laplas | hxxps://zensoft[.]fun/index[.]php?v=716294

Resubmissions

20-07-2023 22:52

230720-2tc9tsba43 1

20-07-2023 21:25

230720-z9yjlaag26 10

Analysis

max time kernel
300s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2023 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://zensoft.fun/index.php?v=716294

Score

10^/10

laplas lumma microsoft clipper discovery persistence phishing spyware stealer

Malware Config

Extracted

Family

laplas

http://185.209.161.189

Attributes

api_key
f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	unmfiihiww.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	ogbxtckpogwwi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	wujcfxahsrlpbv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	sxutfigxvoivvisl.exe

Executes dropped EXE 44 IoCs

pid	Process
3892	Set-up32X64bit.exe
4928	Set-up32X64bit.exe
2920	Set-up32X64bit.exe
3196	Set-up32X64bit.exe
1752	curiwhxpwup.exe
2100	wujcfxahsrlpbv.exe
3444	7z.exe
840	7z.exe
1208	7z.exe
1084	7z.exe
2188	7z.exe
5024	aggbcwtqfgace.exe
4844	7z.exe
3436	sxutfigxvoivvisl.exe
4044	Installer.exe
2796	7z.exe
844	cmd.exe
2180	7z.exe
1536	cmd.exe
4804	7z.exe
4632	7z.exe
1328	Installer.exe
1960	ntlhost.exe
4256	dfnadxvrgfwmsv.exe
2624	unmfiihiww.exe
1676	7z.exe
5104	7z.exe
3788	attrib.exe
4528	jntaxaiacskfj.exe
1092	7z.exe
5088	7z.exe
2056	7z.exe
1280	Installer.exe
2584	ogbxtckpogwwi.exe
3436	7z.exe
940	7z.exe
4172	7z.exe
1152	7z.exe
4428	7z.exe
2892	7z.exe
3760	Installer.exe
2220	VC_redist.x64.exe
2860	VC_redist.x64.exe
4536	VC_redist.x64.exe

Loads dropped DLL 25 IoCs

pid	Process
3444	7z.exe
840	7z.exe
1208	7z.exe
1084	7z.exe
2188	7z.exe
4844	7z.exe
2796	7z.exe
844	cmd.exe
2180	7z.exe
1536	cmd.exe
4804	7z.exe
4632	7z.exe
1676	7z.exe
5104	7z.exe
3788	attrib.exe
1092	7z.exe
5088	7z.exe
2056	7z.exe
3436	7z.exe
940	7z.exe
4172	7z.exe
1152	7z.exe
4428	7z.exe
2892	7z.exe
2860	VC_redist.x64.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	curiwhxpwup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3892 set thread context of 4964	3892	Set-up32X64bit.exe	117
PID 4928 set thread context of 4648	4928	Set-up32X64bit.exe	122
PID 2920 set thread context of 4620	2920	Set-up32X64bit.exe	125
PID 3196 set thread context of 3900	3196	Set-up32X64bit.exe	129

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	326	Go-http-client/1.1

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133343619676753970"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 164765.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2304	chrome.exe
2304	chrome.exe
3892	Set-up32X64bit.exe
3892	Set-up32X64bit.exe
3892	Set-up32X64bit.exe
3892	Set-up32X64bit.exe
4928	Set-up32X64bit.exe
4928	Set-up32X64bit.exe
4964	cmd.exe
4964	cmd.exe
4928	Set-up32X64bit.exe
4928	Set-up32X64bit.exe
2920	Set-up32X64bit.exe
2920	Set-up32X64bit.exe
2920	Set-up32X64bit.exe
2920	Set-up32X64bit.exe
4648	cmd.exe
4648	cmd.exe
3196	Set-up32X64bit.exe
3196	Set-up32X64bit.exe
3196	Set-up32X64bit.exe
3196	Set-up32X64bit.exe
4620	cmd.exe
4620	cmd.exe
5116	chrome.exe
5116	chrome.exe
3812	explorer.exe
3812	explorer.exe
3900	cmd.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3812	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
3892	Set-up32X64bit.exe
4928	Set-up32X64bit.exe
4964	cmd.exe
2920	Set-up32X64bit.exe
4648	cmd.exe
3196	Set-up32X64bit.exe
4620	cmd.exe
3900	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
3756	7zG.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1160	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3500	2304	chrome.exe	84
PID 2304 wrote to memory of 3500	2304	chrome.exe	84
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 2132	2304	chrome.exe	86
PID 2304 wrote to memory of 4452	2304	chrome.exe	87
PID 2304 wrote to memory of 4452	2304	chrome.exe	87
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88
PID 2304 wrote to memory of 2116	2304	chrome.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1512	attrib.exe
3788	attrib.exe
768	attrib.exe
4876	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zensoft.fun/index.php?v=716294
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffe10ed9758,0x7ffe10ed9768,0x7ffe10ed9778
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3188 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:8
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4704 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5944 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:8
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4676 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5292 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6084 --field-trial-handle=1844,i,5941318056742581344,998851801087320649,131072 /prefetch:8
  2⤵
  PID:4752

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3584

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap19522:76:7zEvent310
1⤵
- Suspicious use of FindShellTrayWindow
PID:3756

C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe
"C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4964
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\curiwhxpwup.exe
      "C:\Users\Admin\AppData\Local\Temp\curiwhxpwup.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:1752
    - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        5⤵
        Executes dropped EXE
        
        PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\wujcfxahsrlpbv.exe
      "C:\Users\Admin\AppData\Local\Temp\wujcfxahsrlpbv.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        
        PID:2572
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p3723400966431979727828169 -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4844
      - C:\Windows\system32\attrib.exe
        
        attrib +H "Installer.exe"
        6⤵
        Views/modifies file attributes
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
        
        "Installer.exe"
        6⤵
        Executes dropped EXE
        
        PID:4044
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C powershell -EncodedCommand "PAAjAE4ASgBjAFUATQBLAFoAYQBjAE4AcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBxADMANQBaAGEAagBmAFkAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZQBHAEMAZAAwAFYAcwAxADcAMQAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
        7⤵
        
        PID:856
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -EncodedCommand "PAAjAE4ASgBjAFUATQBLAFoAYQBjAE4AcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBxADMANQBaAGEAagBmAFkAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZQBHAEMAZAAwAFYAcwAxADcAMQAjAD4A"
        8⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk9436" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:844

C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe
"C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4648
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\aggbcwtqfgace.exe
      "C:\Users\Admin\AppData\Local\Temp\aggbcwtqfgace.exe"
      4⤵
      Executes dropped EXE
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\sxutfigxvoivvisl.exe
      "C:\Users\Admin\AppData\Local\Temp\sxutfigxvoivvisl.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:3436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        
        PID:2340
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p3723400966431979727828169 -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4632
      - C:\Windows\system32\attrib.exe
        
        attrib +H "Installer.exe"
        6⤵
        Views/modifies file attributes
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
        
        "Installer.exe"
        6⤵
        Executes dropped EXE
        
        PID:1328

C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe
"C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4620
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\dfnadxvrgfwmsv.exe
      "C:\Users\Admin\AppData\Local\Temp\dfnadxvrgfwmsv.exe"
      4⤵
      Executes dropped EXE
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\unmfiihiww.exe
      "C:\Users\Admin\AppData\Local\Temp\unmfiihiww.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1536
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p3723400966431979727828169 -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2056
      - C:\Windows\system32\attrib.exe
        
        attrib +H "Installer.exe"
        6⤵
        Views/modifies file attributes
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
        
        "Installer.exe"
        6⤵
        Executes dropped EXE
        
        PID:1280

C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe
"C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3900
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\jntaxaiacskfj.exe
      "C:\Users\Admin\AppData\Local\Temp\jntaxaiacskfj.exe"
      4⤵
      Executes dropped EXE
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\ogbxtckpogwwi.exe
      "C:\Users\Admin\AppData\Local\Temp\ogbxtckpogwwi.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        
        PID:2312
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p3723400966431979727828169 -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2892
      - C:\Windows\system32\attrib.exe
        
        attrib +H "Installer.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Views/modifies file attributes
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
        
        "Installer.exe"
        6⤵
        Executes dropped EXE
        
        PID:3760

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe188d46f8,0x7ffe188d4708,0x7ffe188d4718
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7016 /prefetch:2
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,2549473889104211126,3652106153575529442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  PID:3552
- C:\Users\Admin\Downloads\VC_redist.x64.exe
  "C:\Users\Admin\Downloads\VC_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  PID:2220
- - C:\Windows\Temp\{0D80C5FC-9AF9-4198-AFF8-0480B9FD49B4}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{0D80C5FC-9AF9-4198-AFF8-0480B9FD49B4}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=564
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2860
  - - C:\Windows\Temp\{68DF01BA-934A-4C1C-A243-FCE6074CE6BF}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{68DF01BA-934A-4C1C-A243-FCE6074CE6BF}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{05541E5B-05BF-4147-874A-613217BD6550} {0942C3C8-166F-44AD-BB71-ED5A6C574BB9} 2860
      4⤵
      Executes dropped EXE
      PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
a584bfd296d23d2d9784129d2512de76

SHA1
94692ecf82d76e1fb8ad518c042f6baf36c720ef

SHA256
f5fe01856e2333727c75f48f17f8710ae3c7226a9ec5872bc180361bf3a21b95

SHA512
d3ecb026ae6e90580003ac5f1cfcd5e210156c7b6bb5dc1a667eac508128c6b317fa840ca823cdf7efc65e517e68f686bbd9eb18c73c9ba14266d1c04b938393

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
148KB

MD5
df5cbf8c0039b4fdc5eb169d5ebd7857

SHA1
38e3f27458809f03d4888775fdc16e2a97f1d244

SHA256
7671f344de0a7d101f54dc296d910150a02594152c2f3dafe57582ef1389a252

SHA512
36d76ac6fbfb84a902cb3a9ca447ee7f41d7eabe977f19b0787ae3818a0bbf9001c4a08e0e266a5d8ead8a0171cb81fb1e219a0f10e526ec3c733b474553e406

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
332B

MD5
73c3675b3d6675137505e805b03bd819

SHA1
1e418df27edc06e226a6bc93c6834d86874e4bba

SHA256
829df1a991f6e885d6f540118de4f000a9e66b516b1313203ba6ba988b949888

SHA512
e6e4a5ca335694c7e4262d4a34a853c4471d1ef07a19b101fc321de1ae674988588befad320662ff88a6128e407c161df246d6afc09356daaf67490a9c8881db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
a08bf135feb286071df1f1e1d1f1ad6e

SHA1
51173b3f4c091f63ff5b9f0adfecf4d03eb5d021

SHA256
37fa78bd85f7d82477e65c606a4745f7b81dbccfad3aa987214d069d916ebd73

SHA512
94ac287b77b6f33c256f32d07a70ef396bf89b8726dfdfa3294393078f0d767af8d0ed670971f1a4223da9a125df65e51427ddedd316d0abcb24a37cb0d83eec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e8d9f45609c0efd061c9e5b2c3392978

SHA1
93706bf1e08af0091afb4cf032142abc1c6636f1

SHA256
881b75605bb1ec85d0ac5d813c710b05ef8ce424683566f06061d92fc62e3c1b

SHA512
eb6a74855fc473bbf45e7dfbe38019a297dcbe9237462242a7d84a3bb871c2f494f63a3237354c1fef9dfd6a582f959a2caaabe3ba2494acb12a58b1c310fd68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0de0ce9344edf4bb920a34b75ebb26cf

SHA1
d51e0cc9f6b61818418e1cc7ce317a9861c3a06e

SHA256
2ccbbbb5292b5153cbe4d360e8d9d0cf223869476de2d053e752a00f9f76d88b

SHA512
ba5c25309facd9a7a819e707d4deb8d5d3cda503c3aaf54d2354511ab9cbca0a5455e658dcb895cbce9821185f52972fba3e0f5ae3ddd2f71cae1d63605afd65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a23f964adc5f0e33a6c28e8f5836ebb9

SHA1
8f3a8d63774e71582eb42e646713916811236a33

SHA256
d903343083935661b9b241f4501912d79bfe4b5f7f5407e6ea2d68530ea6c1ec

SHA512
555985713d6c3392b2672f539cb170a15b2c64f7faa080c049ebb08e43fee239c1e6d9388949ee934d1c87f9b447629c041db19b0f55a74ca8f28820a08e6aef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7835410d9fab952dc2e260c24c012d57

SHA1
53987ee9014caa99393625859cff9c71c8b7cc63

SHA256
61d1539de61c418f70049758eab17931ca8be992fe733f1c2594dbf155af0178

SHA512
4a5728bb940fb1f9e54b314526ca66f2e6a8de02acfe38cb203a4f0a6e6ebe1b3dde75af20427ed6b035ea27ebed9f1f9fa48e114dfd5cce68ec557a74810326

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
30cad34ac3d3a64b7ff0274781a35ce6

SHA1
310b01232cbbf8ce0da32dd1e613f7db2bbff698

SHA256
60dbfd6e67a2737bf39a61b137bf9abbe9405ec45e1ca421a2f50026e2a7c9f6

SHA512
c5a790d885394fe7d057d3a9a26bbc7e8efde931d08f1847e8ae1a039b8a70e2fcaebff642164416f88df36779d23a8c1c997805070fbc3f0000a52e85cd0d6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
30cad34ac3d3a64b7ff0274781a35ce6

SHA1
310b01232cbbf8ce0da32dd1e613f7db2bbff698

SHA256
60dbfd6e67a2737bf39a61b137bf9abbe9405ec45e1ca421a2f50026e2a7c9f6

SHA512
c5a790d885394fe7d057d3a9a26bbc7e8efde931d08f1847e8ae1a039b8a70e2fcaebff642164416f88df36779d23a8c1c997805070fbc3f0000a52e85cd0d6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
107KB

MD5
539d13fc9ec4062f98f1441d94e38eb3

SHA1
351df8b06d5c8abfc3ee8c5f97a47ccfd77f7871

SHA256
6329b19484daf799fa6d8b8fa225a111a084fac3301a9a677c1fac395174c1c2

SHA512
8177532be674b69854a350e9ab9c43fa5eb564ca42bc8bfe7ec04f01e224c0cd813935bc2853170795212ce575683447a4cb56957c275215e79999605d9a5e9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe584ddd.TMP

Filesize
101KB

MD5
7241853149766db3b0f1ca22e2b27a94

SHA1
7f69f5a42871a51f8bee60e133626b6beed4527b

SHA256
3da1ac82a96021d96d9d03380aa0fa8f68c165fb14cb2f318bddc18165634daf

SHA512
d52795f7077fb3cbfbb003d2306a6b1347929021216c4c294f6c7a99d5b0f434be1eb0b57a52293608f899535081e0775eff4708d5dbdd1e0f6214943feeba77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
94d9b2ff90ce4c2a986e2ad4d0cc04f4

SHA1
fd33e1b8d6ecc41cb4bc37c383fdd3a2b8164438

SHA256
b2e48bf634c0141e856c996f0ba3b31ada275ff140d0db3f49526ac2fc0f666d

SHA512
8babe9f3795bd3fe913cf7fced2b51c0c907279e41882bc0295abbe55932c9ba6e9b0c328af885d3bb4e75f7395a2f0410fc5fa1eefa9ef5a0678770f7a18840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
484B

MD5
a3334b932a02ba65e6c029b57413ce1a

SHA1
2b3f83e4d40a7bbde991b1d53c33bc4462047a63

SHA256
668145b4158b3fb6dd7911054d02ca4f303d468a92e5b7d2b37c4ce7260ce549

SHA512
7c90b74e7792916a6e42e4954f44bba3b7ef938ec62fbe4ed533c1d2f15dcd8343e2f8b70b98c7012943ab892cc370067ae35f963c94f02df44513714b774fb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
87ce5fae9a3e010f14a6fee6b010d45b

SHA1
e42548c1aabeb7ebb47c067f98083ee45251b960

SHA256
c1246880b4d58b36676bc28a9c0db5ffad0d8139c4a4c8ba0007d73fd66b45f1

SHA512
848371d5eca352c3ebf48482f4620e628a20fbbd24693190b18338cea6814a26de9b960449e261fcd11b66adf4f2347d0603e5699af23d7fbea3d8f871a860c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a8d8871d6f29e0804a497636caab50ba

SHA1
8b0b160a27c7f279780c7e63bcf5b36e4dd80ca7

SHA256
04f6614a63d4f61f04bc0097528291a60a6ab490afc9c7c1ad4983167550ba52

SHA512
7d61f449ccf78f4bc0af6a51a4542b48d9bb6ac885e768067212bdd185800e229be8a94b4c4517511375fe096bdd097e2922f1d284f540c998547c1526ddac9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d3433ed6904b6037b90a09955347b5f

SHA1
671bed4c6af4248c8c95a3586bdba0d9ccc351f4

SHA256
c8761731d2c407489728f1b7f7effe26be6cc6b7e6acfc9d1213e77813134585

SHA512
bd4cb1ff669648dc5f3e5dbaffba4d2f399428c598b6c1aaacbe60ccfd81eb2d3e7d58478a6ecabbdce45e3d38271b69f2741233dfef73e355dac0d17d749ee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad42f757797eea0699e1064d539bae28

SHA1
d247cab5175f228c3107bff56411a43b830ad6e8

SHA256
936d96fac0b84e8a7116a58eaf4a89d0a82b81018eb3f1ae2914b59f6365a8c0

SHA512
dc81efc0d2f8884380cd7076fd027df055afc4bf1b152d3796cc12a983aa9a8c8bf297288b77a2038634ed77e810415d4d2c4ee611c365d2e1bb27979546bdd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb4ebbaa9385899f1e89d8a9ce976660

SHA1
c9e305d1d539b176c70ee77f51b3c94ef707720b

SHA256
6a5211cc86a09315d67bddf805f18f1db3ba914e45c0b7c273d96bf22c67c391

SHA512
78af59bf1d563f60f96f4a0f138dfefdd36d124c194eea3a2ad8b29147788ceb9566931e3e819cac60fbde152e3a53580d65f9655acdef84ba5100333c1c8fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
625a2faea686d6c49b201e39dc1b0f4a

SHA1
6ce867917720b2ddfa76ebf6258977dc630afe28

SHA256
802138895366d647b11558735cb99d8ea78092da9f5b1a728efb61aab71c063e

SHA512
f9219fd7aed5289827cab96520ba99e48c94da6a8365753ae035d6023321bb877bd6dfef02ad9a05f8e991a4f52e9a4410fe0f192d42ef10c58303236ae28b9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
b9c7b14b2a8a95b8a3844753bb28b4fc

SHA1
73740bfb5c467dbaa6bf6d422c4adde733b7ecd4

SHA256
4b93e0cc0e045d0d3f5b1ba061e301b9aa129610ec4765206c456cd41262d129

SHA512
3265a8ad1627b78343af160aafb26f39617e791e2a01b1e4a41893acc601d05bc50788f22ce6c3373920235864f5d8e3741978597ba1610415ea85f5fde9281c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
fcca1b3c1d78451d0907355859d401e7

SHA1
2e6f3943fc4ed145e34a4159cdd8860675a2b469

SHA256
548dc1df900792967b3a1d98b6fa54f4e38a239cb8688a93ed6aa84aa9f7acd7

SHA512
a04859cac0b0842c05f7f07c49fc2071a7c7a30e03c96eedbd59c5c73d187ae15ef9d8c4f6ce5f98a321a8e808429c7950b24355f5bb4b7be0315f87f53abbbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
4f6bf5a5437fe998e0dabcc2dca185de

SHA1
e43c602e017a988ed6e604af0e34884e74bef6c2

SHA256
b9ec4323ce791874cf39d64632a676a44f40192700868e105b3d808cd000b841

SHA512
1d043e2a430a09065ea2efcbe49572d444c2fc4f12e4c0793a4065a40527c2a43e692ebef8bf69543b96b79ee9b3201b4e9c60c80bb95eb5af521a8ea69342e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
0f00efd7489c69ef857fe239fd787236

SHA1
8f8b02bd3a179ae606fc7746c6fbcadbe270c784

SHA256
b9ed56c1f748f87f3b96121227488d5cd7fcea5fae1534ef847b0ffe6b2dd7c5

SHA512
73b3d37656e7d053e22270a8c3dd41a4ecf3ef01b7aeda6a27a6cb269fd1df1d3e47b7ad4670b9e91eb593fda0d482838397c26c41087d05efb1e1439ffb5b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
5da43d866d074ff3057b4e2d9f56e590

SHA1
d9edf0993ce384751a7bd620e4656efad3c728fc

SHA256
17664c361327f37d3febeace6016a5f5a6174e203c739e22a8cf00b52b29af5e

SHA512
88b202e36fe5d8f428574d33e9c11dbf827ddf87c634968ad9d6a81934a2dd6d9d24932f4d4e8761883cabd7ffdf33864386cd226d3cd3fbb908452b382cdae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
0e153c1db52f8b8f63a8a5fb8c14a3af

SHA1
747131bf57dfdcac5719bb8947b5f4b40af3ae5a

SHA256
642bdb5617d94cb43cd7acfd8afba6a8a4eb726eec375647cbf207726734ccaa

SHA512
84ce952945b123e4942233029b83b103e60b1d7463384e99743db787936ec914ebde2c8112c76bdd974910af018339e6f449ab95dbea2c6054e09687d5d09ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5ac872.TMP

Filesize
368B

MD5
766434ccacf6effeeea142b91c53300e

SHA1
19b3e9704a4f03e84a6161605c800ef9911c746a

SHA256
4b55cadca38addf303fe6e33af0d3d73616cad6c178ff2d0f74884bd95a7cf1f

SHA512
8dea0fe7422aeab8d3a3ae929a4e50de54bd573009ef2cd95f2ee6b1ca3796bd5fcb8514a7b6ac230b3f554e492db6b62908436fa72001b032a02b3d6b5ba98d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
acea3dd0103e933d365accaa4ee3e223

SHA1
804c27417ce85e309dda6cfb61204b0302161695

SHA256
21fb73bd47a2553b4257b6975797a2021f77692148bbaa55150793e67e551cce

SHA512
6567020ec9bfb8594cfe2e7f26ec35ef154d750ad33c192af66b677e43476701002a84273f6336d2323e63fbf386b0004fc7b17b6cc6ce1c2e739964428bb72a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
a54422fe895445e4b484e5123b2ceb21

SHA1
591c6d0988156bdedefdb5d4128322fae0d29614

SHA256
d8d96fdc5488d31763a3cb64a50d44a543320321d6a35e7a8997a937840633c3

SHA512
d0fba1ca361afb9dd1ee95d36e739c1fe73ae4056fb3ae1872d156f26e9fa8ec4f9bfbe89ef6c66e0983a36dd1f1d86b6faed04f4715c22d9527a2a18aff2374

Download Submit
C:\Users\Admin\AppData\Local\Temp\50115987

Filesize
1.8MB

MD5
fc499c28afd20b9ab16b447daaac8026

SHA1
9d47824863a0404e61d10364658c19960ce893b8

SHA256
81460ebb56a2150e208c236dc719f4fe5ba688a493214cf8cf09413847347e63

SHA512
a26128e690d4fdf156f0190155891206017fad9243a1fed3c07c5ab4ff3feafd5780ee33e655bc770e426a2ca19cca078741babc88cefc1ba2b402b0ef3dfbe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\59562948

Filesize
1.8MB

MD5
000d9c85f16bc06c3b69d9d90e2d96f8

SHA1
41353acce4b7dd8ebb0cf872694290225ace5fce

SHA256
02b2f1762cbb7dfd84834674e57811a0869dc47fe40b0e74a9ef65e64f7279cc

SHA512
94433de268a5f2db8903daeb33feaad629626d129a87b809c1fd6bc3ff107c1e500e448add7a4e4cddd684615c8706c45315464402c1ab0b234a7b67b518d130

Download Submit
C:\Users\Admin\AppData\Local\Temp\60ccc110

Filesize
1.8MB

MD5
bd31296017c25737c0e3147e8be67a5c

SHA1
bc75dbb930c4694e56b93b17cc7b5507fb183e81

SHA256
f23a393e3c34bf1a2a3b433989139a8a263a0d73338f00e4beb20fa238e6e564

SHA512
f8a9655479e40fdb9b405ba70de8af6efe0185fb67d27140c0d2ae43794ed1315031968eb09f1d9b1e9c866311ac3a5e5d3d185a1bf15006aeffe575554fca55

Download Submit
C:\Users\Admin\AppData\Local\Temp\69753a74

Filesize
1.8MB

MD5
98e069e14fa549f9f8216b3b6f31ff16

SHA1
04ebfb5a4679f2540a4c0526dc6fccddeb108ac0

SHA256
675ee73dea51a26aff6d892c64838ee6239933fac78529ccba25796698bff597

SHA512
d01658cd92995879155a32fd5f87a6c728a13e7a03d89f460f6a24ebd6c0f89301be4b453781f468cfb600367ccb63619f7fe5573c8e860327c449a6301df2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nab5pzwv.x0e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aggbcwtqfgace.exe

Filesize
4.0MB

MD5
d076c4b5f5c42b44d583c534f78adbe7

SHA1
c35478e67d490145520be73277cd72cd4e837090

SHA256
2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8

SHA512
b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

Download Submit
C:\Users\Admin\AppData\Local\Temp\aggbcwtqfgace.exe

Filesize
4.0MB

MD5
d076c4b5f5c42b44d583c534f78adbe7

SHA1
c35478e67d490145520be73277cd72cd4e837090

SHA256
2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8

SHA512
b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

Download Submit
C:\Users\Admin\AppData\Local\Temp\aggbcwtqfgace.exe

Filesize
4.0MB

MD5
d076c4b5f5c42b44d583c534f78adbe7

SHA1
c35478e67d490145520be73277cd72cd4e837090

SHA256
2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8

SHA512
b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

Download Submit
C:\Users\Admin\AppData\Local\Temp\curiwhxpwup.exe

Filesize
4.0MB

MD5
d076c4b5f5c42b44d583c534f78adbe7

SHA1
c35478e67d490145520be73277cd72cd4e837090

SHA256
2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8

SHA512
b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

Download Submit
C:\Users\Admin\AppData\Local\Temp\curiwhxpwup.exe

Filesize
4.0MB

MD5
d076c4b5f5c42b44d583c534f78adbe7

SHA1
c35478e67d490145520be73277cd72cd4e837090

SHA256
2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8

SHA512
b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\KillDuplicate.cmd

Filesize
222B

MD5
68cecdf24aa2fd011ece466f00ef8450

SHA1
2f859046187e0d5286d0566fac590b1836f6e1b7

SHA256
64929489dc8a0d66ea95113d4e676368edb576ea85d23564d53346b21c202770

SHA512
471305140cf67abaec6927058853ef43c97bdca763398263fb7932550d72d69b2a9668b286df80b6b28e9dd1cba1c44aaa436931f42cc57766eff280fdb5477c

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\KillDuplicate.cmd

Filesize
222B

MD5
68cecdf24aa2fd011ece466f00ef8450

SHA1
2f859046187e0d5286d0566fac590b1836f6e1b7

SHA256
64929489dc8a0d66ea95113d4e676368edb576ea85d23564d53346b21c202770

SHA512
471305140cf67abaec6927058853ef43c97bdca763398263fb7932550d72d69b2a9668b286df80b6b28e9dd1cba1c44aaa436931f42cc57766eff280fdb5477c

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

Filesize
2.1MB

MD5
cfd06a23cdd0cad9964baef2d48709c3

SHA1
4fa67da62f36bc24e7655e1a13dd0e41e172586b

SHA256
dee2b650d898b91c6ef33f0170af1e3943c47b1a150962a9201b2575f8971acd

SHA512
be35d8fdb419153ae63671d67a6beb85e7e4b292c387ffa5ca3d16960c8bdaa6c482135dcc840f4693683a9475c1243dd262294f6ebf58290f6d4d3f13380546

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\AntiAV.data

Filesize
2.1MB

MD5
cfd06a23cdd0cad9964baef2d48709c3

SHA1
4fa67da62f36bc24e7655e1a13dd0e41e172586b

SHA256
dee2b650d898b91c6ef33f0170af1e3943c47b1a150962a9201b2575f8971acd

SHA512
be35d8fdb419153ae63671d67a6beb85e7e4b292c387ffa5ca3d16960c8bdaa6c482135dcc840f4693683a9475c1243dd262294f6ebf58290f6d4d3f13380546

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\Installer.exe

Filesize
21KB

MD5
7aa6a5a626cfa1260178d7bf1bd1dddb

SHA1
a7223bb6ba6efad042057120065c49eefb8fc8ea

SHA256
0179052465b4f304c3a946cd8c2022192ec672a1cb47bf1fe0bd6039cf77e83c

SHA512
2d52d43dd563d02dbfb6607ee2b9e058d11e7af2980eae88c9acf5de4adf4e41bf462841918e509cfad4055bc1cc8535fd3dd1143dec9ba9704134291aa170aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\Installer.exe

Filesize
21KB

MD5
7aa6a5a626cfa1260178d7bf1bd1dddb

SHA1
a7223bb6ba6efad042057120065c49eefb8fc8ea

SHA256
0179052465b4f304c3a946cd8c2022192ec672a1cb47bf1fe0bd6039cf77e83c

SHA512
2d52d43dd563d02dbfb6607ee2b9e058d11e7af2980eae88c9acf5de4adf4e41bf462841918e509cfad4055bc1cc8535fd3dd1143dec9ba9704134291aa170aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

Filesize
9KB

MD5
8bad123f5cf71fc89af4dcd0b7e0dc3a

SHA1
5769ca42cf63173aa1c0bc681f459d1072327390

SHA256
c55f35297c28db3ca4b6d4d32902fdfe0567ce1c2e47877b07ceca79772153d9

SHA512
de6f00d1f7bab9db779d4b7e07ba4ca7156def2b36861d5e0485037d6ad7b136920bd263c2e293b5acd85bcc6c8cd021db310944aac0758fe065bf0856b8e22a

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

Filesize
9KB

MD5
8bad123f5cf71fc89af4dcd0b7e0dc3a

SHA1
5769ca42cf63173aa1c0bc681f459d1072327390

SHA256
c55f35297c28db3ca4b6d4d32902fdfe0567ce1c2e47877b07ceca79772153d9

SHA512
de6f00d1f7bab9db779d4b7e07ba4ca7156def2b36861d5e0485037d6ad7b136920bd263c2e293b5acd85bcc6c8cd021db310944aac0758fe065bf0856b8e22a

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

Filesize
9KB

MD5
ac80078a2f3e04e44399d76f04ea0d9f

SHA1
efd7b3c6cc78cbc023a55c9a3bfb7857183ffca4

SHA256
cbb94cd884f6bac87ba0379ef1f53b994736614ccd8c01d57403fb515fb70219

SHA512
37c55dde344b570fc3c0b661461625ca619a3a16081c30ccc1e51257be3823cbb541aa23df4e949456b5bfb5392da1437333719b0471dd03d4cc07d995bde72f

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

Filesize
9KB

MD5
ac80078a2f3e04e44399d76f04ea0d9f

SHA1
efd7b3c6cc78cbc023a55c9a3bfb7857183ffca4

SHA256
cbb94cd884f6bac87ba0379ef1f53b994736614ccd8c01d57403fb515fb70219

SHA512
37c55dde344b570fc3c0b661461625ca619a3a16081c30ccc1e51257be3823cbb541aa23df4e949456b5bfb5392da1437333719b0471dd03d4cc07d995bde72f

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

Filesize
9KB

MD5
7df98a3b1c1e55f5568bb3bf91fc0f9a

SHA1
7dd14a2c8a725178b2559a4b7c5d9373db5fa58b

SHA256
4c3b0cc50af879e4e77a3ff5a5cefc66bcb96c4d3f4a4c61ffa7a5f4c5f1f864

SHA512
6542aeeea8ee96bdc13b7b055196c54deff8f665ff73d4349a374e68e3e128aeaadaea16285bf3a2898b994250fa9fd5fa1e4db87a4d0203ce06ed2e49c947e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

Filesize
9KB

MD5
7df98a3b1c1e55f5568bb3bf91fc0f9a

SHA1
7dd14a2c8a725178b2559a4b7c5d9373db5fa58b

SHA256
4c3b0cc50af879e4e77a3ff5a5cefc66bcb96c4d3f4a4c61ffa7a5f4c5f1f864

SHA512
6542aeeea8ee96bdc13b7b055196c54deff8f665ff73d4349a374e68e3e128aeaadaea16285bf3a2898b994250fa9fd5fa1e4db87a4d0203ce06ed2e49c947e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

Filesize
9KB

MD5
7703f67bf5a848f11f611f2adc8a9b9d

SHA1
36dad4be75e2cabab5dd5f12557c9677f17687ab

SHA256
da71fd4d58da91ce7d3ae21ca2c9887d95c9b414f4cdd8ba99ab8d04340e9139

SHA512
9a9eeab6a612ad9a51f631f16df9a9134f5b3a1ad3bad1005f79e2c972ecdcd166b8faae429fddc9c787603352ef380291e6b2add4a9e65108c9062dc245839f

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

Filesize
9KB

MD5
7703f67bf5a848f11f611f2adc8a9b9d

SHA1
36dad4be75e2cabab5dd5f12557c9677f17687ab

SHA256
da71fd4d58da91ce7d3ae21ca2c9887d95c9b414f4cdd8ba99ab8d04340e9139

SHA512
9a9eeab6a612ad9a51f631f16df9a9134f5b3a1ad3bad1005f79e2c972ecdcd166b8faae429fddc9c787603352ef380291e6b2add4a9e65108c9062dc245839f

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

Filesize
1.5MB

MD5
b43a823d7de0d2b913cba1aa08932eb6

SHA1
94b5f3aa5f8cbf976c3a87c9748bdc1133780f50

SHA256
b7ee030ccada50a20f87da01573fb9d0cff405fe9f5eab85df66acd020bc29af

SHA512
f45f20e7cccb752f5b4545f2e4f8418a173707e1131b2d4a8775d4dfef957b9f3319289dfd04f6c7ac0f7be09de6565c1d04ee570b275926f5f02822948ea431

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

Filesize
1.5MB

MD5
b43a823d7de0d2b913cba1aa08932eb6

SHA1
94b5f3aa5f8cbf976c3a87c9748bdc1133780f50

SHA256
b7ee030ccada50a20f87da01573fb9d0cff405fe9f5eab85df66acd020bc29af

SHA512
f45f20e7cccb752f5b4545f2e4f8418a173707e1131b2d4a8775d4dfef957b9f3319289dfd04f6c7ac0f7be09de6565c1d04ee570b275926f5f02822948ea431

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\file.bin

Filesize
1.5MB

MD5
164ffbb4ce7fe04803078a77496f8aeb

SHA1
4716b5e07012785ed9f021c8f556c69e5924f4b4

SHA256
32f533b3aa6bd4d96996ba38ca84aeba408a758247c3ab55919a7f2a46ea8326

SHA512
1f28144563188300fe45c676581e43c43dc2aaaf9e46369bf3fc3825179fbeee47668cdd4c4e5ee63758bd81a455b9f2e2f53305fb4993551317ec40df87a14b

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\file.bin

Filesize
1.5MB

MD5
164ffbb4ce7fe04803078a77496f8aeb

SHA1
4716b5e07012785ed9f021c8f556c69e5924f4b4

SHA256
32f533b3aa6bd4d96996ba38ca84aeba408a758247c3ab55919a7f2a46ea8326

SHA512
1f28144563188300fe45c676581e43c43dc2aaaf9e46369bf3fc3825179fbeee47668cdd4c4e5ee63758bd81a455b9f2e2f53305fb4993551317ec40df87a14b

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
471B

MD5
3b580d215631fc66c021c462c5d67341

SHA1
4f19ac12e1430b38954c6c9b5500f1dc6375259f

SHA256
dbf6cb5907b1210156b9ec4ce3c1ac9d687c5128b11ae90cdf23ef6c33d7b164

SHA512
e9eabb070774411fba16624844ee726f577829fca197a9afee2b96e2519dcbe5dde55388dffaba0d3bcb421e99ed33a63451a4cc385d64db4bac3c68be731e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
471B

MD5
3b580d215631fc66c021c462c5d67341

SHA1
4f19ac12e1430b38954c6c9b5500f1dc6375259f

SHA256
dbf6cb5907b1210156b9ec4ce3c1ac9d687c5128b11ae90cdf23ef6c33d7b164

SHA512
e9eabb070774411fba16624844ee726f577829fca197a9afee2b96e2519dcbe5dde55388dffaba0d3bcb421e99ed33a63451a4cc385d64db4bac3c68be731e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
471B

MD5
3b580d215631fc66c021c462c5d67341

SHA1
4f19ac12e1430b38954c6c9b5500f1dc6375259f

SHA256
dbf6cb5907b1210156b9ec4ce3c1ac9d687c5128b11ae90cdf23ef6c33d7b164

SHA512
e9eabb070774411fba16624844ee726f577829fca197a9afee2b96e2519dcbe5dde55388dffaba0d3bcb421e99ed33a63451a4cc385d64db4bac3c68be731e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\sxutfigxvoivvisl.exe

Filesize
2.5MB

MD5
0aff3062636c07e673c614e4210a7c7e

SHA1
bb9266faa98ecc5e3772e9599e4fcf2008a2adcd

SHA256
28725b63a75a38a88b1663d49d4ba43ab917ba0d0ce6b700c64be2fefd8ffa8f

SHA512
07eaf2b78d959ff6d792d9ff5b5e2783b23a1bd65c59e77094ff3e70f1c902e6bac9c890246989bb9b7b2eeed87076bee54289ef46ece9f8278652690628986e

Download Submit
C:\Users\Admin\AppData\Local\Temp\sxutfigxvoivvisl.exe

Filesize
2.5MB

MD5
0aff3062636c07e673c614e4210a7c7e

SHA1
bb9266faa98ecc5e3772e9599e4fcf2008a2adcd

SHA256
28725b63a75a38a88b1663d49d4ba43ab917ba0d0ce6b700c64be2fefd8ffa8f

SHA512
07eaf2b78d959ff6d792d9ff5b5e2783b23a1bd65c59e77094ff3e70f1c902e6bac9c890246989bb9b7b2eeed87076bee54289ef46ece9f8278652690628986e

Download Submit
C:\Users\Admin\AppData\Local\Temp\unmfiihiww.exe

Filesize
2.5MB

MD5
0aff3062636c07e673c614e4210a7c7e

SHA1
bb9266faa98ecc5e3772e9599e4fcf2008a2adcd

SHA256
28725b63a75a38a88b1663d49d4ba43ab917ba0d0ce6b700c64be2fefd8ffa8f

SHA512
07eaf2b78d959ff6d792d9ff5b5e2783b23a1bd65c59e77094ff3e70f1c902e6bac9c890246989bb9b7b2eeed87076bee54289ef46ece9f8278652690628986e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wujcfxahsrlpbv.exe

Filesize
2.5MB

MD5
0aff3062636c07e673c614e4210a7c7e

SHA1
bb9266faa98ecc5e3772e9599e4fcf2008a2adcd

SHA256
28725b63a75a38a88b1663d49d4ba43ab917ba0d0ce6b700c64be2fefd8ffa8f

SHA512
07eaf2b78d959ff6d792d9ff5b5e2783b23a1bd65c59e77094ff3e70f1c902e6bac9c890246989bb9b7b2eeed87076bee54289ef46ece9f8278652690628986e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wujcfxahsrlpbv.exe

Filesize
2.5MB

MD5
0aff3062636c07e673c614e4210a7c7e

SHA1
bb9266faa98ecc5e3772e9599e4fcf2008a2adcd

SHA256
28725b63a75a38a88b1663d49d4ba43ab917ba0d0ce6b700c64be2fefd8ffa8f

SHA512
07eaf2b78d959ff6d792d9ff5b5e2783b23a1bd65c59e77094ff3e70f1c902e6bac9c890246989bb9b7b2eeed87076bee54289ef46ece9f8278652690628986e

Download Submit
C:\Users\Admin\AppData\Roaming\HBLETLKQITVCF\UTJIEVLWJYX

Filesize
1.7MB

MD5
30d44fa38cfc5f86d2d3db9e30e0c97e

SHA1
d1b9b2222d739b82343acea120ee5a96ed5aca7c

SHA256
e4ff28817cce7c82d582cb3d4dd9ad43872499d5eb1a94cb01a6ad2a794946ce

SHA512
6c4e638537ca288a8ac8931a2668e33ff3a0bfe3c56adcaa849e1b47f51a1e14a939e5b88a169653636426175f31d6577e1864875971e56811b5f75bad1d4d2d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 164765.crdownload

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Users\Admin\Downloads\ZenSoft.rar

Filesize
7.5MB

MD5
3bb0741e92d0c274ff24da3de1d790b8

SHA1
ed2631564f7a6c813dd2c357ebd754e16c2c247e

SHA256
e0c30d0ce9d09217c0041787924ede795a8f074fba47730c998736b330b27267

SHA512
be2627f8c20824ea6529bb87d74ad808ab485015db4611a0dbfacfd04a51723b54516fc36de87e397cdfef7cc479d15fb3fdeef279d8ecabaac9a2dbe60ca49d

Download Submit
C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe

Filesize
6.3MB

MD5
78c15a22686adadcc13bdc5ee11c9d3f

SHA1
4dd46ebee0ddfb9b53afba078ea86c1ada87c13c

SHA256
70cf8f4db81beb93e09306673d79e5eaf7bfaea5eb7a16ee54a16cd490e4bd69

SHA512
c474d6ac06d95e0efd7d41053344684a48e9ce92653a29f4ff412108c2af9f3f1b75eed51c616a604fd25477970370ea49cf46743c6bc6f7c57dd07e44b5428a

Download Submit
C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe

Filesize
6.3MB

MD5
78c15a22686adadcc13bdc5ee11c9d3f

SHA1
4dd46ebee0ddfb9b53afba078ea86c1ada87c13c

SHA256
70cf8f4db81beb93e09306673d79e5eaf7bfaea5eb7a16ee54a16cd490e4bd69

SHA512
c474d6ac06d95e0efd7d41053344684a48e9ce92653a29f4ff412108c2af9f3f1b75eed51c616a604fd25477970370ea49cf46743c6bc6f7c57dd07e44b5428a

Download Submit
C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe

Filesize
6.3MB

MD5
78c15a22686adadcc13bdc5ee11c9d3f

SHA1
4dd46ebee0ddfb9b53afba078ea86c1ada87c13c

SHA256
70cf8f4db81beb93e09306673d79e5eaf7bfaea5eb7a16ee54a16cd490e4bd69

SHA512
c474d6ac06d95e0efd7d41053344684a48e9ce92653a29f4ff412108c2af9f3f1b75eed51c616a604fd25477970370ea49cf46743c6bc6f7c57dd07e44b5428a

Download Submit
C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe

Filesize
6.3MB

MD5
78c15a22686adadcc13bdc5ee11c9d3f

SHA1
4dd46ebee0ddfb9b53afba078ea86c1ada87c13c

SHA256
70cf8f4db81beb93e09306673d79e5eaf7bfaea5eb7a16ee54a16cd490e4bd69

SHA512
c474d6ac06d95e0efd7d41053344684a48e9ce92653a29f4ff412108c2af9f3f1b75eed51c616a604fd25477970370ea49cf46743c6bc6f7c57dd07e44b5428a

Download Submit
C:\Users\Admin\Downloads\ZenSoft\Set-up32X64bit.exe

Filesize
6.3MB

MD5
78c15a22686adadcc13bdc5ee11c9d3f

SHA1
4dd46ebee0ddfb9b53afba078ea86c1ada87c13c

SHA256
70cf8f4db81beb93e09306673d79e5eaf7bfaea5eb7a16ee54a16cd490e4bd69

SHA512
c474d6ac06d95e0efd7d41053344684a48e9ce92653a29f4ff412108c2af9f3f1b75eed51c616a604fd25477970370ea49cf46743c6bc6f7c57dd07e44b5428a

Download Submit
C:\Windows\Temp\{68DF01BA-934A-4C1C-A243-FCE6074CE6BF}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{68DF01BA-934A-4C1C-A243-FCE6074CE6BF}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
memory/1280-938-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/1280-937-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/1328-702-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/1328-700-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/1992-691-0x00000000005D0000-0x0000000000631000-memory.dmp

Filesize
388KB

Download
memory/1992-941-0x00000000005D0000-0x0000000000631000-memory.dmp

Filesize
388KB

Download
memory/1992-742-0x0000000000A80000-0x0000000000EB3000-memory.dmp

Filesize
4.2MB

Download
memory/1992-860-0x00000000005D0000-0x0000000000631000-memory.dmp

Filesize
388KB

Download
memory/1992-790-0x00000000005D0000-0x0000000000631000-memory.dmp

Filesize
388KB

Download
memory/1992-665-0x00007FFE1F650000-0x00007FFE1F845000-memory.dmp

Filesize
2.0MB

Download
memory/2644-701-0x0000000000A80000-0x0000000000EB3000-memory.dmp

Filesize
4.2MB

Download
memory/2644-902-0x0000000000520000-0x0000000000581000-memory.dmp

Filesize
388KB

Download
memory/2644-595-0x0000000000520000-0x0000000000581000-memory.dmp

Filesize
388KB

Download
memory/2644-617-0x00007FFE1F650000-0x00007FFE1F845000-memory.dmp

Filesize
2.0MB

Download
memory/2644-763-0x0000000000520000-0x0000000000581000-memory.dmp

Filesize
388KB

Download
memory/2644-674-0x0000000000520000-0x0000000000581000-memory.dmp

Filesize
388KB

Download
memory/3344-550-0x0000000000580000-0x00000000005E1000-memory.dmp

Filesize
388KB

Download
memory/3344-539-0x0000000000580000-0x00000000005E1000-memory.dmp

Filesize
388KB

Download
memory/3344-571-0x0000000000580000-0x00000000005E1000-memory.dmp

Filesize
388KB

Download
memory/3344-553-0x0000000000A80000-0x0000000000EB3000-memory.dmp

Filesize
4.2MB

Download
memory/3344-637-0x0000000000580000-0x00000000005E1000-memory.dmp

Filesize
388KB

Download
memory/3344-540-0x00007FFE1F650000-0x00007FFE1F845000-memory.dmp

Filesize
2.0MB

Download
memory/3760-980-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/3760-974-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/3812-533-0x0000000000060000-0x00000000000C1000-memory.dmp

Filesize
388KB

Download
memory/3812-546-0x0000000000060000-0x00000000000C1000-memory.dmp

Filesize
388KB

Download
memory/3812-513-0x0000000000A80000-0x0000000000EB3000-memory.dmp

Filesize
4.2MB

Download
memory/3812-512-0x0000000000060000-0x00000000000C1000-memory.dmp

Filesize
388KB

Download
memory/3812-564-0x0000000000060000-0x00000000000C1000-memory.dmp

Filesize
388KB

Download
memory/3812-504-0x00007FFE1F650000-0x00007FFE1F845000-memory.dmp

Filesize
2.0MB

Download
memory/3900-538-0x00007FFE1F650000-0x00007FFE1F845000-memory.dmp

Filesize
2.0MB

Download
memory/4044-680-0x0000000004B60000-0x0000000004B6A000-memory.dmp

Filesize
40KB

Download
memory/4044-679-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/4044-739-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4044-999-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4044-764-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/4044-667-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4044-668-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/4044-672-0x0000000005180000-0x0000000005724000-memory.dmp

Filesize
5.6MB

Download
memory/4044-681-0x0000000004E20000-0x0000000004E86000-memory.dmp

Filesize
408KB

Download
memory/4044-673-0x0000000004BD0000-0x0000000004C62000-memory.dmp

Filesize
584KB

Download
memory/4620-506-0x00007FFE1F650000-0x00007FFE1F845000-memory.dmp

Filesize
2.0MB

Download
memory/4648-501-0x00007FFE1F650000-0x00007FFE1F845000-memory.dmp

Filesize
2.0MB

Download
memory/4760-863-0x00000000073C0000-0x00000000073C8000-memory.dmp

Filesize
32KB

Download
memory/4760-851-0x0000000007070000-0x000000000708A000-memory.dmp

Filesize
104KB

Download
memory/4760-709-0x0000000002760000-0x0000000002796000-memory.dmp

Filesize
216KB

Download
memory/4760-710-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4760-711-0x00000000048C0000-0x00000000048D0000-memory.dmp

Filesize
64KB

Download
memory/4760-870-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4760-862-0x00000000073E0000-0x00000000073FA000-memory.dmp

Filesize
104KB

Download
memory/4760-861-0x00000000072D0000-0x00000000072DE000-memory.dmp

Filesize
56KB

Download
memory/4760-727-0x0000000004F00000-0x0000000005528000-memory.dmp

Filesize
6.2MB

Download
memory/4760-859-0x0000000007320000-0x00000000073B6000-memory.dmp

Filesize
600KB

Download
memory/4760-857-0x0000000007110000-0x000000000711A000-memory.dmp

Filesize
40KB

Download
memory/4760-817-0x0000000071420000-0x0000000071BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4760-712-0x00000000048C0000-0x00000000048D0000-memory.dmp

Filesize
64KB

Download
memory/4760-850-0x00000000076C0000-0x0000000007D3A000-memory.dmp

Filesize
6.5MB

Download
memory/4760-849-0x0000000006330000-0x000000000634E000-memory.dmp

Filesize
120KB

Download
memory/4760-839-0x000000006D6E0000-0x000000006D72C000-memory.dmp

Filesize
304KB

Download
memory/4760-838-0x0000000006D50000-0x0000000006D82000-memory.dmp

Filesize
200KB

Download
memory/4760-837-0x00000000048C0000-0x00000000048D0000-memory.dmp

Filesize
64KB

Download
memory/4760-768-0x0000000005D50000-0x0000000005D6E000-memory.dmp

Filesize
120KB

Download
memory/4760-728-0x0000000004E80000-0x0000000004EA2000-memory.dmp

Filesize
136KB

Download
memory/4760-818-0x00000000048C0000-0x00000000048D0000-memory.dmp

Filesize
64KB

Download
memory/4760-734-0x0000000005690000-0x00000000056F6000-memory.dmp

Filesize
408KB

Download
memory/4964-496-0x00007FFE1F650000-0x00007FFE1F845000-memory.dmp

Filesize
2.0MB

Download
memory/4964-493-0x0000000073110000-0x0000000074364000-memory.dmp

Filesize
18.3MB

Download