laplas | hxxps://www[.]dropbox[.]com/s/zj7cz5633tszjk3/Zafiro%20EA%20MFF%20v1[.]13%20%2B%20Zafiro%20EA%20FTMO%20v1[.]13[.]zip?dl=0

max time kernel
1273s
max time network
1275s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/s/zj7cz5633tszjk3/Zafiro%20EA%20MFF%20v1.13%20%2B%20Zafiro%20EA%20FTMO%20v1.13.zip?dl=0

Score

10^/10

laplas vidar 2ca19830ec2c67b5159166c89d3ebb74 clipper evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

vidar

Version

4.2

Botnet

2ca19830ec2c67b5159166c89d3ebb74

https://steamcommunity.com/profiles/76561199511129510

https://t.me/rechnungsbetrag

Attributes

profile_id_v2
2ca19830ec2c67b5159166c89d3ebb74
user_agent
Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.38 Safari/537.36 Brave/75

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 64 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	96397003725469722039.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	70490693168840115018.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	40231976446048932722.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	49974781107078756244.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	90953893327623055593.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	52191993576975174860.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	21802068079814273531.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	23256957690728622983.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	94792877996711980387.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	06668756520210963848.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	90275318321210826780.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	54918907271654412332.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	71164097721512983704.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	57975750799022750290.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	01514670011694438115.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	93199444704720860194.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	00733238150305510111.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	05633075718535705647.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	49722106109436362705.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	23786436365077715293.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	86956515634634609739.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	15027243444047203425.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	32386923193331596869.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	85831403041983725724.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	45912943173067826847.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	74419892851039774874.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	26971369059021056367.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	08693649255020882360.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	27485460089383862762.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	12779777337561308945.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	55641516514796094424.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	69035610574568521750.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	78704048999844758267.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	08099088409272374484.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	32784540446125725766.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	43744539668854071335.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	62327602442079723741.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	29885372049848912746.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	16340814663215872594.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	80254554185315896060.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	33825815830965168799.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	69027303181175982400.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	93381060267145809911.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	87387650849752683451.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	54035168089423291922.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	60358444529242508500.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	93307365291759943307.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	35414049091555356459.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	45242370924579140626.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	44820727013929330046.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	71935380007017903308.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	25633241967701742174.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	32714823431651688436.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	05664736998866041401.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	83507624342350235547.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	05100985440924939647.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	43343208101030285309.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	60018601089721596320.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	46577176054008839986.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	60270046678587013467.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	94406042477519412300.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	83045998015958193081.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	10618480403867832825.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	61745936040076357336.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 64 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	33575495047299268577.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	24397562068379534428.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	28114763263727411317.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	54035168089423291922.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	96397003725469722039.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	60081052075665025951.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	35414049091555356459.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	32784540446125725766.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	32784540446125725766.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	16722648934186728240.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	27485460089383862762.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	45988478798048613874.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	72595661096465205806.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	05100985440924939647.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	33575495047299268577.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	78704048999844758267.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	08693649255020882360.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	41491672023137460967.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	00733238150305510111.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	40231976446048932722.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	86956515634634609739.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	69035610574568521750.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	93381060267145809911.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	45242370924579140626.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	76174249893566756782.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	63531001972844714257.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	29885372049848912746.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	27900334405235222323.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	59347606635519449511.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	57520020547616514020.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	57975750799022750290.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	45363068273009078093.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	55641516514796094424.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	60270046678587013467.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	23786436365077715293.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	16835618224319599351.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	37866410239435373988.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	27485460089383862762.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	05100985440924939647.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	33825815830965168799.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	43343208101030285309.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	32386923193331596869.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	08099088409272374484.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	74419892851039774874.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	23256957690728622983.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	62327602442079723741.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	85831403041983725724.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	61745936040076357336.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	72595661096465205806.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	36447953403392297318.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	06668756520210963848.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	62327602442079723741.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	44880019851228985898.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	96637589901206791031.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	32714823431651688436.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	77780390688708745405.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	08099088409272374484.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	61745936040076357336.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	36611911650940266469.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	44820727013929330046.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	70490693168840115018.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	00997715248133819781.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	27471693678320656100.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	24521051275525214662.exe

Executes dropped EXE 64 IoCs

pid	Process
2028	43744539668854071335.exe
2612	77780390688708745405.exe
5112	ntlhost.exe
3736	69027303181175982400.exe
4916	70490693168840115018.exe
2736	61745936040076357336.exe
2676	93307365291759943307.exe
3424	24521051275525214662.exe
3168	71164097721512983704.exe
868	00192089646508923131.exe
4416	08099088409272374484.exe
4212	60607504249152517974.exe
5040	60270046678587013467.exe
4856	36611911650940266469.exe
3232	27485460089383862762.exe
3248	45912943173067826847.exe
2732	02399417128809071020.exe
1604	44880019851228985898.exe
4972	73926327360738358197.exe
3432	06668756520210963848.exe
3144	79631773788919618265.exe
2528	90416757990881948111.exe
836	23786436365077715293.exe
1048	62327602442079723741.exe
1716	12779777337561308945.exe
1896	32608880621484482523.exe
1760	94406042477519412300.exe
2024	60081052075665025951.exe
3888	36447953403392297318.exe
2988	82775836866882202403.exe
3948	35414049091555356459.exe
2344	74419892851039774874.exe
1080	05664736998866041401.exe
636	27900334405235222323.exe
4188	59347606635519449511.exe
4460	60791675785475731346.exe
5048	05100985440924939647.exe
1764	57520020547616514020.exe
5008	90275318321210826780.exe
1564	24397562068379534428.exe
4044	83507624342350235547.exe
4116	63531001972844714257.exe
2736	29885372049848912746.exe
4544	57975750799022750290.exe
2756	45363068273009078093.exe
4696	32784540446125725766.exe
3880	28114763263727411317.exe
3908	85831403041983725724.exe
3252	83045998015958193081.exe
3880	55641516514796094424.exe
1876	93381060267145809911.exe
2688	05633075718535705647.exe
4912	10618480403867832825.exe
1536	71935380007017903308.exe
4788	79859115797054584571.exe
3928	60018601089721596320.exe
2528	40231976446048932722.exe
1136	33575495047299268577.exe
1156	86719532028175739560.exe
3508	49722106109436362705.exe
1128	86956515634634609739.exe
2296	52191993576975174860.exe
2088	45242370924579140626.exe
3216	01514670011694438115.exe

Loads dropped DLL 64 IoCs

pid	Process
3480	zalupa.dll
3480	zalupa.dll
3592	zalupa.dll
3592	zalupa.dll
3248	zalupa.dll
3248	zalupa.dll
4792	zalupa.dll
4792	zalupa.dll
3848	zalupa.dll
3848	zalupa.dll
3540	zalupa.dll
3540	zalupa.dll
1860	zalupa.dll
1860	zalupa.dll
2640	zalupa.dll
2640	zalupa.dll
4716	zalupa.dll
4716	zalupa.dll
5052	zalupa.dll
5052	zalupa.dll
2188	zalupa.dll
2188	zalupa.dll
324	zalupa.dll
324	zalupa.dll
3216	zalupa.dll
3216	zalupa.dll
2316	zalupa.dll
2316	zalupa.dll
2912	zalupa.dll
2912	zalupa.dll
1664	zalupa.dll
1664	zalupa.dll
3988	zalupa.dll
3988	zalupa.dll
2860	zalupa.dll
2860	zalupa.dll
3556	zalupa.dll
3556	zalupa.dll
2760	zalupa.dll
2760	zalupa.dll
3724	zalupa.dll
3724	zalupa.dll
1896	zalupa.dll
1896	zalupa.dll
3252	zalupa.dll
3252	zalupa.dll
3224	zalupa.dll
3224	zalupa.dll
4784	zalupa.dll
4784	zalupa.dll
3944	zalupa.dll
3944	zalupa.dll
5008	zalupa.dll
5008	zalupa.dll
1504	zalupa.dll
1504	zalupa.dll
5060	zalupa.dll
5060	zalupa.dll
3492	zalupa.dll
3492	zalupa.dll
4192	zalupa.dll
4192	zalupa.dll
3488	zalupa.dll
3488	zalupa.dll

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	43744539668854071335.exe

Checks whether UAC is enabled 1 TTPs 64 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	32714823431651688436.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	16340814663215872594.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	57520020547616514020.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	21802068079814273531.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	24521051275525214662.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	28114763263727411317.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	33825815830965168799.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	90953893327623055593.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	02399417128809071020.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	45988478798048613874.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	49974781107078756244.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	93381060267145809911.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	46577176054008839986.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	49722106109436362705.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	43343208101030285309.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	27485460089383862762.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	45363068273009078093.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	60358444529242508500.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	79204440492179272198.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	57975750799022750290.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	15027243444047203425.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	62327602442079723741.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	36447953403392297318.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	40231976446048932722.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	00997715248133819781.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	54918907271654412332.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	69027303181175982400.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	73926327360738358197.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	23786436365077715293.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	94406042477519412300.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	94792877996711980387.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	77780390688708745405.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	90416757990881948111.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	62322517006975932537.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	06668756520210963848.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	75723800898303319061.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	71164097721512983704.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	05100985440924939647.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	29885372049848912746.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	22894690672431244214.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	16835618224319599351.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	61745936040076357336.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	44880019851228985898.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	82775836866882202403.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	59347606635519449511.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	32608880621484482523.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	41491672023137460967.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	54035168089423291922.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	45912943173067826847.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	25633241967701742174.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	44820727013929330046.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	60018601089721596320.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	76174249893566756782.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	08693649255020882360.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	60791675785475731346.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	83507624342350235547.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	26971369059021056367.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	93307365291759943307.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	12779777337561308945.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	35414049091555356459.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	90275318321210826780.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	16722648934186728240.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	78704048999844758267.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	05664736998866041401.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
2028	43744539668854071335.exe
2612	77780390688708745405.exe
5112	ntlhost.exe
3736	69027303181175982400.exe
4916	70490693168840115018.exe
2736	61745936040076357336.exe
2676	93307365291759943307.exe
3424	24521051275525214662.exe
3168	71164097721512983704.exe
868	00192089646508923131.exe
4212	60607504249152517974.exe
5040	60270046678587013467.exe
4856	36611911650940266469.exe
3232	27485460089383862762.exe
3248	45912943173067826847.exe
2732	02399417128809071020.exe
1604	44880019851228985898.exe
4972	73926327360738358197.exe
3432	06668756520210963848.exe
3144	79631773788919618265.exe
2528	90416757990881948111.exe
836	23786436365077715293.exe
1048	62327602442079723741.exe
1716	12779777337561308945.exe
1896	32608880621484482523.exe
1760	94406042477519412300.exe
2024	60081052075665025951.exe
3888	36447953403392297318.exe
2988	82775836866882202403.exe
3948	35414049091555356459.exe
2344	74419892851039774874.exe
1080	05664736998866041401.exe
636	27900334405235222323.exe
4188	59347606635519449511.exe
4460	60791675785475731346.exe
5048	05100985440924939647.exe
1764	57520020547616514020.exe
5008	90275318321210826780.exe
1564	24397562068379534428.exe
4044	83507624342350235547.exe
4116	63531001972844714257.exe
2736	29885372049848912746.exe
4544	57975750799022750290.exe
2756	45363068273009078093.exe
4696	32784540446125725766.exe
3880	28114763263727411317.exe
3908	85831403041983725724.exe
3252	83045998015958193081.exe
3880	55641516514796094424.exe
1876	93381060267145809911.exe
2688	05633075718535705647.exe
4912	10618480403867832825.exe
1536	71935380007017903308.exe
4788	79859115797054584571.exe
3928	60018601089721596320.exe
2528	40231976446048932722.exe
1136	33575495047299268577.exe
1156	86719532028175739560.exe
3508	49722106109436362705.exe
1128	86956515634634609739.exe
2296	52191993576975174860.exe
2088	45242370924579140626.exe
3216	01514670011694438115.exe
2532	25633241967701742174.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\fb0779b1-5d1c-43e9-bc62-af539199b6ca.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230608095241.pma	setup.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
988	3944	WerFault.exe	195
5088	1504	WerFault.exe	202
4872	4828	WerFault.exe	216
1108	4724	WerFault.exe	349
780	380	WerFault.exe	340
4568	3396	WerFault.exe	360

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zalupa.dll
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zalupa.dll

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	142	Go-http-client/1.1

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1529757233-3489015626-3409890339-1000\{A5065278-BFEB-4BC8-B852-BD61830C7C73}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2000	NOTEPAD.EXE
3920	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4088	powershell.exe
4088	powershell.exe
4412	msedge.exe
4412	msedge.exe
4340	msedge.exe
4340	msedge.exe
3304	msedge.exe
3304	msedge.exe
4772	msedge.exe
2928	msedge.exe
2928	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
4816	identity_helper.exe
4816	identity_helper.exe
3480	zalupa.dll
3480	zalupa.dll
3592	zalupa.dll
3592	zalupa.dll
3248	zalupa.dll
3248	zalupa.dll
4792	zalupa.dll
4792	zalupa.dll
3848	zalupa.dll
3848	zalupa.dll
3540	zalupa.dll
3540	zalupa.dll
1860	zalupa.dll
1860	zalupa.dll
2640	zalupa.dll
2640	zalupa.dll
4716	zalupa.dll
4716	zalupa.dll
5052	zalupa.dll
5052	zalupa.dll
2188	zalupa.dll
2188	zalupa.dll
324	zalupa.dll
324	zalupa.dll
3216	zalupa.dll
3216	zalupa.dll
2316	zalupa.dll
2316	zalupa.dll
2912	zalupa.dll
2912	zalupa.dll
1664	zalupa.dll
1664	zalupa.dll
3988	zalupa.dll
3988	zalupa.dll
2860	zalupa.dll
2860	zalupa.dll
3556	zalupa.dll
3556	zalupa.dll
2760	zalupa.dll
2760	zalupa.dll
3724	zalupa.dll
3724	zalupa.dll
1896	zalupa.dll
1896	zalupa.dll
3252	zalupa.dll
3252	zalupa.dll
3224	zalupa.dll

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	powershell.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4368	4340	msedge.exe	85
PID 4340 wrote to memory of 4368	4340	msedge.exe	85
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 1512	4340	msedge.exe	86
PID 4340 wrote to memory of 4412	4340	msedge.exe	87
PID 4340 wrote to memory of 4412	4340	msedge.exe	87
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88
PID 4340 wrote to memory of 3484	4340	msedge.exe	88

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://www.dropbox.com/s/zj7cz5633tszjk3/Zafiro%20EA%20MFF%20v1.13%20%2B%20Zafiro%20EA%20FTMO%20v1.13.zip?dl=0
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://www.dropbox.com/s/zj7cz5633tszjk3/Zafiro%20EA%20MFF%20v1.13%20%2B%20Zafiro%20EA%20FTMO%20v1.13.zip?dl=0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc4bd146f8,0x7ffc4bd14708,0x7ffc4bd14718
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6556 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6cdde5460,0x7ff6cdde5470,0x7ff6cdde5480
    3⤵
    PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2548 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12841906839772037979,6734313313243319990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\runs.cmd
1⤵
- Opens file in notepad (likely ransom note)
PID:2000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4700

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\runs.cmd
1⤵
- Opens file in notepad (likely ransom note)
PID:3920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\runs.cmd"
1⤵
PID:3640
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- - C:\ProgramData\43744539668854071335.exe
    "C:\ProgramData\43744539668854071335.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2028
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:5112
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3248
- - C:\ProgramData\69027303181175982400.exe
    "C:\ProgramData\69027303181175982400.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3736
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- - C:\ProgramData\61745936040076357336.exe
    "C:\ProgramData\61745936040076357336.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2736
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:908
- - C:\ProgramData\01514670011694438115.exe
    "C:\ProgramData\01514670011694438115.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3216
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:372
- - C:\ProgramData\25633241967701742174.exe
    "C:\ProgramData\25633241967701742174.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2532
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:5048
- - C:\ProgramData\22894690672431244214.exe
    "C:\ProgramData\22894690672431244214.exe"
    3⤵
    - Checks whether UAC is enabled
    PID:1548
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:3304
- - C:\ProgramData\87387650849752683451.exe
    "C:\ProgramData\87387650849752683451.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:4212
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:1876
- - C:\ProgramData\80254554185315896060.exe
    "C:\ProgramData\80254554185315896060.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:652
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:3576
- - C:\ProgramData\15027243444047203425.exe
    "C:\ProgramData\15027243444047203425.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks whether UAC is enabled
    PID:1536
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4876
- - C:\ProgramData\16835618224319599351.exe
    "C:\ProgramData\16835618224319599351.exe"
    3⤵
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:1500
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4744
- - C:\ProgramData\16340814663215872594.exe
    "C:\ProgramData\16340814663215872594.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks whether UAC is enabled
    PID:4640
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:2084
- - C:\ProgramData\41491672023137460967.exe
    "C:\ProgramData\41491672023137460967.exe"
    3⤵
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:3984
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:992
- - C:\ProgramData\45988478798048613874.exe
    "C:\ProgramData\45988478798048613874.exe"
    3⤵
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:3888
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4456
- - C:\ProgramData\49974781107078756244.exe
    "C:\ProgramData\49974781107078756244.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks whether UAC is enabled
    PID:3804
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4460
- - C:\ProgramData\46577176054008839986.exe
    "C:\ProgramData\46577176054008839986.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks whether UAC is enabled
    PID:436
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:3680
- - C:\ProgramData\23256957690728622983.exe
    "C:\ProgramData\23256957690728622983.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    PID:4724
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 1588
    3⤵
    - Program crash
    PID:780
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:3396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 1568
    3⤵
    - Program crash
    PID:4568
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:4496
- - C:\ProgramData\44820727013929330046.exe
    "C:\ProgramData\44820727013929330046.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:1368
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4116
- - C:\ProgramData\08693649255020882360.exe
    "C:\ProgramData\08693649255020882360.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:1616
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:4752
- - C:\ProgramData\37866410239435373988.exe
    "C:\ProgramData\37866410239435373988.exe"
    3⤵
    - Checks BIOS information in registry
    PID:1744
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:680
- - C:\ProgramData\27471693678320656100.exe
    "C:\ProgramData\27471693678320656100.exe"
    3⤵
    - Checks BIOS information in registry
    PID:3792
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:3244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\runs.cmd" "
1⤵
PID:4852
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- - C:\ProgramData\77780390688708745405.exe
    "C:\ProgramData\77780390688708745405.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2612
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- - C:\ProgramData\70490693168840115018.exe
    "C:\ProgramData\70490693168840115018.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4916
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- - C:\ProgramData\93307365291759943307.exe
    "C:\ProgramData\93307365291759943307.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2676
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- - C:\ProgramData\90416757990881948111.exe
    "C:\ProgramData\90416757990881948111.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2528
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1896
- - C:\ProgramData\23786436365077715293.exe
    "C:\ProgramData\23786436365077715293.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:836
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:1744
- - C:\ProgramData\27900334405235222323.exe
    "C:\ProgramData\27900334405235222323.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:636
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4828
- - C:\ProgramData\59347606635519449511.exe
    "C:\ProgramData\59347606635519449511.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1784
    3⤵
    - Program crash
    PID:4872
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:2260
- - C:\ProgramData\60791675785475731346.exe
    "C:\ProgramData\60791675785475731346.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4460
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:388
- - C:\ProgramData\05100985440924939647.exe
    "C:\ProgramData\05100985440924939647.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5048
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:2344
- - C:\ProgramData\57520020547616514020.exe
    "C:\ProgramData\57520020547616514020.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1764
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:5036
- - C:\ProgramData\90275318321210826780.exe
    "C:\ProgramData\90275318321210826780.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5008
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:1892
- - C:\ProgramData\29885372049848912746.exe
    "C:\ProgramData\29885372049848912746.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2736
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4112
- - C:\ProgramData\57975750799022750290.exe
    "C:\ProgramData\57975750799022750290.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4544
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:1792
- - C:\ProgramData\45363068273009078093.exe
    "C:\ProgramData\45363068273009078093.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2756
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:3632
- - C:\ProgramData\32784540446125725766.exe
    "C:\ProgramData\32784540446125725766.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4696
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:4988
- - C:\ProgramData\28114763263727411317.exe
    "C:\ProgramData\28114763263727411317.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3880
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:1308
- - C:\ProgramData\85831403041983725724.exe
    "C:\ProgramData\85831403041983725724.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3908
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:780
- - C:\ProgramData\83045998015958193081.exe
    "C:\ProgramData\83045998015958193081.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3252
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4456
- - C:\ProgramData\55641516514796094424.exe
    "C:\ProgramData\55641516514796094424.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3880
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:1080
- - C:\ProgramData\93381060267145809911.exe
    "C:\ProgramData\93381060267145809911.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1876
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:2756
- - C:\ProgramData\05633075718535705647.exe
    "C:\ProgramData\05633075718535705647.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2688
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4060
- - C:\ProgramData\10618480403867832825.exe
    "C:\ProgramData\10618480403867832825.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4912
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:1136
- - C:\ProgramData\79859115797054584571.exe
    "C:\ProgramData\79859115797054584571.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4788
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:2456
- - C:\ProgramData\60018601089721596320.exe
    "C:\ProgramData\60018601089721596320.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3928
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:4328
- - C:\ProgramData\40231976446048932722.exe
    "C:\ProgramData\40231976446048932722.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2528
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:540
- - C:\ProgramData\33575495047299268577.exe
    "C:\ProgramData\33575495047299268577.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1136
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:3576
- - C:\ProgramData\45242370924579140626.exe
    "C:\ProgramData\45242370924579140626.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2088
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:4420
- - C:\ProgramData\60358444529242508500.exe
    "C:\ProgramData\60358444529242508500.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks whether UAC is enabled
    PID:3724
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:3020
- - C:\ProgramData\62322517006975932537.exe
    "C:\ProgramData\62322517006975932537.exe"
    3⤵
    - Checks whether UAC is enabled
    PID:2328
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:4336
- - C:\ProgramData\69035610574568521750.exe
    "C:\ProgramData\69035610574568521750.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    PID:1440
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:2440
- - C:\ProgramData\94792877996711980387.exe
    "C:\ProgramData\94792877996711980387.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks whether UAC is enabled
    PID:3576
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:2976
- - C:\ProgramData\32386923193331596869.exe
    "C:\ProgramData\32386923193331596869.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    PID:4044
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\runs.cmd" "
1⤵
PID:4376
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- - C:\ProgramData\24521051275525214662.exe
    "C:\ProgramData\24521051275525214662.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3424
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2640
- - C:\ProgramData\71164097721512983704.exe
    "C:\ProgramData\71164097721512983704.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3168
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- - C:\ProgramData\00192089646508923131.exe
    "C:\ProgramData\00192089646508923131.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:868
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- - C:\ProgramData\08099088409272374484.exe
    "C:\ProgramData\08099088409272374484.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    PID:4416
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2188
- - C:\ProgramData\60607504249152517974.exe
    "C:\ProgramData\60607504249152517974.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4212
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:324
- - C:\ProgramData\60270046678587013467.exe
    "C:\ProgramData\60270046678587013467.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5040
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- - C:\ProgramData\36611911650940266469.exe
    "C:\ProgramData\36611911650940266469.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4856
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- - C:\ProgramData\27485460089383862762.exe
    "C:\ProgramData\27485460089383862762.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3232
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- - C:\ProgramData\45912943173067826847.exe
    "C:\ProgramData\45912943173067826847.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3248
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- - C:\ProgramData\02399417128809071020.exe
    "C:\ProgramData\02399417128809071020.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2732
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- - C:\ProgramData\44880019851228985898.exe
    "C:\ProgramData\44880019851228985898.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1604
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- - C:\ProgramData\73926327360738358197.exe
    "C:\ProgramData\73926327360738358197.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4972
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- - C:\ProgramData\06668756520210963848.exe
    "C:\ProgramData\06668756520210963848.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3432
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- - C:\ProgramData\79631773788919618265.exe
    "C:\ProgramData\79631773788919618265.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3144
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- - C:\ProgramData\62327602442079723741.exe
    "C:\ProgramData\62327602442079723741.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1048
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- - C:\ProgramData\12779777337561308945.exe
    "C:\ProgramData\12779777337561308945.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1716
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  PID:4784
- - C:\ProgramData\32608880621484482523.exe
    "C:\ProgramData\32608880621484482523.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1896
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  PID:3944
- - C:\ProgramData\94406042477519412300.exe
    "C:\ProgramData\94406042477519412300.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1772
    3⤵
    - Program crash
    PID:988
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  PID:5008
- - C:\ProgramData\60081052075665025951.exe
    "C:\ProgramData\60081052075665025951.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2024
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  PID:1504
- - C:\ProgramData\36447953403392297318.exe
    "C:\ProgramData\36447953403392297318.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1796
    3⤵
    - Program crash
    PID:5088
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  PID:5060
- - C:\ProgramData\82775836866882202403.exe
    "C:\ProgramData\82775836866882202403.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2988
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  PID:3492
- - C:\ProgramData\35414049091555356459.exe
    "C:\ProgramData\35414049091555356459.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3948
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  PID:4192
- - C:\ProgramData\74419892851039774874.exe
    "C:\ProgramData\74419892851039774874.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2344
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Loads dropped DLL
  PID:3488
- - C:\ProgramData\05664736998866041401.exe
    "C:\ProgramData\05664736998866041401.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1080
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4504
- - C:\ProgramData\24397562068379534428.exe
    "C:\ProgramData\24397562068379534428.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1564
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:2096
- - C:\ProgramData\83507624342350235547.exe
    "C:\ProgramData\83507624342350235547.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4044
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:3432
- - C:\ProgramData\63531001972844714257.exe
    "C:\ProgramData\63531001972844714257.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4116
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:1992
- - C:\ProgramData\71935380007017903308.exe
    "C:\ProgramData\71935380007017903308.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1536
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:1496
- - C:\ProgramData\86719532028175739560.exe
    "C:\ProgramData\86719532028175739560.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1156
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:408
- - C:\ProgramData\49722106109436362705.exe
    "C:\ProgramData\49722106109436362705.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3508
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:1176
- - C:\ProgramData\86956515634634609739.exe
    "C:\ProgramData\86956515634634609739.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1128
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:1080
- - C:\ProgramData\52191993576975174860.exe
    "C:\ProgramData\52191993576975174860.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2296
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:3112
- - C:\ProgramData\75723800898303319061.exe
    "C:\ProgramData\75723800898303319061.exe"
    3⤵
    - Checks whether UAC is enabled
    PID:3848
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:1896
- - C:\ProgramData\72595661096465205806.exe
    "C:\ProgramData\72595661096465205806.exe"
    3⤵
    - Checks BIOS information in registry
    PID:372
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:3820
- - C:\ProgramData\79204440492179272198.exe
    "C:\ProgramData\79204440492179272198.exe"
    3⤵
    - Checks whether UAC is enabled
    PID:4448
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:2756
- - C:\ProgramData\21802068079814273531.exe
    "C:\ProgramData\21802068079814273531.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks whether UAC is enabled
    PID:2840
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:1860
- - C:\ProgramData\00997715248133819781.exe
    "C:\ProgramData\00997715248133819781.exe"
    3⤵
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:4716
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:4080
- - C:\ProgramData\33825815830965168799.exe
    "C:\ProgramData\33825815830965168799.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:1596
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:3268
- - C:\ProgramData\96637589901206791031.exe
    "C:\ProgramData\96637589901206791031.exe"
    3⤵
    - Checks BIOS information in registry
    PID:2216
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:2456
- - C:\ProgramData\54918907271654412332.exe
    "C:\ProgramData\54918907271654412332.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks whether UAC is enabled
    PID:2976
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4480
- - C:\ProgramData\76174249893566756782.exe
    "C:\ProgramData\76174249893566756782.exe"
    3⤵
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:944
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:4504
- - C:\ProgramData\32714823431651688436.exe
    "C:\ProgramData\32714823431651688436.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:936
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:1632
- - C:\ProgramData\54035168089423291922.exe
    "C:\ProgramData\54035168089423291922.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:4812
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:1128
- - C:\ProgramData\43343208101030285309.exe
    "C:\ProgramData\43343208101030285309.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:3488
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:4312
- - C:\ProgramData\26971369059021056367.exe
    "C:\ProgramData\26971369059021056367.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks whether UAC is enabled
    PID:3020
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:696
- - C:\ProgramData\00733238150305510111.exe
    "C:\ProgramData\00733238150305510111.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    PID:4264
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:4068
- - C:\ProgramData\90953893327623055593.exe
    "C:\ProgramData\90953893327623055593.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks whether UAC is enabled
    PID:5024
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:3840
- - C:\ProgramData\78704048999844758267.exe
    "C:\ProgramData\78704048999844758267.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:4696
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:1064
- - C:\ProgramData\16722648934186728240.exe
    "C:\ProgramData\16722648934186728240.exe"
    3⤵
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:2876
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:352
- - C:\ProgramData\93199444704720860194.exe
    "C:\ProgramData\93199444704720860194.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:5076
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:4416
- - C:\ProgramData\41998241546834698034.exe
    "C:\ProgramData\41998241546834698034.exe"
    3⤵
    PID:3156
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:2028
- - C:\ProgramData\96397003725469722039.exe
    "C:\ProgramData\96397003725469722039.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    PID:5028
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3944 -ip 3944
1⤵
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 1504
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4828 -ip 4828
1⤵
PID:2068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\runs.cmd" "
1⤵
PID:3024
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  - Checks processor information in registry
  PID:3076
- - C:\ProgramData\50758268694127476224.exe
    "C:\ProgramData\50758268694127476224.exe"
    3⤵
    PID:640
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:4724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 1572
    3⤵
    - Program crash
    PID:1108
- C:\Users\Admin\Desktop\zalupa.dll
  zalupa.dll
  2⤵
  PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4724 -ip 4724
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 380 -ip 380
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3396 -ip 3396
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\02303626197213381662834425

Filesize
20KB

MD5
80f12fc892a081177c31fdae9f085157

SHA1
1209146f1f3d909299febb92b0cb9aef6ead8db4

SHA256
c80760f39f9456822a1857e74b74b0031b29a518ef672a4c0288f3886989db66

SHA512
33b6f0d26975c085bb4bf8503fcc816f71a1320ad471a10f23e7c99f7c4fe2a6b77fd169adf5d8a0568be888df1e3156e8d7d37d3ee69f11c3b5dee7b8ea5d91

Download Submit
C:\ProgramData\03889418562153271070742691

Filesize
20KB

MD5
2655b69501c2e8be1467b2852ac8ee41

SHA1
bbcadd25a1a0685e40d5c1736076d19d2392a77e

SHA256
eabe1f1b7e934de98eeb0e6a8f09039c964abf4bdcff80b32cd9c23b3a1f169a

SHA512
1632558cb1094d82d006dca31e004cc3bbb44d342f9995454effba0b7b6e09fae59d6e15f9e0c5343e437a8fed8ac2799c37101ce945039c461f6a37263526ee

Download Submit
C:\ProgramData\05214909009983583836937838

Filesize
20KB

MD5
0de06b0cd0b0bfad7366dd887b447bed

SHA1
dd63c66b0a2530a8722ba1cd2805f44329fffa7b

SHA256
9225c28bf52b439b8917bdfd9072106392dd61edef7b76f4553fab6faee6eee1

SHA512
8945d215047b7978082e5e0173c2e6cd6476bbf13f70dcef7b7159c74172936bd4d2f2e534077b1be48ae3f6ad9334d0d05889dfe6ec26f077d60c4487a7d4b1

Download Submit
C:\ProgramData\05829950942562714735623456

Filesize
20KB

MD5
2ff791d13fd6b1f192fb8c72f2c5f824

SHA1
3eb36232d22d13b24cff302cebd13fb7fbf2501e

SHA256
df50e578f408278391a398bbac5919be0037d6b792d70e0527eb281fe18e1dc9

SHA512
4a68bf5597d449c7ba95ac527f4530786f33f8065af42f1abc32f8aa46ffcedecf408858b138fa3833491c977d7548dd92fb1d207fda9bd555a3c21e7c940146

Download Submit
C:\ProgramData\08915069549472471958077954

Filesize
20KB

MD5
905ed0062be5cd0ba493a010dad5cdd6

SHA1
9b0a523511659bf0d75298bfd7a9465f35772b26

SHA256
48410138c006917bf5634f44179325da3027c1209c3fc056c657a42a1c75c3df

SHA512
4112e4df7b76dbe9a51ef85b620167af6aba59a579a682b25d1c252035981c4d251dd410e1fccdbb91a62027092b30da20bbadcbe88be57266937d89d469678d

Download Submit
C:\ProgramData\17306148349847459353039789

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\ProgramData\17306148349847459353039789

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\ProgramData\26218189278034013217325898

Filesize
20KB

MD5
54e4f177c562e4fb6e2b208165618a62

SHA1
11d292594440d71298fd32012c5bd51cc096aafa

SHA256
17f63defb14487a0bdeb5709c45b5976dae4950b4a804181f316eae62e2b627f

SHA512
f6a057d282c99cb43cc60b5a45a7ca0154254f7eff0c0120a88f558614e4bfac8680793800e5b9e161af93b0f28ce061cc44cf1e607129454c29a8a0bd997f21

Download Submit
C:\ProgramData\31275679222385257160569362

Filesize
20KB

MD5
7cf19856f50f2726f34e72bbb0251407

SHA1
b799ed45014ca9b541274d0ad3ddd1082027c0e5

SHA256
6eb57a204d85bd292b45e3a1350ed0295d8bb12ada7f7abdbb0fa33e5d439261

SHA512
f693bc4dd8fe8a24dc970f2143b7819f8f60ac0ab4d86466314795651c57958216e2176ec02950d0b154c42f18e6774d4b443f777d86e70bcf36efddd8d53f3c

Download Submit
C:\ProgramData\33113282464027770899111323

Filesize
20KB

MD5
7590d9a7130a582d19b5c14faf2dbcf9

SHA1
eb1ee3a7d3ee9a3c419be35c39005763f22bb26a

SHA256
153b3583446af2c2ba0600e6e17873468594176f3b51ad9069b4323bc4e5948a

SHA512
eb8a727fb1fd98de19674aad98bf8ed1bc65478e6f175c4a259fe641140c84aab1592b251429b2dd6a36809f3beb78adcce946230cf6737c371220355241fe41

Download Submit
C:\ProgramData\35137994635255840921500247

Filesize
92KB

MD5
4b609cebb20f08b79628408f4fa2ad42

SHA1
f725278c8bc0527c316e01827f195de5c9a8f934

SHA256
2802818c570f9da1ce2e2fe2ff12cd3190b4c287866a3e4dfe2ad3a7df4cecdf

SHA512
19111811722223521c8ef801290e2d5d8a49c0800363b9cf4232ca037dbcc515aa16ba6c043193f81388260db0e9a7cdb31b0da8c7ffa5bcad67ddbd842e2c60

Download Submit
C:\ProgramData\37667070143631350168092430

Filesize
20KB

MD5
53df130448e55bbf850d8a0d4a824f40

SHA1
8ff83fd546803bec73dec17ddb6c3a2ba312c18b

SHA256
32303699ce6b9b85db90795733ebe169ce795a75fb3b706a3b487e270192d591

SHA512
4187802c3e2261e9716c07d616181f871606f6a632e0e5a9a262366b15b3542ee19d2f1d5c174480408bbe1bcf541677975d65a514ac6dccc2836737c659e776

Download Submit
C:\ProgramData\37721104127439886565667045

Filesize
20KB

MD5
ad0261079a9ae306510ee2292ef61ee0

SHA1
4be2b95e4e577d308a757482bb99a843f5bc6fe4

SHA256
f307b192f30d92dec5e0caa2cc8079626a8b2d601fc8aea3b16981a9b8123da0

SHA512
0d559024175eacee75d33a2e7c6471608317dea87f45ba3cce3689a990b6875d672fd1022663c776a6c45f5c25f130fc24e93628249df1d7991e27b9009a4b20

Download Submit
C:\ProgramData\37721104127439886565667045

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\ProgramData\41762672014081340517577503

Filesize
20KB

MD5
883c09f315d52153be5adeb32502a0fe

SHA1
5363ccecc5f0e036ec125cc1e98c08bcf361e05f

SHA256
fa463862236da0a0f910965fd000aa4d8fd2ceb8c840fc3fd0f13d3c3de84aa8

SHA512
25d64dfa0dd3390c886cf6d011818bc3f86576292792ece7a35d3a02ac96421e3fb077a04f707a4be0e09e2ac8cf06f937cf6a3b3115950569496e745c536018

Download Submit
C:\ProgramData\43744539668854071335.exe

Filesize
3.7MB

MD5
ccf4763882256111f713d881ad7d9aa9

SHA1
507297f20fd3fbda9a8cd426bbcffdeb8e4e8ab1

SHA256
59d9b80d021e8dc40f387d759ce6f77c56330a07352c0238f1768116cf80ebf7

SHA512
53d20ba5739d1205be1b16966d981881ea8c9b0b8c9880b1e407f354e025b6ccae61e653b78d6a9e3d9c5023ff09143b365545c411809b645ac24f8620580416

Download Submit
C:\ProgramData\43744539668854071335.exe

Filesize
3.7MB

MD5
ccf4763882256111f713d881ad7d9aa9

SHA1
507297f20fd3fbda9a8cd426bbcffdeb8e4e8ab1

SHA256
59d9b80d021e8dc40f387d759ce6f77c56330a07352c0238f1768116cf80ebf7

SHA512
53d20ba5739d1205be1b16966d981881ea8c9b0b8c9880b1e407f354e025b6ccae61e653b78d6a9e3d9c5023ff09143b365545c411809b645ac24f8620580416

Download Submit
C:\ProgramData\43744539668854071335.exe

Filesize
3.7MB

MD5
ccf4763882256111f713d881ad7d9aa9

SHA1
507297f20fd3fbda9a8cd426bbcffdeb8e4e8ab1

SHA256
59d9b80d021e8dc40f387d759ce6f77c56330a07352c0238f1768116cf80ebf7

SHA512
53d20ba5739d1205be1b16966d981881ea8c9b0b8c9880b1e407f354e025b6ccae61e653b78d6a9e3d9c5023ff09143b365545c411809b645ac24f8620580416

Download Submit
C:\ProgramData\44409042813602870724950259

Filesize
20KB

MD5
26982433a01d47662a30274dc51adc4c

SHA1
2460e2a751d065d1de7ec20f6af658025f0bbbd5

SHA256
7b700204d80c28d4e47832f96528b153c4576a95ecd4d335ea02a84d1abc268e

SHA512
dba81954b3df624a904a116e56c9d2598eaf34df01b2ca936af48a421062f99bf5661ff7904229cdc099643499dfb9a64f127727e566119a45be17ce91942e63

Download Submit
C:\ProgramData\52529121255961849477058489

Filesize
20KB

MD5
46779aa07bdfee0e0b4d0b7022bddf87

SHA1
c51261c096b1abfa56cd3d99a1ef8099d6cb7121

SHA256
ac8cb7ddcfac7616bd0a507bd2bf520437ec7e53c8a205db3b91eecd902f3b08

SHA512
fe2ae119a67fe0f87b6eff528f0b95ff454330359b520251c95b58a6e95f37044c0e754070a6a887bf9d157b14b93554f5d62c92009ac3be8f4f7275b536f8e6

Download Submit
C:\ProgramData\61604904540791323659042725

Filesize
20KB

MD5
4f1c9802402e491d261c91f953f8da2d

SHA1
31e966e5572c89c052409209b332c8efe6e00716

SHA256
96cd3c37f079510d79302792194f814193c76ca9bc0ecff0c456fc32faef022b

SHA512
6b12b0922d6ea3007f9591a972b4d4dd9a8fa9ae665ebf68c43c2237db9a3b0df73a479cb5317c6f99a44661c16fc28ea1318bfb30c0ddeae345d45b16a131da

Download Submit
C:\ProgramData\62969652120071519398240403

Filesize
20KB

MD5
07665e64e7d6f4c00b4d8d4e29e755c1

SHA1
e80d56dd68738cbb13a995e701a24096435a1533

SHA256
b31fab08518514721145715b691ac541737b6391fbb0620283c3c1d6b5b63c35

SHA512
72199d9cc33a617793fa1ca93c922b6065d9acdc2346e61fb97e87b7ddf9d9461e5cff5d2bccd7b34aa9579cc4c696c14e15a90b9c0ef3d50a5000bce54ff963

Download Submit
C:\ProgramData\67968632365594732088534343

Filesize
20KB

MD5
d39911b31f483cc6a3968c04f87eef12

SHA1
c596095e83242d33952d2fbd2b27e6eb6957305b

SHA256
cb5a2e76b318a77651ca52df39d29d34b919f71b5313d86de2ce67e47786a796

SHA512
fc43bf2180b07fee7fabe665d45aaa74b325809f866cac5cee431962d6ee50a8e1587ff14fb8832a87ef7e35ef238b983cea692e823a0cb26568e590fc4cd81b

Download Submit
C:\ProgramData\69027303181175982400.exe

Filesize
3.7MB

MD5
ccf4763882256111f713d881ad7d9aa9

SHA1
507297f20fd3fbda9a8cd426bbcffdeb8e4e8ab1

SHA256
59d9b80d021e8dc40f387d759ce6f77c56330a07352c0238f1768116cf80ebf7

SHA512
53d20ba5739d1205be1b16966d981881ea8c9b0b8c9880b1e407f354e025b6ccae61e653b78d6a9e3d9c5023ff09143b365545c411809b645ac24f8620580416

Download Submit
C:\ProgramData\69027303181175982400.exe

Filesize
3.7MB

MD5
ccf4763882256111f713d881ad7d9aa9

SHA1
507297f20fd3fbda9a8cd426bbcffdeb8e4e8ab1

SHA256
59d9b80d021e8dc40f387d759ce6f77c56330a07352c0238f1768116cf80ebf7

SHA512
53d20ba5739d1205be1b16966d981881ea8c9b0b8c9880b1e407f354e025b6ccae61e653b78d6a9e3d9c5023ff09143b365545c411809b645ac24f8620580416

Download Submit
C:\ProgramData\71662407415231979963248249

Filesize
20KB

MD5
5c346f53257389dc330b1d3f4819abe0

SHA1
59a530a7f763c15b5feee65c14bc6bfabe9d68d0

SHA256
e372e41fe2016fc38b42c3dc220b2bad0e5f6343d0f6bc15540d38f7383f9bb6

SHA512
80f864c29c2a3d9843033e21b7c0be885c76f7b79f2b95603053a016c53342d108e186c840aef677a11a618f53678604053fd321bc02ead39d0247edb3440242

Download Submit
C:\ProgramData\77780390688708745405.exe

Filesize
3.7MB

MD5
ccf4763882256111f713d881ad7d9aa9

SHA1
507297f20fd3fbda9a8cd426bbcffdeb8e4e8ab1

SHA256
59d9b80d021e8dc40f387d759ce6f77c56330a07352c0238f1768116cf80ebf7

SHA512
53d20ba5739d1205be1b16966d981881ea8c9b0b8c9880b1e407f354e025b6ccae61e653b78d6a9e3d9c5023ff09143b365545c411809b645ac24f8620580416

Download Submit
C:\ProgramData\77780390688708745405.exe

Filesize
3.7MB

MD5
ccf4763882256111f713d881ad7d9aa9

SHA1
507297f20fd3fbda9a8cd426bbcffdeb8e4e8ab1

SHA256
59d9b80d021e8dc40f387d759ce6f77c56330a07352c0238f1768116cf80ebf7

SHA512
53d20ba5739d1205be1b16966d981881ea8c9b0b8c9880b1e407f354e025b6ccae61e653b78d6a9e3d9c5023ff09143b365545c411809b645ac24f8620580416

Download Submit
C:\ProgramData\81172442847747271567978254

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\ProgramData\93933236296309795117928568

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\ProgramData\freebl3.dll

Filesize
669KB

MD5
550686c0ee48c386dfcb40199bd076ac

SHA1
ee5134da4d3efcb466081fb6197be5e12a5b22ab

SHA256
edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

SHA512
0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

Download Submit
C:\ProgramData\freebl3.dll

Filesize
669KB

MD5
550686c0ee48c386dfcb40199bd076ac

SHA1
ee5134da4d3efcb466081fb6197be5e12a5b22ab

SHA256
edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

SHA512
0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

Download Submit
C:\ProgramData\freebl3.dll

Filesize
669KB

MD5
550686c0ee48c386dfcb40199bd076ac

SHA1
ee5134da4d3efcb466081fb6197be5e12a5b22ab

SHA256
edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

SHA512
0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

Download Submit
C:\ProgramData\freebl3.dll

Filesize
669KB

MD5
550686c0ee48c386dfcb40199bd076ac

SHA1
ee5134da4d3efcb466081fb6197be5e12a5b22ab

SHA256
edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

SHA512
0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\ProgramData\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\ProgramData\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\ProgramData\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\softokn3.dll

Filesize
251KB

MD5
4e52d739c324db8225bd9ab2695f262f

SHA1
71c3da43dc5a0d2a1941e874a6d015a071783889

SHA256
74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

SHA512
2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

Download Submit
C:\ProgramData\softokn3.dll

Filesize
251KB

MD5
4e52d739c324db8225bd9ab2695f262f

SHA1
71c3da43dc5a0d2a1941e874a6d015a071783889

SHA256
74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

SHA512
2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

Download Submit
C:\ProgramData\softokn3.dll

Filesize
251KB

MD5
4e52d739c324db8225bd9ab2695f262f

SHA1
71c3da43dc5a0d2a1941e874a6d015a071783889

SHA256
74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

SHA512
2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

Download Submit
C:\ProgramData\softokn3.dll

Filesize
251KB

MD5
4e52d739c324db8225bd9ab2695f262f

SHA1
71c3da43dc5a0d2a1941e874a6d015a071783889

SHA256
74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

SHA512
2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

Download Submit
C:\ProgramData\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\ProgramData\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\ProgramData\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\ProgramData\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
1KB

MD5
965e643d41d2bc128e3bcd222b366534

SHA1
a580ba9f4551dcb826fd64df155e84441ab3d38f

SHA256
646fe5ec9d6610c10506e3010199e474439ff35d4ea3b978b8b0aa768f3c94b0

SHA512
410f71e75046b52ec5f22aa49660f75f75593b79c050c8ce8eed9e7e7d00b6938f2f784a1007be9618c8bb30b15fb1ee855845ef91303f2c69e7b09299fe3153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30

Filesize
1KB

MD5
fc9db7199a674e2dfebc7e727d99a9d9

SHA1
fc5223fb3a5aac2efc351a2e88bd21da775e011c

SHA256
6ed39986a4c889fde041b1a1a765a9c9010afbbea45be0ae01b0e54008e7a8a1

SHA512
518b5b1b8438387dd48c98b141221b33fca64cf1407e007c04f395607c6eb59d3df203290015e40b87767dd4c9f66c50de5b94b8e841808cbecfc48dea085d4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
1KB

MD5
dc9cff177000842f2a6012e44187a7ac

SHA1
d21b0e775cc8da0aa8ff411a9fca7d824d9c9d9e

SHA256
42ec597f23785bd1abab286493d81952a9484684bca351c01e711cca2fae0d40

SHA512
7631b223d6af02e592630e758fa368bc1fd6895f9f0bbe611bffd9df73bcfb7c8c0b0b03f87c727809e24174c88b7b40648da45426dce33e36576b4490a6b652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
e42fd51e401060282f33ca525581d8b4

SHA1
664984f91aaf66d261bca3bd138df4e7a1f7b7f1

SHA256
8d48f2da3df9d6e26193dc32a26f198d6d57b8e2bcabf23ad3f56efedcf28b24

SHA512
5a3abee84a3a56967331cdfe3e1d95db6f0036f4945c0704ffae3f3792ffac9eff13465135b234276eeb8727a5f6501f905032daee35c5ff5de03cd61dd36582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30

Filesize
474B

MD5
022746b7738f25f3d58f4f40f84c063d

SHA1
8f96887cf5ce70989b7ee1ab16f7d37a66bc0531

SHA256
0484b67f8a1f36cb20aa6eccb3c1fc30b7deaa8e5a085987416118e86e4ad9cf

SHA512
8fa7dfc46545eeb36af9c5718e25ed08178b1836d717f1b4ce169d75b8aa54454ef61a220e7432b365097dfbe3c447909d6858a730bc11081b0333e9cb78106e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
458B

MD5
422f8fe948d2147d26af7b3d9d75e0f6

SHA1
ef8b2dab3bfb508ed7bc4bb4618a36f6a1b8e344

SHA256
fe04bf8473d4ceefc8f70eb780ffeab793070abe70079f117fa05c6943f802db

SHA512
c08a164c3f8444be27b93f0a021c8524dbc88ff9f905d8e7463b799717c564d8119a5e53976f9e2c108c0c28bbaffe225192ab179ac6a73808953f3c85fe15e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\624d9775-a0f4-44e6-9b85-935ec537d6d3.tmp

Filesize
871B

MD5
d6c223866d69030fe6fc2a9248f3ba40

SHA1
1e7c9c4d38bfaf0f951322c3621b67cf28045a71

SHA256
1277c5406dc2a64a937c3225c03be46ee961f982826065a7985b23f507381b58

SHA512
e95e4ffa2bb278fc6d69a2f3b7ea1c54244bbd593e1b48421b68bc397be522f23a904f45785fa2526fb59e37c681f41c7521b3f0d31a07e8402c166324d7362e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
2971ebcde9edb795ba520d96bdf7923e

SHA1
dca3e2d612411f3f647f31e8aca0eafa8705c9e7

SHA256
db2a6a31cc86448d446b0053475c18f4ce0638faf00197077dba5bb430793fcd

SHA512
ec589e5740826dd7ca9e5c0529df0ccdd311afe1ffdb78fbbf5b7b1309b748f5d34e869b95090fc5cdfc6fe1b26e7316b5b73865906e7d8b5d8817a09a797da5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e81d39da344f2d6413934024e5a85a54

SHA1
5cb6404b8fe98fa597eb7d39ccb99b557fb46c48

SHA256
e64213ef5ac39ae2d517017e2f091beb628ab2a2c9d4ce5e220dfc1836b66934

SHA512
a650a339927d58a3961201fafd1da2d60c9d8d174e7640094e58973c31f583d07a357054e78940646d6ac2c945c5a0868618aebbfbd44a1d5d65bf5a0e7f4b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
ad0261079a9ae306510ee2292ef61ee0

SHA1
4be2b95e4e577d308a757482bb99a843f5bc6fe4

SHA256
f307b192f30d92dec5e0caa2cc8079626a8b2d601fc8aea3b16981a9b8123da0

SHA512
0d559024175eacee75d33a2e7c6471608317dea87f45ba3cce3689a990b6875d672fd1022663c776a6c45f5c25f130fc24e93628249df1d7991e27b9009a4b20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
7595a48cec84f6742ee6d070881b9ec2

SHA1
1c7a1aa92bb9be06e88acbb5899f81c7f0b0775e

SHA256
e087c6ea0d2f81cbb7f0c60dafb687f7627d0cd18ddd4fa946e9439018a430ae

SHA512
4ea107f0ebe9ccaf314a11af284b83d354629a1a7ecf3246e1a41cee7617a4c59684b53850e5fa1c2c97658405429fbdb8263dd0c3271bfa83b80622c66284c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
211040fbb539d447dbde8ba08bca7cb6

SHA1
c3cfb63b70f5286ba8977244ed503fca226d3b56

SHA256
32dd44f9d16309f6d7cfd1614ac7284f5fff0b2dc8b2ab775e433ea16a96fa00

SHA512
9420f6e58ae49dbeb904d380b7d4fa7bd9eee6955214076534e21864fa2b89d3d01081a5e036da1a959e95556a5bf3dadf4ffbe7e67e6e29614bb849407f8407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
744ae5adf77ba5b6e317347e67b9131a

SHA1
adabc531a465db8afbeebe3cb3d1b8f5843e84f8

SHA256
aaf4f87ec055db3e640b14f613b4b35964b50016a209c5fe24e55420dbed9e91

SHA512
12372681b3ed8e6a1b9c05c3ce8c61862ac3edc109fca5882d4441f2329028d3ba4016adaf51eab1cb3044af26dfea82a2615782cd5ad3023c8d67f09e9fe0db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
da4064f1f9801387de1bec3ffc1ebf96

SHA1
1ebde32190b0bce4d824481c317c3a404aa52775

SHA256
698bc3010d9a3b51bebd0f91f2a39bc7fd92d6f40d41c35c8cb69f0f50b596a9

SHA512
5ddad7d3c4590311b556ecc225cf421f553420b33add67c2e9cec8e2f1b76a14de815fa0a240039ab19604502508756fa14b5a205246d0178ab5b9d404b3bd9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6cb7220201a4266c82f24aff4f95db9d

SHA1
809eb773a94f57c804f267da0b9e516909c03634

SHA256
21176b82cae09f39c1149b2b27d28dd0db68e812d0b532224dbbca282f6938c8

SHA512
72039a0a90cfe220613d3289782c6bd210c59cc8442c3a61ea82dffc7f651933c92870df83c0a0d223ff27bc8482d963bc4bb7565cab11f5cc5d6d099334edf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3596009d9cbeb3d8adf8d8bed02c93a

SHA1
36c5d6887f00aa3d5ed50b75d30270169fe68436

SHA256
0379f8a0134eaaae20d8c1f630e28673daae656b7284151cd18aa11bb25b8ff1

SHA512
e8881bce57ea463d8b46ae7b623b6bf5284a9e6d896fed3c2e97244f2045c6b3de3181d1d40dba655c7ce471a29201cfdc8421ad3a3ba2fe42d31c1d41a992b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bc5f988722f72244e9a4aa8e1d6a0ee2

SHA1
4a132601b1d75fe013d364df95b711223eb9f742

SHA256
8ae99505d61450350ed2799d1bcca3cf9bcd4dd2e6a99cfcfcb2e929704592d9

SHA512
be7c42520bfe8aa8a966881190240bfef15471e84c4dad78ee3c3c0adc14d02e24f6eb950a68914d5870d51c4e91e42cb91eaedc69c360cb9cdc70c40d0cea2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
35cc8bcb785540feb02fc38af84428bc

SHA1
677189a375a96aea9af983e6cc2d509fac137c90

SHA256
180c1950edec974b1c6c7dd0625465eb8e5ded691c2038368e112e0a2b7f8c5e

SHA512
9da4f9dd4646ea84b43b431a306409fe354233c45aa5d471b952c50c9b51c80825e10d14ca4460ff9c1dc9bb5c88db3945cf0d53af8c94282df8993edbe5b5e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
04c4b4de3d51441fffe0cbc759d9adf6

SHA1
20b8dd5f42a46243affb1429934e8c69b51e48a9

SHA256
03d5132bc3a903407557f5d792959499fc514b13eef52ef26682b41e59e98b61

SHA512
1005532b897d91055a06c0e6f731fc5edc0c939749b082b6c009db1a2669038ccc9d15fd9303bee8d0acfb2c60786d784f10a9a3abdd51fcd45de550d977c374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
e9ccba6533465c2ace10832dd13b6c41

SHA1
d21893e7e2ffd16c746859ac5bcd3b441c35a29c

SHA256
51666a4a0c86a49264cbb604e789b90f2a54489db91e8d1110d9b368d151e563

SHA512
80146dd603b5b3e392d2416348cd094d858b6a00dba66518d97d0494b3ba90fc7d67f547e9a9926299eab884f3c3ee1f51b87911e4f63094c9996c48d37420f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
53675989b6a18289294b009bc6dc3ceb

SHA1
116f87c358281003730cd9b04045e3b0aa2f9a0c

SHA256
06626f5a084f035a6cfa1f9137161d4a937d3dfb1569b547a0fbacb34976cd64

SHA512
bc469ec91e8a62086f93a9382b3d08917fa2de20992a1fa839766e7c3548b35eb9d6c546f1bdc25a696622ca77b2cc0d77eec5140fdaece3e4352d78f4494848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
be69815eaedf5f3211f845ba2a8de265

SHA1
b870ec8e4bd5c9be4434e1cc06aa99ac167f50de

SHA256
b0ba37c25562e214416e7fa66042e8112dd8310a010d32061a4592effc1f37a4

SHA512
a7f20141fadd1ead3e110ce6856672112bb01aeff6b64e55db2f1f588f952e4852452bd62ba77cc6ca25b7d761ff47745abb223024b327d9ef4cd5f20537c578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
0a37ddccaaa9ee39e01d1c3baa6e42aa

SHA1
aba76be76b56ecb6aaed6b0aafcdac0f2f3512b6

SHA256
187ebd702c7ee6167752a2f3cc20d137afeaccf15706c9abd3a8fa8b74888f43

SHA512
27a158b4e9d82f25f04b3e9db0c789299be83cf026409939bac115e18793626914254929f2164dc2d09d3a7c6386a7c82692bc34285b6474ac8f9573b43f0d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
bbe5ac1f0a6812fa92023e8883ac5a3c

SHA1
ac6c49d07a743cb6bc0e86df3ee5deacc5496e05

SHA256
6a76bf702d8b577f44462e84cc37dae4f75dbe1fc28754a199db036e7160bd7f

SHA512
1b4515b09fcbba5ae5ffe75f3e13c1ee332c4745cbd538626c17add23ce45f267230e41d069d89026679ea57b60829fbebc51b67019aba1c4e26cca49f8c1b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
eddb8a55261ad2e66f83061574984ce2

SHA1
85e81f62879aef092f289612946758982b3d69bb

SHA256
4e3553a4d729982b0ecff6b5f09a299b55f0fc759d6b4c1d282125ad99adc505

SHA512
9b814f8b1905f155da4f6efd289f7c66a78c6a443633a8977240f660cf587f49b38716c4ddc05fa27f7c5d5c63128e38cbf998578890d34080bd3fc886c06bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
01b30d2132fe0febe3b64105c2b93f61

SHA1
5ac2b1a37e3736b09b7b2d0a0b793acd414d04e0

SHA256
87ad89366036a7e3386150bb7456b7b755e1948ad9aed1f55f1ad449eb183a54

SHA512
a0a9656f956390405febe6c6d98c5ffca2b790bc49f11de02f77a1772ed4179830b50586b6974621fc772550ea9315907fbfbbc5bf14cb77d36bb1a9ba82fa99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
add768eeee4d9d92b416130df0de72b7

SHA1
199b6394498a5ce22edce720192d29a97220800c

SHA256
d78c20e0b3c799caf7b0873d8b7afbeb948e1156a83f30447d69eb26002498e3

SHA512
44008b9e3ca5e53f97ade5dae0222faa15c64f11b3e2c2bd19546e28b024bba1af8a11ff69e54105f816aad7a7f4c3166653e62a3b810241418455a655289e53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
471e14a4e341739345f7962db0db854a

SHA1
d26c2156476a3ccc38af4d77af4e58804205ab0b

SHA256
6beddc4342610e7416c9e4662efd8130f91c76fb3f1d809e6d9644b252e46e6a

SHA512
e7f88417fc4169945976372a9a410194650c174fa39ecf5feeb12884f59b7fbdb14f34235a9eee62e96905c8cd08670ed5524085cf4372e4cdfe99c02c23b979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe571ca0.TMP

Filesize
871B

MD5
06cab7a483a8e928ec8ff5dead7cd4c6

SHA1
049a816ee49abcbf066a1a58d5812c826dfebfac

SHA256
6cf03970be48817f9f71caf45c72be2ef23040861ea2e0fcc162242885d05079

SHA512
6bf3a5ccfed0a241c53182a14a4e5fd5d0575955809cb5292b390b491d5554bb4e902bd29565936c3ef6b7d63f6e392a6761eb75ee1f87c004b495bef4eb2396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b8691c8498e0503f5de4d3bfb7d48741

SHA1
5d796caa8bb83c1e4f7891492bf5a3229e4a74c6

SHA256
3227e2f53b976fbe1c60cf0ddd1edcc3920c703882945c124ba8283a48d8b15c

SHA512
6e33b8f0ec4fab5163f50ab6da055f95c701e5d0c8b96909cdf97ca05e19241c03b0ff640c44aafcd07109c23ee8829b7bce96fe47caf9ea7cf8fa6b4250a1e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
ebbefd00ef66af19c593db61fd13ae65

SHA1
e205ebf468eac436a609dda4c0dc3def1d79026b

SHA256
84c3bc69d82a99a2a76733b5b91b8fef41739910602c1d9e3bedf6a81a484cf8

SHA512
cffc76e2ab79ca1e678307b71aadddf673e5953abaed769f5219201f4d70bad9ff417edb4f8df75b91214862770dab69d1e4e230999f47ca026f425017facce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
0b9a6fda5c3e39fee01c8f3c76ab1d73

SHA1
1dbfb8f07a5c964be6dbef90420f038e29a0f104

SHA256
47f4090b5cbd52fba5c8664a92e33fc76acaaa26b0056ccd6733667fc17b6181

SHA512
64a4eca16390c74df9260cdbca8004078d95a18500ac33adb39afb48bd5fc057fc026c8af104755ee32208b24619e03b945ed1c17f0f7a766f54e4852c6facf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
06f4c0cfc5f1905a545c67a5e30b4c00

SHA1
f49c9cd26f659e9218d345aa1407df098cf8a7de

SHA256
4e1cffeaabdfc853f508d27779fa67517d87018ea8a86c9c273692b357886e60

SHA512
0e2845fd7f0990606b120231db223f585d89890b21c487e5dc432e20abd2649997a484e813f9e83d9c61697d5f706d8ac76581b723bbb1510ef254ef4c6b7586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
601745ecc3ca37c9364a261b41a4ac15

SHA1
e450d9b2d8b3da8117b368bd732c2ea5b54b3c8d

SHA256
9193261446299fbd0fa6453fcaa8985c96b483e81c513e69d3c70b41ebcaddd7

SHA512
0519fe0c8379b65ea47055794796cc20dddfbe4fc82ada10ef2ab6bc9ce2679308e50c8e51ff5fa7a2bc259b59d2b422654ad0a0690b9911ad378d06b8784603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
300164cd7c7e9d8d2b0dca4010e1eea9

SHA1
b5aac7b5f6a183a9e5aa0d145796463fae4dd3fc

SHA256
735f62cb193f71d4319ecc414a1dfea49bed7ead8b3df07a7d6907dcd49da2e3

SHA512
2877fbbb510db3f18149d1a2c6b35497ff510635a6c6d49c63447beabe6c3cc3a0aa64f973b607d55dda1f5e9f76bb51f1a8d26210dbc8293fe329fc1e52eab0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nkaatyqi.1j5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
9dc1bb806fa56f98a10473fc5576a8bb

SHA1
aa6bdc97a538567867e8d8c4bc8c61438068ab2f

SHA256
ad29f50cefbb38d1e7b2de53d4ba52e1c1883ea98fa224a71fd68347b240d912

SHA512
4a2751f52e91d13565b79558065e25cb103a588ac847e47e6e044bc27b919d8bbc8455d7177d10a443e0de4841b43715d59777bb03bbf10df914e505ccabd1fb

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
733.7MB

MD5
74836a44957aaf38943f5e627231733a

SHA1
d1bd58c4d81d8a721043f2855a96914aabe2264d

SHA256
eb6b6647886729f24d142f817daedecfd30e17f8c36f3685672149495e51e8af

SHA512
5811c4d3ec2eee6611875af803729f84982307058c4e060435c7ecde3f36a7c770c38e46144b3cb577c6caeca710ac9842814757eac5511863caffaf0e7bd460

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
733.7MB

MD5
74836a44957aaf38943f5e627231733a

SHA1
d1bd58c4d81d8a721043f2855a96914aabe2264d

SHA256
eb6b6647886729f24d142f817daedecfd30e17f8c36f3685672149495e51e8af

SHA512
5811c4d3ec2eee6611875af803729f84982307058c4e060435c7ecde3f36a7c770c38e46144b3cb577c6caeca710ac9842814757eac5511863caffaf0e7bd460

Download Submit
C:\Users\Admin\Desktop\New Rich Text Document.rtf

Filesize
7B

MD5
8274425de767b30b2fff1124ab54abb5

SHA1
2201589aa3ed709b3665e4ff979e10c6ad5137fc

SHA256
0d6afb7e939f0936f40afdc759b5a354ea5427ec250a47e7b904ab1ea800a01d

SHA512
16f1647b22ca8679352e232c7dcbcdcba224c9b045c70e572bf061b2996f251cbd65a152557409f17be9417b23460adebe5de08d2dea30d13a64e22f6607206b

Download Submit
C:\Users\Admin\Desktop\runs.cmd

Filesize
107B

MD5
b81a08a7390c999a8edd901f4f1e74c3

SHA1
d27deb27ad799aa40a80921dd282a005f99152e0

SHA256
ab2472cad912cb34e8fa7272e50c94c8c087f40e8aa6af2179c0823aa10a142e

SHA512
ad66efc19a99fd6434e8f010a527f473b2b608623d567d352c58e5f52f39af7feb64ce708f88727eb7ccd06126cd2aeb4376961702ee3fd9ab983f7d980b682e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 348318.crdownload

Filesize
7.9MB

MD5
a0638548ba0b039ef86cab79b7d6a925

SHA1
e6b84bc5eaf1e7a505e2bd34536e3cd491422a15

SHA256
a063e4a346ef47f4c739515e005fe1bb2d3f887e093408775f0479c29c5bfbea

SHA512
e863f8b4a20e5cb7f91d33b41ca1356e2fcf3bca50b252a23902a208284b5c5c05e65b7f1977220766ae7440944f908b156f58edf4b6354ebffcb192fbee17e5

Download Submit
memory/836-2524-0x00000000003C0000-0x0000000000C0C000-memory.dmp

Filesize
8.3MB

Download
memory/836-2523-0x00000000003C0000-0x0000000000C0C000-memory.dmp

Filesize
8.3MB

Download
memory/868-1494-0x00000000001F0000-0x0000000000A3C000-memory.dmp

Filesize
8.3MB

Download
memory/868-1503-0x00000000001F0000-0x0000000000A3C000-memory.dmp

Filesize
8.3MB

Download
memory/1048-2594-0x0000000000020000-0x000000000086C000-memory.dmp

Filesize
8.3MB

Download
memory/1048-2606-0x0000000000020000-0x000000000086C000-memory.dmp

Filesize
8.3MB

Download
memory/1604-2122-0x0000000000190000-0x00000000009DC000-memory.dmp

Filesize
8.3MB

Download
memory/1604-2129-0x0000000000190000-0x00000000009DC000-memory.dmp

Filesize
8.3MB

Download
memory/1716-2685-0x0000000000590000-0x0000000000DDC000-memory.dmp

Filesize
8.3MB

Download
memory/1716-2673-0x0000000000590000-0x0000000000DDC000-memory.dmp

Filesize
8.3MB

Download
memory/1760-2840-0x0000000000780000-0x0000000000FCC000-memory.dmp

Filesize
8.3MB

Download
memory/1760-2831-0x0000000000780000-0x0000000000FCC000-memory.dmp

Filesize
8.3MB

Download
memory/1896-2764-0x0000000000A10000-0x000000000125C000-memory.dmp

Filesize
8.3MB

Download
memory/1896-2752-0x0000000000A10000-0x000000000125C000-memory.dmp

Filesize
8.3MB

Download
memory/2024-2915-0x0000000000100000-0x000000000094C000-memory.dmp

Filesize
8.3MB

Download
memory/2024-2922-0x0000000000100000-0x000000000094C000-memory.dmp

Filesize
8.3MB

Download
memory/2028-767-0x00000000003A0000-0x0000000000BEC000-memory.dmp

Filesize
8.3MB

Download
memory/2028-845-0x00000000003A0000-0x0000000000BEC000-memory.dmp

Filesize
8.3MB

Download
memory/2028-765-0x00000000003A0000-0x0000000000BEC000-memory.dmp

Filesize
8.3MB

Download
memory/2028-769-0x00000000003A0000-0x0000000000BEC000-memory.dmp

Filesize
8.3MB

Download
memory/2028-771-0x00000000003A0000-0x0000000000BEC000-memory.dmp

Filesize
8.3MB

Download
memory/2028-772-0x00000000003A0000-0x0000000000BEC000-memory.dmp

Filesize
8.3MB

Download
memory/2028-878-0x00000000003A0000-0x0000000000BEC000-memory.dmp

Filesize
8.3MB

Download
memory/2028-773-0x00000000003A0000-0x0000000000BEC000-memory.dmp

Filesize
8.3MB

Download
memory/2028-774-0x00000000003A0000-0x0000000000BEC000-memory.dmp

Filesize
8.3MB

Download
memory/2028-775-0x00000000003A0000-0x0000000000BEC000-memory.dmp

Filesize
8.3MB

Download
memory/2528-2445-0x0000000000A00000-0x000000000124C000-memory.dmp

Filesize
8.3MB

Download
memory/2528-2438-0x0000000000A00000-0x000000000124C000-memory.dmp

Filesize
8.3MB

Download
memory/2612-864-0x0000000000AD0000-0x000000000131C000-memory.dmp

Filesize
8.3MB

Download
memory/2612-867-0x0000000000AD0000-0x000000000131C000-memory.dmp

Filesize
8.3MB

Download
memory/2612-859-0x0000000000AD0000-0x000000000131C000-memory.dmp

Filesize
8.3MB

Download
memory/2612-860-0x0000000000AD0000-0x000000000131C000-memory.dmp

Filesize
8.3MB

Download
memory/2612-861-0x0000000000AD0000-0x000000000131C000-memory.dmp

Filesize
8.3MB

Download
memory/2612-862-0x0000000000AD0000-0x000000000131C000-memory.dmp

Filesize
8.3MB

Download
memory/2612-863-0x0000000000AD0000-0x000000000131C000-memory.dmp

Filesize
8.3MB

Download
memory/2612-866-0x0000000000AD0000-0x000000000131C000-memory.dmp

Filesize
8.3MB

Download
memory/2612-865-0x0000000000AD0000-0x000000000131C000-memory.dmp

Filesize
8.3MB

Download
memory/2676-1260-0x0000000000A20000-0x000000000126C000-memory.dmp

Filesize
8.3MB

Download
memory/2676-1258-0x0000000000A20000-0x000000000126C000-memory.dmp

Filesize
8.3MB

Download
memory/2732-2040-0x00000000003F0000-0x0000000000C3C000-memory.dmp

Filesize
8.3MB

Download
memory/2732-2053-0x00000000003F0000-0x0000000000C3C000-memory.dmp

Filesize
8.3MB

Download
memory/2736-1169-0x0000000000AB0000-0x00000000012FC000-memory.dmp

Filesize
8.3MB

Download
memory/2736-1178-0x0000000000AB0000-0x00000000012FC000-memory.dmp

Filesize
8.3MB

Download
memory/2988-3076-0x00000000005C0000-0x0000000000E0C000-memory.dmp

Filesize
8.3MB

Download
memory/3144-2364-0x00000000006E0000-0x0000000000F2C000-memory.dmp

Filesize
8.3MB

Download
memory/3144-2366-0x00000000006E0000-0x0000000000F2C000-memory.dmp

Filesize
8.3MB

Download
memory/3168-1418-0x00000000003D0000-0x0000000000C1C000-memory.dmp

Filesize
8.3MB

Download
memory/3168-1410-0x00000000003D0000-0x0000000000C1C000-memory.dmp

Filesize
8.3MB

Download
memory/3232-1890-0x00000000009F0000-0x000000000123C000-memory.dmp

Filesize
8.3MB

Download
memory/3232-1895-0x00000000009F0000-0x000000000123C000-memory.dmp

Filesize
8.3MB

Download
memory/3248-1974-0x0000000000780000-0x0000000000FCC000-memory.dmp

Filesize
8.3MB

Download
memory/3248-766-0x0000000000E70000-0x00000000015C1000-memory.dmp

Filesize
7.3MB

Download
memory/3248-1963-0x0000000000780000-0x0000000000FCC000-memory.dmp

Filesize
8.3MB

Download
memory/3424-1337-0x0000000000800000-0x000000000104C000-memory.dmp

Filesize
8.3MB

Download
memory/3424-1339-0x0000000000800000-0x000000000104C000-memory.dmp

Filesize
8.3MB

Download
memory/3432-2278-0x00000000009A0000-0x00000000011EC000-memory.dmp

Filesize
8.3MB

Download
memory/3432-2290-0x00000000009A0000-0x00000000011EC000-memory.dmp

Filesize
8.3MB

Download
memory/3480-676-0x0000000000E70000-0x00000000015C1000-memory.dmp

Filesize
7.3MB

Download
memory/3480-691-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3592-679-0x0000000000E70000-0x00000000015C1000-memory.dmp

Filesize
7.3MB

Download
memory/3736-978-0x0000000000280000-0x0000000000ACC000-memory.dmp

Filesize
8.3MB

Download
memory/3736-962-0x0000000000280000-0x0000000000ACC000-memory.dmp

Filesize
8.3MB

Download
memory/3888-2998-0x00000000006A0000-0x0000000000EEC000-memory.dmp

Filesize
8.3MB

Download
memory/3888-2989-0x00000000006A0000-0x0000000000EEC000-memory.dmp

Filesize
8.3MB

Download
memory/3948-3155-0x0000000000EE0000-0x000000000172C000-memory.dmp

Filesize
8.3MB

Download
memory/3948-3152-0x0000000000EE0000-0x000000000172C000-memory.dmp

Filesize
8.3MB

Download
memory/4088-145-0x0000023FF4CB0000-0x0000023FF4CC0000-memory.dmp

Filesize
64KB

Download
memory/4088-144-0x0000023FF4CB0000-0x0000023FF4CC0000-memory.dmp

Filesize
64KB

Download
memory/4088-143-0x0000023FF4CB0000-0x0000023FF4CC0000-memory.dmp

Filesize
64KB

Download
memory/4088-142-0x0000023FF7480000-0x0000023FF74A2000-memory.dmp

Filesize
136KB

Download
memory/4212-1657-0x0000000000B90000-0x00000000013DC000-memory.dmp

Filesize
8.3MB

Download
memory/4212-1645-0x0000000000B90000-0x00000000013DC000-memory.dmp

Filesize
8.3MB

Download
memory/4416-1573-0x0000000000C00000-0x000000000144C000-memory.dmp

Filesize
8.3MB

Download
memory/4416-1575-0x0000000000C00000-0x000000000144C000-memory.dmp

Filesize
8.3MB

Download
memory/4792-868-0x0000000000E70000-0x00000000015C1000-memory.dmp

Filesize
7.3MB

Download
memory/4856-1816-0x0000000000DA0000-0x00000000015EC000-memory.dmp

Filesize
8.3MB

Download
memory/4856-1803-0x0000000000DA0000-0x00000000015EC000-memory.dmp

Filesize
8.3MB

Download
memory/4916-1078-0x0000000000F00000-0x000000000174C000-memory.dmp

Filesize
8.3MB

Download
memory/4916-1101-0x0000000000F00000-0x000000000174C000-memory.dmp

Filesize
8.3MB

Download
memory/4972-2199-0x0000000000250000-0x0000000000A9C000-memory.dmp

Filesize
8.3MB

Download
memory/4972-2211-0x0000000000250000-0x0000000000A9C000-memory.dmp

Filesize
8.3MB

Download
memory/5040-1724-0x00000000007D0000-0x000000000101C000-memory.dmp

Filesize
8.3MB

Download
memory/5040-1737-0x00000000007D0000-0x000000000101C000-memory.dmp

Filesize
8.3MB

Download
memory/5112-897-0x0000000000E30000-0x000000000167C000-memory.dmp

Filesize
8.3MB

Download
memory/5112-961-0x0000000000E30000-0x000000000167C000-memory.dmp

Filesize
8.3MB

Download