457ee8a5b22aad50da96664cc

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\SkiaSharp.dll

Filesize
336KB

MD5
4ac25bbf8eea219bfd4d8ac036ece89d

SHA1
1b6d4455edc87dadc08bad2e1ab312d6a0805665

SHA256
17f9a087c10abd7dbc267f73a87f07d63ba7f8bbfd7dfcf8fddccf69c510f91a

SHA512
a39837baf155e2123834cae5a048cdc1182cbb832304063a3d357b7f89f08638582fe3ea996e71e82151254f002af22f9e5350f7a1ac1f2a3d90c0a85143ce9a

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\System.Buffers.dll

Filesize
20KB

MD5
ecdfe8ede869d2ccc6bf99981ea96400

SHA1
2f410a0396bc148ed533ad49b6415fb58dd4d641

SHA256
accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb

SHA512
5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\WeifenLuo.WinFormsUI.Docking.dll

Filesize
284KB

MD5
11cccc9c18e704756de2e56270f5a3f1

SHA1
273a726253f0f46122ed039789dbb63161be0947

SHA256
b5ecf504a54bdfc7aaeda83228f4dd6f2ea57a36d2cf1010a1b4c462bcd60128

SHA512
8c9afdf226c89694098b8e5111fa2c5066cfb7f0ffa5bbfb1b0fe2947c8d508fa2cf07f4ce5d8a4d72d9cdf263b48998bb76937b970ca79547ad1b7019dfe16e

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\addcomps\Carbon.json

Filesize
5KB

MD5
b6c0fb9b206781d35880367ee1336368

SHA1
1e36ce5cb45835c60384fdc40fc0d93169ecbd77

SHA256
d63e9466eaf690a774f836f90ad7dc46ebf341407672bcebed5d4d78ea0d3323

SHA512
d074ad62a162c47e7c5a241d670cfc8af9cce46353b1fc05c3828b27fb1920c90714f3a9c7a32d5dfbdc762ffb2e7f4cc2e1553f2a89b10b1840a7ebea530b71

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\addcomps\Casein.json

Filesize
6KB

MD5
299f28f64170e8b5befd8e8770d9ac56

SHA1
8e1feb4af9b185082735de7e8d048495b3d4b8d8

SHA256
7034ef65a1cfa8c3d63dd901d0b04ee587344b25bd2106d6faf5cdf3d9c16ecc

SHA512
dfb5f4d16dfe3b879ab0ba0a7b7a16c9aacc91bba1b8118a84ff5f52a25fc79954e5b2f9e782563344b47ebcaa67778e891c54e96a8b33c8a8a2417babf0d0aa

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\addcomps\Coal.json

Filesize
6KB

MD5
7e1195fd0353ab1a80c6cdb320b28f0f

SHA1
4f6cd34220fd3251bfea92097d0eb66c060cfe32

SHA256
a4a8208d53a0168f9e7e8912f245144f6d60be369ba173c6d6c978335c8e69e7

SHA512
f5c0462f672d69b3bc8b182ef23fd3ee8454916d36ef31847cd198f49ae5e14c4a84b71fa5ac9ecf2cf9aa5e1a2b66f7e2e47d19759b71640c714b078ceeaf14

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\addcomps\Helium-3.json

Filesize
6KB

MD5
603b99f90fd5fed5b2197e2295d09fe8

SHA1
94fcaa431b1824d3b52c51fb7b6678634af8d235

SHA256
5bcdf2f1ef4035260a9eace9b234dc2e0853b84cc055ae915bec78c217fd86d8

SHA512
75a8e518220c23403044a481d4a7f7402a0382e3dd4732f99668d362f646a320da7f5596fbd14aded903961a99f1d3c7614c56780b1f10c79ad0047c70b24b0a

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\addcomps\KOH.json

Filesize
5KB

MD5
ec9f8d1f12bc5ca0570f1081b1aea066

SHA1
c8196499a1451ceb09d8f2b6b565c8802b895708

SHA256
3a7a849f7a7e5f10bc748381c1c2f832620bd0a841ebc59843f523dec9041463

SHA512
703e83216299f74fb3243f00e585fd43712c75bdbc60f8d70d169ba753b1386386b68b42e02bf1c8e480efc2caffd1a9c71138b1d4b2bf4d830450e130d73f63

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\addcomps\Lactose.json

Filesize
5KB

MD5
415aa312f618b40535a165e2eabbc775

SHA1
d1c1f93a126082d0f7b7b0fd42e9f75d3ce5795e

SHA256
904288ea5beec6b09c2a9deabafe7544b7e1f8d5e306b7a7fe0d4ad29707ec56

SHA512
0c3d40a0697a2d2d6785eaff060c4aee4e8711021d70ec982a34d6159e1b2c692f01f2fa31a43703545877119945393ea643a7fee2baeeaba48e03aeff3ca284

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\addcomps\Mercury.json

Filesize
5KB

MD5
ff61576f4e5939c131a709260b72dc3b

SHA1
0623076c2faaca6c1847de1f2e6798b7f4ce1a3b

SHA256
ad029859c9867aabc30733e58ef6602087a79e359657d6974adc34fbd2c77792

SHA512
8cd008fb2dd5906c71d65441377bbc0eeb4da99560515f24585ac652a66e1f19055b403e2cf3f11d163aa578ebf8ef9b08e3dc995f658d4e020817c7813e3293

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\en\DWSIM.resources.dll

Filesize
1.6MB

MD5
3fc1a72a2df02317ec30b0ae1f567eba

SHA1
c9d587ce9a6c6baeb8a7a817b9853fa38170346c

SHA256
1d7b306eacfcf9c99eadfb27b9ac04532ef874b4ca52afee6672ed7ad8b22758

SHA512
37c7012bcd344534dd036d5c5b1a2868a91d7950b39bd327cc0460cf05d6d6e1a913b44c052ae4a84d726b17d359a6966276253eb113009809ba16b52e419336

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\en\DWSIM.resources.dll

Filesize
1.6MB

MD5
3fc1a72a2df02317ec30b0ae1f567eba

SHA1
c9d587ce9a6c6baeb8a7a817b9853fa38170346c

SHA256
1d7b306eacfcf9c99eadfb27b9ac04532ef874b4ca52afee6672ed7ad8b22758

SHA512
37c7012bcd344534dd036d5c5b1a2868a91d7950b39bd327cc0460cf05d6d6e1a913b44c052ae4a84d726b17d359a6966276253eb113009809ba16b52e419336

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\en\DWSIM.resources.dll

Filesize
1.6MB

MD5
3fc1a72a2df02317ec30b0ae1f567eba

SHA1
c9d587ce9a6c6baeb8a7a817b9853fa38170346c

SHA256
1d7b306eacfcf9c99eadfb27b9ac04532ef874b4ca52afee6672ed7ad8b22758

SHA512
37c7012bcd344534dd036d5c5b1a2868a91d7950b39bd327cc0460cf05d6d6e1a913b44c052ae4a84d726b17d359a6966276253eb113009809ba16b52e419336

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\extenders\AutomaticTranslation.dll

Filesize
937KB

MD5
6696873227943d1751ff994e14f167bc

SHA1
3fb3893aac6969aca355090ec14b4999b2c6d3b1

SHA256
51e3f20ec6f8d4f8e6df3da4a942f0ee731e75bbaed8c7087f3043fee630ebc3

SHA512
6a61b1ae03a5d84b4258f21866a3cf23ff339a9d6ab0cb08cbd8221088f8819dbe6d6c369b8992344eeae41ecc88fb2113930bde3eeeb0f2cd0556b028114d6a

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\extenders\DWSIM.Analytics.dll

Filesize
100KB

MD5
cc9b9cf8f54d3597efb0182efe85d30a

SHA1
ed65ed7ebf26d495235729c44ec2b57052e02540

SHA256
a31e256d3c9be0d5497a089de2d14478267bc28671bfa342e6b784f2e3fd61e1

SHA512
01aa23474b7e79a25c325f694f8e885a44a6142c63ea1a5d6ac0a8ec98c4fb2939e9e878422bcec9fd25be3ac7aed9aca54f20efd6c41a07a192f79915d0cbf5

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\libSkiaSharp.DLL

Filesize
7.2MB

MD5
c2606a96a53b6595d64832831ebeb369

SHA1
17466422aa77ede1c3ef18cb23e77de63d744ae3

SHA256
bd270e27375d27d2be055a29410f35aafd920612545676de14110d87b509b7b5

SHA512
531c245577b4becd742f12961b3ce95949574abc6baac2d916578680934c249ac60f3ea0e5061f83dcbd501212a4afea2e0982cf182ea8d48de3b004b6e8e421

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\libSkiaSharp.dll

Filesize
7.2MB

MD5
c2606a96a53b6595d64832831ebeb369

SHA1
17466422aa77ede1c3ef18cb23e77de63d744ae3

SHA256
bd270e27375d27d2be055a29410f35aafd920612545676de14110d87b509b7b5

SHA512
531c245577b4becd742f12961b3ce95949574abc6baac2d916578680934c249ac60f3ea0e5061f83dcbd501212a4afea2e0982cf182ea8d48de3b004b6e8e421

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\unitops\DWSIM.UnitOperations.NeuralNetwork.dll

Filesize
154KB

MD5
3ec9ef22d7ac0836d21ce771a2384aa8

SHA1
a968b5fa0bcd1982d35bf0dfa8d0d8b54caedee7

SHA256
4331f9a98a9a7c2e74ee0025e51f0a12f6a8c7117418034f2c060c13332177cd

SHA512
d3f2e66a5ea1b8202c3d2540e73da33af1254a5df58296eadaf3ff211bab9c7ade8db7901283fa3533b40a61891f455c84aa1dcc3a982af3ca670ebe3b24634b

Download Submit
C:\Users\Admin\AppData\Local\DWSIM\unitops\DWSIM.UnitOperations.PipeNetwork.Trial.dll

Filesize
560KB

MD5
43f5a8bb1cbe7e0a61d3c0d7fa710daf

SHA1
d538a94216da6af0875ccf639d00a9d5d7368bf6

SHA256
1231668deceea8bc7c5b6da2e30e86227807efad867823cac84a8c25948061a3

SHA512
7fc3bb8831b13f17dc4e06d5850d91062ea7a48991a257f964fae16e27ce646b080f682db82b56889f6c79bf6ad9595000f8800665b963e2c4b950edc07252d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ab50c31-fb0a-42ea-bdcd-11567ad51927.tmp

Filesize
4KB

MD5
29cb4a9b2228d6eeb9e74a02174799b3

SHA1
d87c783ba9c3b3f4edef41c58d8ef497b0a8153d

SHA256
c85eacb65261fc6f971b1614a9cc8b192c790fac51901b82f516dcab4bf4cf57

SHA512
6821b9ab8d6ed5d05dbbdb2bda7791dda9af34b47348c344a9aa86d5cd0795b5cf962aa6bed3847337ac381368aa68ba662d8fae63b3a0c2750b500c9b46595d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
9d28aada222f9e2c238a236adc315a54

SHA1
1df502b4deb40a39f6553fc7146d404efcfd7c37

SHA256
707d35999c1d41e7d5b1e4da3a70a0a4fa05a866d869217024dc4eb52f83fa0a

SHA512
a8bfc85a08540534ba3a7cc36c77caeac4fa234c4681f3700a12391169118bfe9576030a64cab2b5b3f6286b4b81008b924ba9e7f314b31f98d986a4a70a6ab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
c36bb9bca15bc9fba808677bba3928e6

SHA1
a5101402c81b37e6818487e0d6f6f157ae6bd0d1

SHA256
8f4b28d51acc1966984982deb1027127046872edfbaf8061cdbaf268979ecb68

SHA512
879112fb9b27957b84f38212f35a8aeadff49b708d0d5c5f92e7b2c1c3164ba5549bfa7967fddfaa89144e8c961044a3b492d2901b2e40514f115f6d686603f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
f61aca021b27693b4499ee675523f0a9

SHA1
94d652f674736ba88624c5f286f4243b83f1dd4b

SHA256
a5e9b864583c6eebae4a63720a9965f3a5c11b2c78b160e4d928b5d0ab15b89f

SHA512
6a404aeaa5a6347597f4a585c7e2b50cd2c5cf42c72b62278deaf8eaf7c917bc20cef707344b33f408fc8fe63b80480b45ecd5e421518a4cfa276a5b712442aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c721c16e01b77a07a1d110ed55f5a8cf

SHA1
5d4c16e6be9399056c42dcdb9e021360b59257a1

SHA256
caa193df1e52a4172376372059ee85ecb8551b7e83a92786d79eb2effb0a87a1

SHA512
3e0fb96e5bd6f96cc360a01b887c05fdf7abf107002230faf87e30b64c52620cb9d23cd3662cdb3e2466e53446410dc18bd89747f3d59a30dbe1bc927e152a82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
75f1c78606140875a63b139b86ff4193

SHA1
849d44fb2db5777d1457243291307795f8fc7d11

SHA256
da6d81310646d096df076a5b9c15785dc5b25d6d100e60dd4ad67027655102d3

SHA512
03271b2a28f68b7c74ab83a4bb95cc32390ff179ff6dd93bc2983faf2e9669e41981d0cccff84fa5bbdad50868ce7397aa8abff79f0462a0005f01f1a5c8a43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3966348bbd403f0d73c498b32b42c474

SHA1
e831a80dc7540db9afced875d230530380ec5119

SHA256
85295f1484a81c8e36f1287dbb3d8c2ff4f80a5b2dc0985b88abcf49850d7542

SHA512
75a7fe567b809507d121ecfccd5cb85d7dc8e64609f916a450345a1ba959f7535767619970de25f9474c498666ad1b08250697222d5696f7a589f663a035c41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
61e7a053b3b1416ad5003420eb587b4d

SHA1
fde8f447279a7a344d0d7e5ada22807ebf44d8a1

SHA256
c31d64729467e99446020cc27c8cdf2d89c38026ffeeaf6fc9789cda77a6c6d7

SHA512
fbbbbe46baced725f745dd53f5347b57f58bce537b477d74af736f03f84b051adf7f52163316cae0ebd7769bbe8c08e2e64ab2ec237dd786cc33e99a1b2fb908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
92eb1f54de969d9de50d34c2b96235ce

SHA1
67748312ceeed321faebdef7e593d24c6e74bd38

SHA256
0b6133e837e272ba97ec6f12e13d596f0c7dd82115d64dc7fefbc030c18cb330

SHA512
ce0591772567c6d7b359ee4bc57a28c57b395429c80d2d75d29dc1585d931e17065073343909106b6475fb0c2a0db36e45d64e951e2bc22c3f4f8e8c18514437

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\AlternativeStartMenuApplication.ini

Filesize
1KB

MD5
ea1e282beba913e8149f970113c2be89

SHA1
2a90a7a8ff657632eaa5bba90572ca8867c47c3f

SHA256
e5c263494f8c250e616f02750eb11b441c0dbf99f5b43a2a116d58cc52e899ad

SHA512
f4ee45d2c2e1db4211b5dd6879ce336293f7c4a8931c9e3907231d1ded0579cbd44cf65a346c613a19d1c0dcd6288ddcd3883c94e8b164f8016269ffdfe7ae3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\AlternativeStartMenuApplication.ini

Filesize
1KB

MD5
85dc592846bce061357825fda021a4b7

SHA1
5264670bdbdcb9c155c33aeea93883186dcf70ab

SHA256
1fcd9cc713b11bd0e15af3662781fc4ca178e091681a12eadb042c37f5a10158

SHA512
10ad064a0f1824f45746904af2a2c104ffd7ba8e538f0707651e72185a5c5e2220e2fc4786b3f54b02405b6ce14aec947685742517f996805f9dae2cf7de3728

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\AlternativeStartMenuApplication.ini

Filesize
1KB

MD5
dc6aa9f3ad374419d0dfd10287112fbc

SHA1
75a6c17a8f63fb5e3a9f0e97daebc7713243b3b7

SHA256
1664fe613e83db77b059750e8db07fd9ea0d99433f47f8357ed87bc71144659d

SHA512
ee60c807874c34743f8f37894ff127b9814dbe13adcafb68654a09f2e8a83f34eac6b87b4fdb8d7a639d5ef3c0f32cd986f826a084e402ec5cdcf01ee8f3636b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\DumpLog.dll

Filesize
3KB

MD5
d444d73c66298580938e2f92b1790386

SHA1
639d06d607879daef717aa059b17a8886ff9a220

SHA256
cda786ccedeff0a982f78fe6a225251dd4c35062069b0a9bd1a2ff6406f787a4

SHA512
8c65fd4f4b2c1230276e763b7da65ded80bb2f90664f8aebccf74922e19ebadf9c92a6f3fa8f9df4f2bf445208fe160814fa99bef60b667a5aba24d19ebd650f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\DumpLog.dll

Filesize
3KB

MD5
d444d73c66298580938e2f92b1790386

SHA1
639d06d607879daef717aa059b17a8886ff9a220

SHA256
cda786ccedeff0a982f78fe6a225251dd4c35062069b0a9bd1a2ff6406f787a4

SHA512
8c65fd4f4b2c1230276e763b7da65ded80bb2f90664f8aebccf74922e19ebadf9c92a6f3fa8f9df4f2bf445208fe160814fa99bef60b667a5aba24d19ebd650f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\DumpLog.dll

Filesize
3KB

MD5
d444d73c66298580938e2f92b1790386

SHA1
639d06d607879daef717aa059b17a8886ff9a220

SHA256
cda786ccedeff0a982f78fe6a225251dd4c35062069b0a9bd1a2ff6406f787a4

SHA512
8c65fd4f4b2c1230276e763b7da65ded80bb2f90664f8aebccf74922e19ebadf9c92a6f3fa8f9df4f2bf445208fe160814fa99bef60b667a5aba24d19ebd650f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\Header.bmp

Filesize
2KB

MD5
2f9528b7172999a0ae4a56324bf7a7b6

SHA1
455de822d8318ee8f1e278411ee778d5798bc210

SHA256
1fa4ddb7c3b135a9ff2698fb2df2af2cc3d8795a409553687b4eb583d139d0a0

SHA512
eba619fd4faaac27bd67123005338d4155bdbcff09e0c5ef1d71c0d6a642aec10e0abcda947098007c6b249a9b2beb04ce1a7c3279b17075586c30646041e570

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\InstallOptions.dll

Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\InstallOptions.dll

Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\InstallOptions.dll

Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\LangDLL.dll

Filesize
5KB

MD5
109b201717ab5ef9b5628a9f3efef36f

SHA1
98db1f0cc5f110438a02015b722778af84d50ea7

SHA256
20e642707ef82852bcf153254cb94b629b93ee89a8e8a03f838eef6cbb493319

SHA512
174e241863294c12d0705c9d2de92f177eb8f3d91125b183d8d4899c89b9a202a4c7a81e0a541029a4e52513eee98029196a4c3b8663b479e69116347e5de5b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\Registry.ini

Filesize
161B

MD5
6d7a343b9ebe454cb1c7ef613b3029f3

SHA1
59686daff56b5fb4c912cec569d08ccd417ebb02

SHA256
9439f5ee5d25331e652caa696938f40e8b046b6f3e3092212489b14a3e36663f

SHA512
d063d0690bf18d17b4b1c567a719f797c32e83bbb9198f500425f74c0f5a414940064afcc7b215c29365d82f0a718faeb57ad7f876338c71a55448757168c3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\SkinnedControls.dll

Filesize
78KB

MD5
e99ccb5d7c703f4f2c646dc5ab7729b9

SHA1
3822691b5db44138a8a77d913bc5bee9d6fe1e08

SHA256
6b12c941a9154f3cede11e7ea9e2395e36df27549551cf0f4597cfce26057340

SHA512
1e1ab42193d35524917c4c658e63e6eb1d36a10c88c13fc683e1c85205d2d2005e71ecb41666bb7ed2f4d04815afc56c9ecafa2a3328b4635d8390668498f0d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\SkinnedControls.dll

Filesize
78KB

MD5
e99ccb5d7c703f4f2c646dc5ab7729b9

SHA1
3822691b5db44138a8a77d913bc5bee9d6fe1e08

SHA256
6b12c941a9154f3cede11e7ea9e2395e36df27549551cf0f4597cfce26057340

SHA512
1e1ab42193d35524917c4c658e63e6eb1d36a10c88c13fc683e1c85205d2d2005e71ecb41666bb7ed2f4d04815afc56c9ecafa2a3328b4635d8390668498f0d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\System.dll

Filesize
12KB

MD5
8cf2ac271d7679b1d68eefc1ae0c5618

SHA1
7cc1caaa747ee16dc894a600a4256f64fa65a9b8

SHA256
6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

SHA512
ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\ioSpecial.ini

Filesize
1KB

MD5
54ebaba89a07a20c914ab7f495f68537

SHA1
3db9c061a2793aaffbf21ebf3fddac4296065c91

SHA256
8e0330bafc30b205872af1e5626bc9176fffd7fd24b2c8b564589dd867659f22

SHA512
6b4184f5a62a45b8868ac96691c95f6f06d92dc1bf888afe0d0093d5a693a2f400e521741256c9061a515fcbefe35f69f2e802fc9c0d87aea2772f512cb502ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\ioSpecial.ini

Filesize
1KB

MD5
68444955a23e332a1effe360e54969f1

SHA1
6cbd426a18507d22105a03342141aa10194e2ca3

SHA256
63348b15fed7201b310379c0ae5736c893c85d8462979e05c1c12c4a3724c689

SHA512
2b6ebb06865df913feedf6117e76c69150352ea466585ef42ec9339aaebc0f4932a07b8e5297cf6d3bee0fb3cb693f9c64b2e7c4680ba6dd739a910a30021ed2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\ioSpecial.ini

Filesize
968B

MD5
ee32f7ffcc8a9d9e235d08194b294be1

SHA1
821041e3531d917942cf4856103fbbf7ce23e32a

SHA256
72b6b4620195d0bf6c8e96123136eef9888ca945cfccfa62632619c3560d3715

SHA512
52cf8f3596b5aa3247d7a0d5356d9b4c5021839ad19d31f98ffd7be3379d74007b1dc1f77bb929fd8d302cc21bbfc9c3fedf8b9e5a98abfd1a69c6403a4ff43d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\ioSpecial.ini

Filesize
1KB

MD5
314da7c27f786368c6b66c70d8fcabe8

SHA1
2b25310aa807e1a2c225afe8d160d9af97abe3de

SHA256
a5ca2c61c24657b79308f1fda1ba019dd4ab9cde47103b4502889d2a461654ed

SHA512
ef7349c319d3c8dcce26018545c28a141b57c32e4bc1eb2b9356c13f6d58e3f09afd3b7ae7117ff47bd4701103fb69908cfeb58dfc9b82f420597955fad81547

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\ioSpecial.ini

Filesize
1KB

MD5
893ec79702b0b75a2f6f3a04c38fec27

SHA1
fb1d68808b8366263d0fa4f722d1c2f3ac388cdf

SHA256
20dde2411676964f409c539c42c5083dcb26f4677ace46aa155f35332411f298

SHA512
ccaa9fc1b8681065fdfa3bf09e47b82f447965e191852f5ae3726b3e4059275dbdafb7ce883880eb8b6809a4cbbdd1c3d54cdf5b48193e2d23560be36fba53e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\ioSpecial.ini

Filesize
1KB

MD5
893ec79702b0b75a2f6f3a04c38fec27

SHA1
fb1d68808b8366263d0fa4f722d1c2f3ac388cdf

SHA256
20dde2411676964f409c539c42c5083dcb26f4677ace46aa155f35332411f298

SHA512
ccaa9fc1b8681065fdfa3bf09e47b82f447965e191852f5ae3726b3e4059275dbdafb7ce883880eb8b6809a4cbbdd1c3d54cdf5b48193e2d23560be36fba53e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaA1A5.tmp\nsArray.dll

Filesize
12KB

MD5
da4bc09439ed21faf7620a53433aac92

SHA1
94e3347aebe16cb88b9f29f00134d9e0fb67e508

SHA256
216d68d3f0b37bb2203b3a438a84a089e8c388608f46377ad7e7d6a2709cf9b0

SHA512
920294456e8fee0c4137e4b4ba1389f09ade297d6ed49d78a9593d129dbb5eb048da2cbff7ac29687999991d5f38657cb31af73e2ccf6b8b9ce29480d4d81ec6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
3d4dddffba75174a4075d13e4a17f70f

SHA1
2a39eb6531ee08c98cbeae97f452d8feff11ddf4

SHA256
d8629da2ab0416bad86accc8159da73ce6adf636d2758758d7efa339824fc57f

SHA512
90dabdf896fa87cdc1c0742f3992d6be821e379df52f6b49f5ad7e2ac77e432c0af28b6303d3c704f8046b05dcbc41d841b96aa9477aa6cfe2656e1469f98c2a

Download Submit
memory/2304-3230-0x000001A500430000-0x000001A5004C2000-memory.dmp

Filesize
584KB

Download
memory/2304-3233-0x000001A5054C0000-0x000001A50841A000-memory.dmp

Filesize
47.4MB

Download
memory/2304-3234-0x000001A4FAE50000-0x000001A4FAE60000-memory.dmp

Filesize
64KB

Download
memory/2304-3235-0x000001A4FAE50000-0x000001A4FAE60000-memory.dmp

Filesize
64KB

Download
memory/2304-3236-0x000001A4FAE50000-0x000001A4FAE60000-memory.dmp

Filesize
64KB

Download
memory/2304-3240-0x000001A4FE3E0000-0x000001A4FE3E8000-memory.dmp

Filesize
32KB

Download
memory/2304-3231-0x000001A4FE3D0000-0x000001A4FE3D8000-memory.dmp

Filesize
32KB

Download
memory/2304-3169-0x000001A4FBBA0000-0x000001A4FBD34000-memory.dmp

Filesize
1.6MB

Download
memory/2304-3238-0x000001A5001C0000-0x000001A500218000-memory.dmp

Filesize
352KB

Download
memory/2304-3228-0x000001A4FFF50000-0x000001A4FFF9E000-memory.dmp

Filesize
312KB

Download
memory/2304-3226-0x000001A4FE7F0000-0x000001A4FE81C000-memory.dmp

Filesize
176KB

Download
memory/2304-3224-0x000001A4FE480000-0x000001A4FE4A0000-memory.dmp

Filesize
128KB

Download
memory/2304-3244-0x000001A4FE4A0000-0x000001A4FE4AA000-memory.dmp

Filesize
40KB

Download
memory/2304-3245-0x000001A4FE4B0000-0x000001A4FE4B8000-memory.dmp

Filesize
32KB

Download
memory/2304-3222-0x000001A5000D0000-0x000001A5001C0000-memory.dmp

Filesize
960KB

Download
memory/2304-3247-0x000001A4FE4C0000-0x000001A4FE4CC000-memory.dmp

Filesize
48KB

Download
memory/2304-3249-0x000001A4FE820000-0x000001A4FE828000-memory.dmp

Filesize
32KB

Download
memory/2304-3220-0x000001A4FE3C0000-0x000001A4FE3C8000-memory.dmp

Filesize
32KB

Download
memory/2304-3251-0x000001A4FFFA0000-0x000001A4FFFCC000-memory.dmp

Filesize
176KB

Download
memory/2304-3218-0x000001A4FE7B0000-0x000001A4FE7EA000-memory.dmp

Filesize
232KB

Download
memory/2304-3214-0x000001A4FE460000-0x000001A4FE47C000-memory.dmp

Filesize
112KB

Download
memory/2304-3212-0x000001A4FE430000-0x000001A4FE452000-memory.dmp

Filesize
136KB

Download
memory/2304-3255-0x000001A500860000-0x000001A500A22000-memory.dmp

Filesize
1.8MB

Download
memory/2304-3210-0x000001A4FE410000-0x000001A4FE42C000-memory.dmp

Filesize
112KB

Download
memory/2304-3253-0x000001A5005B0000-0x000001A500686000-memory.dmp

Filesize
856KB

Download
memory/2304-3257-0x000001A4FFFD0000-0x000001A4FFFFA000-memory.dmp

Filesize
168KB

Download
memory/2304-3258-0x000001A500390000-0x000001A5003B2000-memory.dmp

Filesize
136KB

Download
memory/2304-3208-0x000001A4FE3B0000-0x000001A4FE3BA000-memory.dmp

Filesize
40KB

Download
memory/2304-3260-0x000001A500690000-0x000001A50075A000-memory.dmp

Filesize
808KB

Download
memory/2304-3206-0x000001A500A70000-0x000001A501148000-memory.dmp

Filesize
6.8MB

Download
memory/2304-3262-0x000001A4FFF20000-0x000001A4FFF3A000-memory.dmp

Filesize
104KB

Download
memory/2304-3204-0x000001A500230000-0x000001A500388000-memory.dmp

Filesize
1.3MB

Download
memory/2304-3264-0x000001A500760000-0x000001A500812000-memory.dmp

Filesize
712KB

Download
memory/2304-3202-0x000001A4FE3A0000-0x000001A4FE3A8000-memory.dmp

Filesize
32KB

Download
memory/2304-3201-0x000001A4FE2D0000-0x000001A4FE2D8000-memory.dmp

Filesize
32KB

Download
memory/2304-3200-0x000001A4FE290000-0x000001A4FE298000-memory.dmp

Filesize
32KB

Download
memory/2304-3199-0x000001A4FE280000-0x000001A4FE288000-memory.dmp

Filesize
32KB

Download
memory/2304-3198-0x000001A4FE270000-0x000001A4FE278000-memory.dmp

Filesize
32KB

Download
memory/2304-3197-0x000001A4FE240000-0x000001A4FE248000-memory.dmp

Filesize
32KB

Download
memory/2304-3194-0x000001A4FE720000-0x000001A4FE7AA000-memory.dmp

Filesize
552KB

Download
memory/2304-3272-0x000001A5003C0000-0x000001A5003D2000-memory.dmp

Filesize
72KB

Download
memory/2304-3273-0x000001A4FE550000-0x000001A4FE5CE000-memory.dmp

Filesize
504KB

Download
memory/2304-3274-0x000001A4FF4A0000-0x000001A4FFD8E000-memory.dmp

Filesize
8.9MB

Download
memory/2304-3275-0x000001A4FE500000-0x000001A4FE52E000-memory.dmp

Filesize
184KB

Download
memory/2304-3276-0x000001A4FAE50000-0x000001A4FAE60000-memory.dmp

Filesize
64KB

Download
memory/2304-3196-0x000001A4FE3F0000-0x000001A4FE410000-memory.dmp

Filesize
128KB

Download
memory/2304-3192-0x000001A4FE220000-0x000001A4FE228000-memory.dmp

Filesize
32KB

Download
memory/2304-3191-0x000001A4FD6C0000-0x000001A4FD6C8000-memory.dmp

Filesize
32KB

Download
memory/2304-3190-0x000001A4FE230000-0x000001A4FE238000-memory.dmp

Filesize
32KB

Download
memory/2304-3188-0x000001A4FE2A0000-0x000001A4FE2CA000-memory.dmp

Filesize
168KB

Download
memory/2304-3186-0x000001A4FE250000-0x000001A4FE264000-memory.dmp

Filesize
80KB

Download
memory/2304-3183-0x000001A5012B0000-0x000001A502558000-memory.dmp

Filesize
18.7MB

Download
memory/2304-3184-0x000001A4FAE50000-0x000001A4FAE60000-memory.dmp

Filesize
64KB

Download
memory/2304-3182-0x000001A4FAE50000-0x000001A4FAE60000-memory.dmp

Filesize
64KB

Download
memory/2304-3180-0x000001A4FE840000-0x000001A4FEBA4000-memory.dmp

Filesize
3.4MB

Download
memory/2304-3160-0x000001A4DEF40000-0x000001A4E076C000-memory.dmp

Filesize
24.2MB

Download
memory/2304-3178-0x000001A4FD6A0000-0x000001A4FD6AA000-memory.dmp

Filesize
40KB

Download
memory/2304-3177-0x000001A4FE2E0000-0x000001A4FE392000-memory.dmp

Filesize
712KB

Download
memory/2304-3162-0x000001A4E0B00000-0x000001A4E0B24000-memory.dmp

Filesize
144KB

Download
memory/2304-3175-0x000001A4FD6D0000-0x000001A4FD7FA000-memory.dmp

Filesize
1.2MB

Download
memory/2304-3164-0x000001A4FAC80000-0x000001A4FACDE000-memory.dmp

Filesize
376KB

Download
memory/2304-3173-0x000001A4FAC30000-0x000001A4FAC3E000-memory.dmp

Filesize
56KB

Download
memory/2304-3171-0x000001A4FAC50000-0x000001A4FAC60000-memory.dmp

Filesize
64KB

Download
memory/2304-3168-0x000001A4FAE50000-0x000001A4FAE60000-memory.dmp

Filesize
64KB

Download