7cbe7d346f86a0f771e9cd2957f588b28310251461033a1e8e1fa47513f4544c

Resubmissions

08-12-2023 21:49

231208-1pd5wseed7 9

08-12-2023 21:32

231208-1d5hpsedh7 10

Analysis

max time kernel
357s
max time network
350s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
08-12-2023 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Abbys Loader.exe
Size

8.3MB
MD5

e3ffc5689f47470d27cc887f436a6314
SHA1

6dcd3bd8efe25473799c60e4a5c6bd452c6f173f
SHA256

7cbe7d346f86a0f771e9cd2957f588b28310251461033a1e8e1fa47513f4544c
SHA512

28f644253daf94d4f5032fa9cc2037240d3d35ce5fae90c9f0254db65798baa29079d9e4a0b961b61ffe0cb3e26ae11945a83f84da03565b2fb8b9798e7e4de3
SSDEEP

196608:ib44X4ZJfaTLcGSp5Ri2SiW8kW8oaMjITKYODW:C44X4Z4TLcGSp5b28kKrBvW

Score

9^/10

discovery evasion persistence

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Abbys Loader.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions Abbys Loader.exe
Downloads MZ/PE file

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	Abbys Loader.exe

Drops file in Drivers directory 9 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\deviodrv.sys	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\awealloc.sys	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET632.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET630.tmp	rundll32.exe
File created	C:\Windows\system32\DRIVERS\SET630.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET631.tmp	rundll32.exe
File created	C:\Windows\system32\DRIVERS\SET631.tmp	rundll32.exe
File created	C:\Windows\system32\DRIVERS\SET632.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\imdisk.sys	rundll32.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Abbys Loader.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools Abbys Loader.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	Abbys Loader.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Abbys Loader.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Abbys Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Abbys Loader.exe

Executes dropped EXE 12 IoCs

Processes:

config.execonfig.exeCheatEngine75.exeCheatEngine75.tmpCheatEngine75.exeCheatEngine75.tmp_setup64.tmpKernelmoduleunloader.exewindowsrepair.exeCheat Engine.execheatengine-x86_64-SSE4-AVX2.exeDotNetDataCollector32.exe

pid	process
4332	config.exe
2720	config.exe
1880	CheatEngine75.exe
3252	CheatEngine75.tmp
4860	CheatEngine75.exe
4372	CheatEngine75.tmp
3456	_setup64.tmp
2128	Kernelmoduleunloader.exe
2720	windowsrepair.exe
240	Cheat Engine.exe
752	cheatengine-x86_64-SSE4-AVX2.exe
4512	DotNetDataCollector32.exe

Loads dropped DLL 8 IoCs

Processes:

CheatEngine75.tmpcheatengine-x86_64-SSE4-AVX2.exe

pid	process
3252	CheatEngine75.tmp
752	cheatengine-x86_64-SSE4-AVX2.exe
752	cheatengine-x86_64-SSE4-AVX2.exe
752	cheatengine-x86_64-SSE4-AVX2.exe
752	cheatengine-x86_64-SSE4-AVX2.exe
752	cheatengine-x86_64-SSE4-AVX2.exe
752	cheatengine-x86_64-SSE4-AVX2.exe
752	cheatengine-x86_64-SSE4-AVX2.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exe

pid process

1492 icacls.exe
5096 icacls.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

rundll32.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" rundll32.exe

pid	process
1492	icacls.exe
5096	icacls.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Checks for any installed AV software in registry 1 TTPs 3 IoCs

Security Software Discovery

T1518.001

Processes:

CheatEngine75.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Browser\Installed	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Browser\Installed	CheatEngine75.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3240588775-3651084335-2656120175-1000\SOFTWARE\Avira\Browser\Installed	CheatEngine75.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Abbys Loader.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Abbys Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Abbys Loader.exe

Drops file in System32 directory 64 IoCs

Processes:

cheatengine-x86_64-SSE4-AVX2.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM32\wintypes.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\ucrtbase.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\DWrite.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\WindowsCodecs.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\SET658.tmp	rundll32.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\apphelp.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\ole32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\CRYPTSP.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\rtutils.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\ncrypt.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\SHLWAPI.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\PROPSYS.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\msvcrt.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\OLEAUT32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\NSI.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\clbcatq.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\USER32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\msvcp110_win.dll	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Windows\SysWOW64\SET658.tmp	rundll32.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\wintypes.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\psapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\VAULTCLI.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\imdisk.exe	rundll32.exe
File created	C:\Windows\system32\SET645.tmp	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\SET657.tmp	rundll32.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\VCRUNTIME140_CLR0400.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\SHCORE.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\profext.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\SET643.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\SET646.tmp	rundll32.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\Windows.StateRepositoryPS.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\rsaenh.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\bcrypt.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\iphlpapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\DNSAPI.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\wbem\fastprox.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\fwpuclnt.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\NTASN1.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\sechost.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\wbemcomn.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\OneCoreCommonProxyStub.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\Windows.System.Launcher.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\wow64base.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\wow64con.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\wow64cpu.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\GDI32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\NETAPI32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\dataexchange.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\dhcpcsvc6.DLL	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\rasapi32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\secur32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SysWOW64\sxs.dll	cheatengine-x86_64-SSE4-AVX2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Abbys Loader.exe

pid process

2804 Abbys Loader.exe

Drops file in Program Files directory 64 IoCs

Processes:

cheatengine-x86_64-SSE4-AVX2.exeCheatEngine75.tmpconfig.exe

description	ioc	process
File opened for modification	C:\Program Files\Cheat Engine 7.5\DLL\kernel32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\dll\ucrtbase.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\shlwapi.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\winnsi.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\Cheat Engine 7.5\include\is-MRFKA.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\include\sec_api\is-5F3T5.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\autorun\is-8R768.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-N0B3N.tmp	CheatEngine75.tmp
File opened for modification	C:\Program Files\Cheat Engine 7.5\wmswsock.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\rasman.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\Windows.StateRepositoryCore.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\Cheat Engine 7.5\is-MVTKG.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-GAGJ6.tmp	CheatEngine75.tmp
File opened for modification	C:\Program Files\Cheat Engine 7.5\symbols\dll\DXCore.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\dll\Windows.Storage.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\ucrtbase_clr0400.i386.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\Cheat Engine 7.5\include\is-ILO51.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\include\sec_api\is-5BP70.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\is-9CEDB.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\autorun\is-J6A68.tmp	CheatEngine75.tmp
File opened for modification	C:\Program Files\Cheat Engine 7.5\symbols\dll\user32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\crypt32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\msvcp110_win.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\Cheat Engine 7.5\languages\is-F9GIJ.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\autorun\images\is-9QUJT.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-VG2QL.tmp	CheatEngine75.tmp
File opened for modification	C:\Program Files\Cheat Engine 7.5\tcc64-64.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\dll\msvcrt.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\symbols\dll\InputHost.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\symbols\dll\advapi32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\DataExchange.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\Cheat Engine 7.5\is-BM7HF.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\plugins\is-1POLS.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\plugins\is-8LSKS.tmp	CheatEngine75.tmp
File opened for modification	C:\Program Files\Cheat Engine 7.5\dll\gdi32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\dll\tcc64-64.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\cryptbase.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\Abbys Loader.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\Cheat Engine 7.5\languages\is-S6NO6.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-EL9VO.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-1I7TK.tmp	CheatEngine75.tmp
File opened for modification	C:\Program Files\Cheat Engine 7.5\dll\gdi32full.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\win64\symsrv.dll	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-39E03.tmp	CheatEngine75.tmp
File opened for modification	C:\Program Files\Cheat Engine 7.5\rsaenh.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\wuxtheme.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\ImDisk\DiscUtilsDevio.exe	config.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	CheatEngine75.tmp
File opened for modification	C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector64.dll	CheatEngine75.tmp
File opened for modification	C:\Program Files\Cheat Engine 7.5\bcryptprimitives.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\symbols\dll\winhttp.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\wgdi32full.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\Cheat Engine 7.5\unins000.dat	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\autorun\is-GVKFG.tmp	CheatEngine75.tmp
File opened for modification	C:\Program Files\Cheat Engine 7.5\symbols\DLL\cryptbase.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\symbols\dll\LFS.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\mlang.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\clibs64\lfs.dll	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\include\is-25M39.tmp	CheatEngine75.tmp
File created	C:\Program Files\Cheat Engine 7.5\badassets\is-Q20AO.tmp	CheatEngine75.tmp
File opened for modification	C:\Program Files\Cheat Engine 7.5\wwin32u.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\rasapi32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files\Cheat Engine 7.5\is-OMB40.tmp	CheatEngine75.tmp

Drops file in Windows directory 22 IoCs

Processes:

cheatengine-x86_64-SSE4-AVX2.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.22000.434_none_1630a2eb2777c45d\gdiplus.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\INF\SET647.tmp	rundll32.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467\comctl32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\0bba5450e1a6c54699676b87d274f05d\System.Net.Http.ni.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\581aeeaa2a7e5e20d12cc1c5ccceb08d\System.Configuration.ni.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\37f752fa0f0436bb445cac49fb118e3f\System.Xml.ni.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_e541a94fcce8ed6d\comctl32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\INF\imdisk.inf	rundll32.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\0255ec6dbdf5c884ff88ccf0b3140cf7\WindowsBase.ni.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System\1a1b2c0d59576b0e7cc713a8229a5ff1\System.ni.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\a629dc226209d249e95a8bc6319a940d\System.Core.ni.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrcompression.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\wminet_utils.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22000.1_none_6ec7c6847ea94424\comctl32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\f69214dbc8f5830f991f31ddb8ab6a6c\System.Runtime.Serialization.ni.dll	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Windows\INF\SET647.tmp	rundll32.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

424 sc.exe
1920 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3180 2804 WerFault.exe Abbys Loader.exe

pid	process
424	sc.exe
1920	sc.exe

pid	pid_target	process	target process
3180	2804	WerFault.exe	Abbys Loader.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

runonce.exeCheatEngine75.tmp

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CheatEngine75.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	CheatEngine75.tmp

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exechrome.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133465458986878132"	chrome.exe

Modifies registry class 41 IoCs

Processes:

msedge.exeCheatEngine75.tmprundll32.execonfig.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3240588775-3651084335-2656120175-1000\{B9C14467-013B-4F41-B03C-10B7597D24C1}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CETRAINER\ = "CheatEngine"	CheatEngine75.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\ = "Cheat Engine"	CheatEngine75.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\shell\open	CheatEngine75.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\command	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\command\ = "\"C:\\Program Files\\ImDisk\\ImDisk-Dlg.exe\" RM %L"	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\command	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\command	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\DefaultIcon	CheatEngine75.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\DefaultIcon\ = "C:\\Program Files\\Cheat Engine 7.5\\Cheat Engine.exe,0"	CheatEngine75.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\shell\open\command\ = "\"C:\\Program Files\\Cheat Engine 7.5\\Cheat Engine.exe\" \"%1\""	CheatEngine75.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\ = "Unmount ImDisk Virtual Disk"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\command\ = "rundll32.exe imdisk.cpl,RunDLL_RemoveDevice %L"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\ = "Save disk contents as image file"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\Icon = "\"C:\\Program Files\\ImDisk\\config.exe\""	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\shell\open\command	CheatEngine75.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\Icon = "\"C:\\Program Files\\ImDisk\\config.exe\""	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile	config.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\ = "Unmount ImDisk Virtual Disk"	config.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\ = "Save disk contents as image file"	config.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\command\ = "\"C:\\Program Files\\ImDisk\\ImDisk-Dlg.exe\" CP %L"	config.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\ = "Mount as ImDisk Virtual Disk"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\command	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\command	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount	config.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\command\ = "rundll32.exe imdisk.cpl,RunDLL_MountFile %L"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\ = "Mount as ImDisk Virtual Disk"	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\shell	CheatEngine75.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\Icon = "\"C:\\Program Files\\ImDisk\\config.exe\""	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.CETRAINER	CheatEngine75.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.CT	CheatEngine75.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CT\ = "CheatEngine"	CheatEngine75.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine	CheatEngine75.tmp
Key created	\REGISTRY\USER\S-1-5-21-3240588775-3651084335-2656120175-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\command\ = "rundll32.exe imdisk.cpl,RunDLL_SaveImageFile %L"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\command\ = "\"C:\\Program Files\\ImDisk\\MountImg.exe\" \"%L\""	config.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 859980.crdownload:SmartScreen msedge.exe
Runs net.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 859980.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Abbys Loader.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exechrome.exemsedge.exemsedge.exe

pid	process
2804	Abbys Loader.exe
2940	msedge.exe
2940	msedge.exe
1380	msedge.exe
1380	msedge.exe
3964	msedge.exe
3964	msedge.exe
2220	identity_helper.exe
2220	identity_helper.exe
3336	msedge.exe
3336	msedge.exe
2008	msedge.exe
2008	msedge.exe
1040	msedge.exe
1040	msedge.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
4284	chrome.exe
4284	chrome.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
4284	chrome.exe
4284	chrome.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2804	Abbys Loader.exe
2320	msedge.exe
2320	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

cheatengine-x86_64-SSE4-AVX2.exe

pid process

752 cheatengine-x86_64-SSE4-AVX2.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

668

pid	process
752	cheatengine-x86_64-SSE4-AVX2.exe

pid	process
668

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 54 IoCs

Processes:

msedge.exemsedge.exechrome.exemsedge.exe

pid	process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Abbys Loader.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	2804	Abbys Loader.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exemsedge.exe

pid	process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exemsedge.exechrome.exe

pid	process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Abbys Loader.exe

pid process

2804 Abbys Loader.exe
2804 Abbys Loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Abbys Loader.exemsedge.exe

description	pid	process	target process
PID 2804 wrote to memory of 1380	2804	Abbys Loader.exe	msedge.exe
PID 2804 wrote to memory of 1380	2804	Abbys Loader.exe	msedge.exe
PID 1380 wrote to memory of 4544	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4544	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2632	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2940	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2940	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4660	1380	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Abbys Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Abbys Loader.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sourceforge.net/projects/imdisk-toolkit/
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbaddc3cb8,0x7ffbaddc3cc8,0x7ffbaddc3cd8
3⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
3⤵
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
3⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
3⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
3⤵
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
3⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
3⤵
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
3⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
3⤵
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
3⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
3⤵
PID:1780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
3⤵
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6752 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
3⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
3⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
3⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
3⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
3⤵
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
3⤵
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
3⤵
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
3⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
3⤵
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
3⤵
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
3⤵
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
3⤵
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
3⤵
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
3⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
3⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
3⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
3⤵
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,7419664121472562575,11060896128055970091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=necrum.win/dashboard/
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffbaddc3cb8,0x7ffbaddc3cc8,0x7ffbaddc3cd8
3⤵
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,5808527312253578712,483524981273902977,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
3⤵
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,5808527312253578712,483524981273902977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,5808527312253578712,483524981273902977,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
3⤵
PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,5808527312253578712,483524981273902977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
3⤵
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,5808527312253578712,483524981273902977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
3⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,5808527312253578712,483524981273902977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
3⤵
PID:3952

C:\Windows\System32\Wbem\wmic.exe
"wmic" baseboard get serialnumber
2⤵
PID:1336

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command "Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show('You must close them in order to use our Loader. Exe: - DotNetDataCollector32', 'We found bad software!')"
2⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 2640
2⤵
- Program crash
PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_ImDiskTk-x64.zip\ImDiskTk20220826\install.bat" "
1⤵
PID:4216

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_ImDiskTk-x64.zip\ImDiskTk20220826\install.bat" 7 "
2⤵
PID:2652

C:\Windows\system32\extrac32.exe
extrac32.exe /e /l "C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81" "C:\Users\Admin\AppData\Local\Temp\Temp1_ImDiskTk-x64.zip\ImDiskTk20220826\files.cab"
3⤵
PID:228

C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\config.exe
"C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\config.exe"
3⤵
- Executes dropped EXE
PID:4332

C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\config.exe
"C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\config.exe" /UAC "C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\config.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
PID:2720

C:\Windows\SYSTEM32\rundll32.exe
rundll32 setupapi.dll,InstallHinfSection DefaultInstall 128 driver\imdisk.inf
5⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
PID:3812

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
6⤵
- Checks processor information in registry
PID:4800

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
7⤵
PID:328

C:\Windows\SYSTEM32\reg.exe
reg copy HKLM\SOFTWARE\ImDisk\DriverBackup HKLM\SYSTEM\CurrentControlSet\Services\ImDisk\Parameters /f
5⤵
PID:1852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbadb09758,0x7ffbadb09768,0x7ffbadb09778
2⤵
PID:4608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:8
2⤵
PID:2280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:2
2⤵
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:8
2⤵
PID:4168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3212 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:1
2⤵
PID:5052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:1
2⤵
PID:1104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4060 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:1
2⤵
PID:4144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4704 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:8
2⤵
PID:2624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4880 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:8
2⤵
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5032 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:8
2⤵
PID:2344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3680 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:8
2⤵
PID:3368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:8
2⤵
PID:3048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:8
2⤵
PID:4568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:8
2⤵
PID:884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1952,i,4944454461165413932,13178286473131217549,131072 /prefetch:8
2⤵
PID:2624

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbaddc3cb8,0x7ffbaddc3cc8,0x7ffbaddc3cd8
2⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
2⤵
PID:2304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
2⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
2⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
2⤵
PID:708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
2⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
2⤵
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
2⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
2⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
2⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5072 /prefetch:8
2⤵
- Modifies registry class
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5112 /prefetch:8
2⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
2⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
2⤵
PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
2⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
2⤵
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
2⤵
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
2⤵
PID:3724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
2⤵
PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
2⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
2⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
2⤵
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
2⤵
PID:1312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
2⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
2⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
2⤵
PID:328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
2⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
2⤵
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7340 /prefetch:8
2⤵
PID:832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,4201228395315609010,6321257100094940604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7420 /prefetch:8
2⤵
PID:976

C:\Users\Admin\Downloads\CheatEngine75.exe
"C:\Users\Admin\Downloads\CheatEngine75.exe"
2⤵
- Executes dropped EXE
PID:1880

C:\Users\Admin\AppData\Local\Temp\is-NBTBO.tmp\CheatEngine75.tmp
"C:\Users\Admin\AppData\Local\Temp\is-NBTBO.tmp\CheatEngine75.tmp" /SL5="$502BC,2349502,832512,C:\Users\Admin\Downloads\CheatEngine75.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:3252

C:\Users\Admin\AppData\Local\Temp\is-D1TTI.tmp\CheatEngine75.exe
"C:\Users\Admin\AppData\Local\Temp\is-D1TTI.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
4⤵
- Executes dropped EXE
PID:4860

C:\Users\Admin\AppData\Local\Temp\is-7AR18.tmp\CheatEngine75.tmp
"C:\Users\Admin\AppData\Local\Temp\is-7AR18.tmp\CheatEngine75.tmp" /SL5="$501E4,26511452,832512,C:\Users\Admin\AppData\Local\Temp\is-D1TTI.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
PID:4372

C:\Windows\SYSTEM32\net.exe
"net" stop BadlionAntic
6⤵
PID:1088

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BadlionAntic
7⤵
PID:1496

C:\Windows\SYSTEM32\net.exe
"net" stop BadlionAnticheat
6⤵
PID:2008

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BadlionAnticheat
7⤵
PID:1668

C:\Windows\SYSTEM32\sc.exe
"sc" delete BadlionAntic
6⤵
- Launches sc.exe
PID:1920

C:\Windows\SYSTEM32\sc.exe
"sc" delete BadlionAnticheat
6⤵
- Launches sc.exe
PID:424

C:\Users\Admin\AppData\Local\Temp\is-I8K1V.tmp\_isetup\_setup64.tmp
helper 105 0x3D0
6⤵
- Executes dropped EXE
PID:3456

C:\Windows\system32\icacls.exe
"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
6⤵
- Modifies file permissions
PID:5096

C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe
"C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP
6⤵
- Executes dropped EXE
PID:2128

C:\Program Files\Cheat Engine 7.5\windowsrepair.exe
"C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s
6⤵
- Executes dropped EXE
PID:2720

C:\Windows\system32\icacls.exe
"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
6⤵
- Modifies file permissions
PID:1492

C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe
"C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"
4⤵
- Executes dropped EXE
PID:240

C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
"C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:752

C:\Program Files\Cheat Engine 7.5\DotNetDataCollector32.exe
"C:\Program Files\Cheat Engine 7.5\DotNetDataCollector32.exe" cedotnetpipe2804_240936937
6⤵
- Executes dropped EXE
PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2804 -ip 2804
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe

Filesize
389KB

MD5
f921416197c2ae407d53ba5712c3930a

SHA1
6a7daa7372e93c48758b9752c8a5a673b525632b

SHA256
e31b233ddf070798cc0381cc6285f6f79ea0c17b99737f7547618dcfd36cdc0e

SHA512
0139efb76c2107d0497be9910836d7c19329e4399aa8d46bbe17ae63d56ab73004c51b650ce38d79681c22c2d1b77078a7d7185431882baf3e7bef473ac95dce

Download Submit
C:\Program Files\Cheat Engine 7.5\badassets\scoreboard.png

Filesize
5KB

MD5
5cff22e5655d267b559261c37a423871

SHA1
b60ae22dfd7843dd1522663a3f46b3e505744b0f

SHA256
a8d8227b8e97a713e0f1f5db5286b3db786b7148c1c8eb3d4bbfe683dc940db9

SHA512
e00f5b4a7fa1989382df800d168871530917fcd99efcfe4418ef1b7e8473caea015f0b252cac6a982be93b5d873f4e9acdb460c8e03ae1c6eea9c37f84105e50

Download Submit
C:\Program Files\ImDisk\MountImg.exe

Filesize
55KB

MD5
a1f89dbe8abd9882fe193f30a2573088

SHA1
a2ebaf075806cbe6ef2a4fae9b93f2aeef86f56b

SHA256
bf070a5b618ccbc5533a6fc10d89a4e6014ca15a3bdf8ac1fa56c56a821b132e

SHA512
9f527289451ae951ad081d76936a351bd19e31c7c3becc5c86952e83dd70b9e48d6650ee32d972c6be32bf747e3e066ef875a4175d8eb2775a02fbb0f7cae10d

Download Submit
C:\Program Files\ImDisk\RamDiskUI.exe

Filesize
67KB

MD5
e8beba83e216609b18f4c66c68a1fbef

SHA1
966253811c021301ed486e83e8bacdf876e1ee0f

SHA256
e23ea1b9fd07a5d389f89e057ea973389a0253812729bdc410d414f17267e395

SHA512
fabdd08164e74501496a11398d3507c03a4ebabb83e5a3ef5a8058d338b823741eaa295c2206dc5011684c14bbd4c4f4df0c35479b077045257c7c4cc60e41d3

Download Submit
C:\Program Files\ImDisk\config.exe

Filesize
64KB

MD5
34ebbbc5576bb4b92e8a455b95e876d3

SHA1
0d51c0393b14ae5cbe458a5312eecfd77704d74b

SHA256
70bfe7f6c62bb1602b9852c16b71dc463f0bdbdd55ab422ab559b9d0337470a7

SHA512
4c7889c57170f10342c7378779b01d1eeb790cbf6375e9efc05407b81498467b59f92ec0495ef0d1a7a51072bc620c696e9587390f3c741280d63624b5d6892a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2c65ebc6-f3d8-42f0-9c1e-4d3e05ac20f6.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
682B

MD5
30efcaf55566f1c3077d96387ab4c774

SHA1
cd60d181e0fb88144af326c67b0cf35d0038b0d0

SHA256
c7360c8df0f78dda0ef90cbc3c0a82672917933bef6416a379eecfed8d058317

SHA512
970139de9ee3e7d6d3101beaec738ef7f95444ebeb4592d9f2cfc10da539dc2ffee548a8f394a10b567245ec5a9acc3b11d8042adc35eed4405143c92ce697b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
442773c68212446ee41a6a3c595c3cbb

SHA1
6f0493ce7f30c97112f7a15efae5be1c0684aef6

SHA256
e363472b6a6f3266f6ac9bf5f9a0d34961164bce6d514c189fc80e6264f9b22d

SHA512
35bc6ae7023b95491cff3af9fb50ea736ef1e1a769994468e08322db062ea17adb61915493fb15ee37bf45dce8d73ba229dcda765f1b18c994fc82cc7e92f611

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d254ef70b68c5f8abb3bb2c041fad25e

SHA1
6ca3be993745705c57e81e223ff5f998ae37769d

SHA256
43396e370df1781a09a27c49d6ccb9ee260d117ef3f7a18d5eb4586943c05b4a

SHA512
90c74cd8a6d947ba9bc307ccb5ef735d89e80f52db23519d568e345adca3e5154ff8b7bfd33ff9ab03fcdc1390c634e77e58fbde1e1858ead2182bb8dfe334cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
ecbf867a2e7fb8841adb05d7e4e94895

SHA1
f41e9590136e7a3520058ffa3be7d6d6e06393a3

SHA256
512eb0a3c0ab15b04ad13db9cc030638084c9420ddb16d47e04c4fa2eb1119f3

SHA512
b7650feca968af943b90ebcfbca1d0692989dd79dddbd8b38eaff81bd038168b0300e95f08ed46bfad3516687351b86cbb9e6883f400e3317ef9c7bfab4153fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
4KB

MD5
43bba89e3b3f1acf140b23b409f9c0f7

SHA1
7b56d0b9d8c2bd58d5ad075fc0cd2a7e29662a9a

SHA256
74e9ba6a79051d5180c383cd2cf2334bcdc83b2519d77c052e8dba92dfe18633

SHA512
00bac01ebc5ec70977906eff17534742a0bf19fec03d547db8e42fca3c046000972feb2a4cd6125f4c76567c461231120ffcf19577239381660fbbeeffa7e2d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
9c02aad1bcb5797f62a500d1defb4028

SHA1
f37a15070b9f4e1e1d7b9b5e04e576d4c42064ae

SHA256
f9834ca9a140567f8665415567cf92aabcf7840cbb03bb437326ff076177933f

SHA512
1bf327c6625a64f40b9b857a7d494dc53e9f4f66ed2aeae840d615bc73bb5e85771f608de2aee4fdfd751f586e3c2236d9c6d8890d50fad64530afbb8293a1fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
160KB

MD5
7cce8faa527f62e3fa1bc3c15b70150a

SHA1
426d8bfb00d5a843ca61531931a8347f215862e0

SHA256
0f6caee74bd2a0aff4a8b16044aa0ab468b05e3310d04d8554115ca3507b1e90

SHA512
62da0d08eed864639ad711c5d0f9bca53591bb536b8e19e634243572551a0511ef785eef9e0190166a86f4cbd9faf92f852cc2f04b01cedaf0bdc7b6a54d4d0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
164KB

MD5
e07057fe7df0a3bfc0b21b1218d18708

SHA1
99578c096f1dd4fe6a90d2a574b02780871d0336

SHA256
a5ba78f00f2f0102f483eb5b7aa84bccfae9351b81878289b8d99f509847f577

SHA512
6364fa6170b14ee2d18553ef506fe5a71b1568f3e2b09d27cf4d90ba8bc2a5667efe54c508237db7506763cc8a7e39339b8497cef87513a18c18d9982bb1cac5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ae25675f0cdb55d538ab8c64663ab66

SHA1
6a81a76a843ebad56bfc96cc40cac045fbcdf384

SHA256
8b6e8afb01a484b89f0e1da06a0b8787d2a67307dda148c4a0590a630cec315c

SHA512
460a53687a454be7e379e468f09dbb121e43941191994a9496295093b5d1168e018d6f0a0769267a727c1c71c90db9494a4bdb6e7c830c6656558e813515ed74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
63f9a0695dc0fe4093ca23f0ff0fcd4a

SHA1
74116ba7349dd902ff354b462cc02e5090bda18e

SHA256
1827cc039fb778ee297ac22ca02d9cb02739be4fd0927db0d4d8229d79f97ff1

SHA512
37400f23c5a512ccb5e646e74df0929295149a69890d7d063cbdea333777180ab0842bad795417c638a6751d343b467783fad2a413287136d7376b3eaae68446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd3a7be89106326f6f5a86db2c0741c5

SHA1
3142feda21b514830599f61e6b0a6c0b1723c651

SHA256
1c7ebda260331e423a4253876fdfa9e1f10de4bf1b14a4d8edf410a8a1dd0719

SHA512
36bff157c34df1db1015952e509b20f9cec5763b60a076173cef4daef2ebf77868d374392b428f1361722a86a2eb2cd6c4a98987c6f34267f1a662d683441f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ee2939560b8c0d69124883827cdd26b1

SHA1
b8230d6fa42e20a75f4d1afefd0ba93aefdc3b13

SHA256
bfb53cbb111eb235160480a1d7e6f6aa141a7c17f30cfc0fba1eb2bf8f4c0610

SHA512
634c4a92b77e85adc80649f594fc219a37f5898da3e7a217b976d354ef78878501d8db7cb16159ac24ffaf57cfa670c35ebf6b547369336c3964f9d2b50aac17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
63KB

MD5
8e378d9e173f0fb3cd91ebea9aef4c02

SHA1
abe69de17a299929fd3c3b2b32052d0764a9f566

SHA256
bac8b84c337700fc4170588a11e491b11e230097c79e92d4df5d98392f1331e5

SHA512
32f1baea9f94bb0f805ea9cf1d4cadc728052a75ff1d8be3666ea79043aba56f61268563a348acca0d5fa47d67d0f20c5df0a8bf2082151cc08512fb39e6e69d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
86KB

MD5
bea49ea7d3f47dfd4c4f0986af4d3454

SHA1
b96c2cfd6b3b790af4df8691c126d8329f5c8488

SHA256
5b03ee1f364f6f3f03788f20120bdfa2835a20c6a105510c71d72cddc5fa5300

SHA512
dab859f370169536e65dd32ba4e7e0f0ad5aa936b6c7d26dcc202445808c2864ad81ba3a620251f0496c7f67a7a2e23d28628e8fa2b68f68b0a9d6b29c668550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
16KB

MD5
aa36ef163a75e6cdccf97a2c86273b4a

SHA1
3bc3c7cc7a6658334ca686b5a3687d75431d31b3

SHA256
9866f38dca92a062fd2dad944abf3b4f087cede9bb31768f11a8e2ce44a75d34

SHA512
deb53ad06f920d4024f85c8aab0d5b7e04fba3584e091189beb578a09ad5c1bb5b31d0b0fc67b9042a6649956fe2ebf64ff1dd45a65aaf519019f6f67d171fbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
17KB

MD5
40f02d6a3c42c0c37bbfdd77d34d1317

SHA1
1d57521040d49ba97602ea7e22e14b14f7aa6ab7

SHA256
403f149a188cb9a6d2c872684c87b3aecb3db2d57255c5abcaefe2c4c5749218

SHA512
ad6c22978cab39de5b388ea508cd1b3029d1080d301b84f96f20806a52522f57a5fc3b34cef52da29d49aebc5edaa71ae62b0254d3c27abae49a3e36e0d6ef0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
28KB

MD5
c149ab6351e6d05fd3dc4fb93a94fae5

SHA1
107d89a766b20622ec0c4ccd9c50718a0d98e1cd

SHA256
a1bc42a01ee5df2434b17aa1c995bcc983402a3ae742b7aa2b4e3634c9f88e39

SHA512
2f91efb8d8d74ac60eb5ee3a7a94203c1cafa1b279f20321aa83d7849134f89ec54d957cc47f500d181abbbea950b86b9c340f43eb9f486bd3712c41be5737a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
63KB

MD5
34d5015941e4901485c7974667b85162

SHA1
cf032e42cf197dcc3022001a0bde9d74eb11ac15

SHA256
5c166a5d40aeefd0679a14f95e47ff28824e66abba82adfa30be41803cc25632

SHA512
42cef1d6847f535a6e8afc0469b9f5ef79ce4ab21512ac7eeda8ef9667d5f24bb33b30aba9a29824b3d853d41d4addf6bdee2042cf4fbd0a033b61657c671f0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
134KB

MD5
e7a56a7f650115eab5cacc036069709d

SHA1
7c1d6e4c6b7d2fa4819963b67de48770abfd7224

SHA256
0c82dca9989585ad461daf8bbe1c21a2c254620eadfeea318e515b95a00fef1c

SHA512
9eeb51fc6caf80e8e14046491c93693710b2319fb50aa40bc52f878ab586138971ecd4183d0f9eea627fb1c453d111a4c3827aa300fbeac06e9713d0e3c16029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
63KB

MD5
1f2f241ddfba908fb5fd0382f2196a5e

SHA1
0235d85d8173ba7b6c085f5a58e0235e00fcf70c

SHA256
c7eaef0b79808f7804119c492c3123bd6835d710b761e33128a19080289cad29

SHA512
b675316046a45dd288869bfdffe8ad5b057634d1f36e0ba78e94351c94505138abd280430e5f6bf46085db2860b4581da2df84bc21ab402fb1a4e9e600857dd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
492KB

MD5
6d266d52482ac7fb36495cef65a48618

SHA1
6b660e1de72f4f386993811296ebc535996bd84d

SHA256
18a9d6157be7b518f79bc4fb7017c5a6db83cc82208e27f384ff8c9db7de83ff

SHA512
8b3b899a1529d0a9f726f03a6973d90a73cbba192ef08d36667e1270352c4737812ba647fc4f20e730eafd9ab240ac5ea625b6254ecad8b0b1cf571da3f81a1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8eba1bcb79d9bd8a_0

Filesize
3KB

MD5
6e50425e6c858d66156566be1446d1d7

SHA1
31e5530118c469f4b8a08758119beb5a8cb104fb

SHA256
84356a4cf2d0356ffa44ce816895dcb1d52dc8656c7dafcf666cd336deb08092

SHA512
b86cb3083b8d3cd057f9d4933828fdd8da81cec008fe775cf092f257cb7a61b8efa64f77a72863578d1f9add1ba35f858ecab5ef54a42b1801fd59fb508e61c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9c14981b0a92663c_0

Filesize
33KB

MD5
66b1e9498b066166dc59f16443d8fee9

SHA1
906be8dbdd19378ad69e442dbf052b2c8469c316

SHA256
4e0a41cb73c6950c560486b9b94da940bcfc49f0dfdd0087d1ba4621e9ba0416

SHA512
81af8c94bf686face91e5662dc856475757899c40b6d921213eabca54e93e4376dc70ef23fadb1601909dc09f88e1569080d45412dd73d7d7d6985720a58187f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b7a0c41b0ef30fa6_0

Filesize
306B

MD5
3702d7db2a3a263302e199fa0c1d726c

SHA1
ef5439e374d4fc39b1a4c45f6259463cb10e8060

SHA256
cbf52d955579f6169a0281d80b8563df5a988179055c7ad01c7ca71f0368fe2e

SHA512
99347ca4b2929e3a3ab570b250c20d22d683b7ba3ca4e7062b06a5200dc41cbc3eed33bc2c540a885ea91f8d55b92f2171c6229caf6234d22aeb1df182a69820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e679ef9d1f25da5a_0

Filesize
365KB

MD5
569f6de187fde726d86da8d875c1aa33

SHA1
53c5b1de9bd4a199c575f44caae0fdcc950c15b6

SHA256
372bf3e3d3b00319d031e4ade886fe1a04c1977a558d475a3185de44a437676c

SHA512
87db31fe9f7870623ee1139718ab4e0c05e579c48f383cb4570df0cbed7340e8fb0f8e15c10b5e5d44c01091f5cc44a08fe5e921e173fe634af874d65a6f3178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
83d8402c2a6eea2c2c7184ef2ac7c9ae

SHA1
8b902f342561c4826e61d458d42920da5ecc500d

SHA256
f5337dc8e5c99f9fd4f5c33c0ad45c077d65b2a2089304aac37410827fe05cda

SHA512
02efd4df3b393628e6258f83d2ec58fc4221a034b5d36744dfcce549411b54f6cee9f135f2c1c0750e0bad01e0c4c89837a5f2d8169a13a74a70444d7f728bbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
9711925ad36f2dd4b90d1d7e6ffd7043

SHA1
bd660c5abb0f3d78e53a7437e6ed13767e01949a

SHA256
2f6770883145d62410e9392aa1d4dd2b6114622c77f16b661ecc34396f77f222

SHA512
7d2b2c0678b7d8b30e3f73d40a6a048470206b88f1e0056c987f711f950fe96e82a7bf4bd0c3c2de945d7e78e0735da3f476899f376871ab91d3e9723a9e6760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
21f84f88a553b0554fc815924cdd0b72

SHA1
e6ca6daca9b55d8c78e80144e9426e797f4e05f7

SHA256
d7d403ec668aca8d184f00c38efddd602a0a3e4938cebecc4f41e5a1e81b2869

SHA512
ac720be4453a9043b5707e4cc5967cc7836c9cf2316a4b42fe7992632128bd6098c6f230beff9fa70eb798323cf8a314acb1cf7f5964d14c31f70557f2fe356c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
b7e05ee7d35ee9b2f3e28cb17d4676b3

SHA1
41c3f966063c49583dee9d222fffaff53d9d9b08

SHA256
489f9c6d20f584f07dc03504d5b57aaf9bfc0b8bfb072b14284fe8151a018161

SHA512
85b29e3497bf2d73273f487e8296882ff32fbab2d56b2e3da7fd72c66cb1df876b2d0b194ac26c33f1983e6720717602c3df0c84477ac0cae51100852d426d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
581591ab3409fb5e5e0f711686208a5d

SHA1
7112b8bd6400a64585164fd41cb6411e3f9dcf25

SHA256
aeeb174ae063344fcff1b8a4399b4b43a78e41905b29fc86e01b442f32219552

SHA512
fb32e4b82021a0251f53e5506b82a64d576b3fd25070e7c34e90bd27821e2c0fbc92959fa33561057b3b1942497922d7facdffe6ae02f67fd037cd4d88b566f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
d348d1ca329158614cd27a982516012d

SHA1
d1cac0e6eb7bae1327c385d8bbfda2da60d2d636

SHA256
282d414227878f8fd7411242c59c53e518429ece4f734b0a32becd4ca98d953b

SHA512
54e3cae4fcb86807de1a078430d17b08bb3b7f9d7e4b910bda294980ca2e579eefb7becb8f74080a9f602832f6cf68cfcc92e9f7972d7c981d21a517eb863377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
565921f79a2f95f0f14e1f567b7babbc

SHA1
08aea7ba1b285786a45b9bfa6007e2f86e94cecb

SHA256
c942fcbd9c44c6b56995e9dd176b7279c8b3fcdfdcde29acd544a44325ac9e37

SHA512
57052fa15210a7ff07c0978bbbd2c36ace25a5ac9ff1a86cc664399bc3f7317572a956122b2a6adda76a148cf7dbefca0af1e3fac6372a018d2ce4483652cf8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
aed87fe8a7cf90dbb7e1d73ebf5e55aa

SHA1
5a4ad542535d9dabf031aad843916bde0379f7e1

SHA256
20e3e24bee71e77def926bc61d451a22eb89bf61f17e649d58566a5b12f0c147

SHA512
eef20f63288638e328892bddc4fce71bbc697dcfba436b014c4b78f61ebc836c850bd34af40b11434f7687bf8c55ce4f17dab90b88c3ad43578dd1e04f363c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
3852f3af922b3432d54530aae6677c4e

SHA1
346409702196a0aa89dce390befed9df8562756a

SHA256
9b3a5343d39122347829ec9ea5ba943ec055be6af46e99447247b2d37ed8bb8c

SHA512
ec68f8aaff4a0a1ce06019bc61ed891c07cf6f77e5f2b2b19f2f7590563784c77fa8d2480942744f9e7f1d7b3cdaa99341ce94b1e9200db5bc0e9ea534839481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35535b9dac8cb7d40279399cf93136c6

SHA1
390c4f2a1d12fdc2399fc62ad877efc06210c418

SHA256
f7c5f1a0931bc2de30f54b56b148ba7d325412891e77617d053fce1661303d6d

SHA512
b6cde8e57a482a289caf4e1f1482630f9a16c46dc390be841fb71dd7c02f914aabbe89cf8f896deea07ea04b9231e467d9364ecd56ef179e1b37155281c321b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
3a2fffe59d8c1606ada51da660a08561

SHA1
2df53a847662461edf4977ec0d6a05524e7ad19e

SHA256
44af2c9e2c5011f60e8a714557e98f6f7d78b22f3fa16bda0e324642792bee55

SHA512
6c9e2749182c46a0c5830b8ae3eae78010f6bd79e699cd841ae2a89f81e82974421a6b16bdcaf4d179b356e80852d6768de584eeeed774487148cd6eb1478a73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
63a71bab087e1f87a9f7f89c49453933

SHA1
33bb1c8c84dd417607fcf6602712d66c1476f455

SHA256
241bcee0798dc912fdf09453fc1403bcd21ea202a5c164ae8ca4043b55697b9b

SHA512
19b1bdfefa1fa1b84f5ac62fc300188fd31da0ebd5aafcf899cc4d8f1cd235f6428090001796bf8395d99b00362cef2e04d9c55f8acf6039c1f4d750626166b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
3af1a7ddfb40a1838f5a90876a9c7b78

SHA1
537d868a609a4e6117c7fa2289ff224797592d3c

SHA256
a424a58a8b7c171f8acedcb9807ecffa5493179eaba26e4f49d4f6e378500167

SHA512
04faad653ad11f9d3d435a066166124f4c1a72d98a2b195ff521c977542c2751c2e833b384ef6f73f42a2d381bdaf2581eb8cdd68bfff2b3004d6aef7887b590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
5d4457bdf494074b753e56b595193d16

SHA1
29936527ce4a5f5c0d633eb2c12eb1d3d62506c1

SHA256
4f158f2fd031705482d433d565ca22eef3fb75ca4c0237a6bd30278c58eed3b9

SHA512
072d1c30732d61b56edd33810e9c366cc1f33cca107cb3cb1acf1f321c7a8b5bf16d9d5f25296bc555a857d4e016d3e6778abfac7f0c195793b6ac87e1b2358b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
b4f32001cb51094c9616c1165606c216

SHA1
0206b460fa32b4dca8bf07d3d9490d1dde4e26b2

SHA256
b4fed02d81a9f106db1702eeee952d8340242bd323f17c1b70f5f70869fbbab5

SHA512
5e7b0107917a638b146334b3bbe01004e0754c9f4f1fc5b23a98c5431a7ee17ccd63df9b6b52f5075a6bdec5a311dba648ff6a7d9a96a146591fb3b06ad73c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
534a228e4533b4ee8c64ea0093e7420b

SHA1
24c9fed0c0ad36125e9141214c7e412d3939985c

SHA256
879dd9f2e565e56d83438aa55325dd2ea18e6dc345f50ed838932a7ed6b466b9

SHA512
13f37dcd15d901130448fdd0fd5184e01402ea8b2b8aaf5c6c8936aa79b1d59cafccd548aca3ca0237237f5d170ce83b59297f8feb34622c457a4b12c7ce9401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
98092b09ed21398c5356239054850bf8

SHA1
e986405049bb25c56a8fdca5e25f659aa86f81a4

SHA256
64fd284564853b30ee03cde22f1b4e7a4aef409a8c63a30799f726956515129e

SHA512
d73dc84041dff57884b20ce92271570bf6ba6d787b20cc2c098e425bb68535df2a6d9454ce42e75869d952d4bcf7b3dffa41ab22158bc12a2a161e2a28cbdf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
2e06eddc59d8a8cfd75ebe1ac61603cb

SHA1
4c771d6ebeecc337dcddc3c3c194d98e5a4c8975

SHA256
66f8451d1676ee445233ec982d8216b192fbb119fadba70ff3e157d870c7b68f

SHA512
ce90fca73641c4c036249cfd50157b0bad320cf42eb3c6a7310ffc12387a5f823d833a92fd897d3195e84fee974157128b92563bdfd4b02bcc35ca9912404944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
61b69b24551a9a704ef5a84c63b4a052

SHA1
a515fd8f2f5e91dceab4da02555faac9b209109e

SHA256
022ecd152d8efefaf47f85f4db65bd9565b7737968a787a61ca133e9c877690e

SHA512
23ebc18217737d60b8295e173fb51d8ebee089101b1ad4c0adde6d7aea5f0089ea355067202615fec1ace9cfb8b716f02127f0faf3bc81b489006e7e27fa3eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
1d303b6555ebdebefc46ce11c992e345

SHA1
5e73d5b05008c8fc585c3c886ed5e39951075cdf

SHA256
75f8b4a5f0181a24d36b14725afa493685b68cc7f281c4d7fd685280c289edec

SHA512
0c8fa380e419741967dc77e05ffe334ceb24dae107968543eb4bf918d64e16d48f26c2232214bc9d4d1d88cfc6f49a13e666c61a7e190432034206d30724ebdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
3024d37e37915eda906ff127098b91a9

SHA1
416e6304c64a7bc12b3f0c514273000cb72d521a

SHA256
b809661cd8561639801d27a8b99f5c9a350dfa1a5559d3cc8ef9d83498672f23

SHA512
a39057302f8f48ce0520678cf02b8025cd5cc261dd8dcfc5b46c12df9e52791b4424579912462ec40f1e10f72aba3c787187dd393ef82ccacd341dc0e9cdb694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
faa6645211e780ecd4bd4977380a6047

SHA1
59076bb81bd1004c52dc5349069b909a2576c315

SHA256
975f1e8f2f1ac24325fefb892b16edaeb2f93675e4b0598f3e0bb6b93cd73bf4

SHA512
975d8a5cb52202333559d805f30676ac414c89fdcb22605b4b15c287a8d4082965251545b4e1512f7dab68d7f1fc95cf63b5ec002a3daed198a59ae40eba0a87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e812658833adcdfa2958d4501961d9bc

SHA1
d53aebca837a302f91aaf7c1835702778d90da60

SHA256
a2954a713d477f73a1a370ba12d14644614982e375abfc78953f7e7993a8f61b

SHA512
c6ce85c156ac1c2bd706c4baea18e5509b0a814806c9c8758a21aa1a0921eedcb1dddb7f2dbc8de512446a3c28108370fecf4d4902af4b3b1398cd9c11c1ea9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
2bf3d3e3295404c0aa2c2d0ef4b4a38e

SHA1
c6892cfec7af9029ffe5499af2bb595f2bc07ac5

SHA256
30caab8ecbb3e6b60cfa3df6bae6dc8d0b6420e1816c0a63c0ea6bbed4911d94

SHA512
7b76ef4154f09d8a1490ae6f3f9a26c5f33a27df265fccd46e4a6bcdf3a5fda60b0645b745cf199847702b848c028da62ede9be154d8e876bec7286a90894bb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
ebdfdd348cdf307adb1d28ba5637779e

SHA1
7df171545424211855b25655da277251de75d1d8

SHA256
e85cadb2faa7f7539360118f98c31064c7d627f7a4a23d78dbecf72bdd1d2379

SHA512
924f6f1230646e964ebce923e0c8370f52438e1a4623531ace1f15247a5df67a7fd96a86d7ca8f01f33e3d237b67296403de545ffc7c66cb45e4e9d62b9c18a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9c794c3a5d6dc3a3b22fecfa347a8455

SHA1
f80e90dab28760729992301c1f8d5ea63f4b028f

SHA256
0b72fa1cca098a1b6d19a61142b94ea1ff413efcea1d8cc96fd11778e9437e55

SHA512
d1de685e3316df532d3497c3a0b9347eb8fdf9d0b3ef7822a0642a451232792129d92bf5899533345adc90db7f2b457c8a2c5ceab01b0b282f333a68599d85bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
1f097d796081fbd15d860f942260f625

SHA1
2854b4e08812e7f040c56bf2c5408faae47fab03

SHA256
b87b31ef71ecace1371eb526af587ada463f66a783841ddc03eefe14738d3b1c

SHA512
a056cc6171cf5f50902bba6dd7c476f6b1bccf94edbac154494ef26b3e671e8adf4de19d81d0801bd86f718db1417b552c2ad482a2b9448c28188bdb27a71357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
8a48f5642bfe7239f439bde221807fa7

SHA1
51a14fce1bf7d4cdd9e3c7ea3bd0d4e1e7e9f637

SHA256
83fabdb55bb7386480b23d9be79c2ecee0cef73707b56e4dd2023f5f6675cfe2

SHA512
40337c710faa8483a2d756f5789cfb4e71d90427614f5822e294ee1f89668540de40f9275fc4bae6a0e20b5f1252dc4311a374ba2a3d5b29b1f3944be8386de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580172.TMP

Filesize
537B

MD5
ccb1f34ad4589b0a1fc6edadc683f45a

SHA1
982c87181d8063cb5a00ed2e65941d5dd2a0f377

SHA256
d74c1afbf0a68933f9b647f8106782b7553554673a55249f591b2784d87e1e22

SHA512
fb31ec64601bd6c801f66bf9a0e043c64ae5133ecb53baa487d70a367c95be909e9cc7f8545572bbebb318b0968e10fd9d8dafd8a74496225dce42f71af27c0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
22efcdd7ab5fe1a6f73ce51ef4f8713b

SHA1
14b3da31843b1a1260552df72e4d99d915cefe16

SHA256
24c132f1457bbdecb67e5a70567b9507214012a0611659a0b840916abe662712

SHA512
799f4f0ce6242198b4207a1d6fd1eed07383433e61c6c724172344466e7d712260d18382201282254e9f36037b18a7b34f6e0b26c4e5a1359a7348b8ea56589e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
87e3a3f89645d1b4d854d22ed82de6af

SHA1
5810f69fb1c532c5b5187278618ec0d8b3444215

SHA256
7093e5ec59b49d169d52859eed3040d7d2d29953aa587f8d25647a6e358cc2b0

SHA512
92c36f5f9190d951a909c2745171718fca76e86bd5992a40ce782619b3ae345069eabff26715db77b7017177682e101f326205257fdbd3d5a41ef04f033a94a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
09ef06cefc550e4a560e7fdc1e707469

SHA1
a68cb5ac9684531e1ba8c9018ae9a296c8ef91c9

SHA256
96f7dfb65589ba3c48c7ac95e814b14668e0341f2493fef780056fac85767df5

SHA512
d7acf51f850540471ea8d4f784845d99755d47049ac089c03063a6f2c51392215802b0ca49babf372508e62202d136c9eb21f9f7aa0429aa688d4a73e48279a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
48eff36060cc1542f187011de3599dc8

SHA1
a515ae0cfe4607a3b83e66bdf7490f6f4a99444f

SHA256
be3128aba2590e8d58e3264988ce26ce3b3a52ffe77490be08f382da7ec95cc2

SHA512
40ee3ec36358f53462263dc888fc43c0e5afd3c1e583cb25a13c3fee7d96e7f258741c7366d05a177d9f4380cd8513a28dded956656784d77a7463b79cbb055a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
53f8cbe5e790604297cc2aa985e946e4

SHA1
b6565e629935e9cff609d8331ffa9b1192313915

SHA256
ecb8e7448d7e02d5b006d0b62879fb9b9a0fed204699c4e02be0385d22e6ec3d

SHA512
693003826a83c635a12967038b988d7fc46b9f4b7420a24827a729259f9f0ab5965bc8e0d1bc1162fb20c391748d6e6e87639424b95764efe29037d6d81848fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IMDISK~1.81\driver\awealloc\amd64\awealloc.sys

Filesize
35KB

MD5
4db300dc68d6313671e122b3fc6b2411

SHA1
ef616f847e050c1c2f6ef6ff3c2a6b8e512a3af6

SHA256
5493a502f5ece4f3fa5eaac23c7d8e747535396835087e175041067b72607255

SHA512
eebff0d1afe4bdd5529dcedd917b60f60c47e1a48353cbd552928cc9e0ea7a8b9575131cd84578c81b3d62860f1578ec46973df65ec76ae8291b2ba8b8e012ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IMDISK~1.81\driver\cli\amd64\imdisk.exe

Filesize
64KB

MD5
935e5daf2c65c0694c9b346ad051fd02

SHA1
36012a3b255c91bcbc0c47e600b88e3f72dae227

SHA256
e080f0a7748d247b39e7b508a0afcce23e0d7de00794b29079952a62c343f8d0

SHA512
a1f797a3cf7b65be75bcf69404eceb04d6ab30abd66a072337de10d2da9acdac609862502503d6def14f29be342c118c7ebade9131e26c52ec3c40118cc8d025

Download Submit
C:\Users\Admin\AppData\Local\Temp\IMDISK~1.81\driver\cli\i386\imdisk.exe

Filesize
64KB

MD5
fe7911be7f2cca37cb4d51efe545e3c0

SHA1
e12aa937f0f1b9578614385731b408281d88c398

SHA256
5fb13fbb8e3211ea945777c327da9e2c1aef887b22186de3aed4a82d78cd1649

SHA512
42dc722ba84198ae2f1173cdb3724fc18e0875d57a0aaffa622c00b488e441f1eafc3c4887dd75901bff3e4e27f25af217af08c2da267166c9e0abf68acd7723

Download Submit
C:\Users\Admin\AppData\Local\Temp\IMDISK~1.81\driver\cpl\amd64\imdisk.cpl

Filesize
137KB

MD5
c4d4ee2e46cb53aa2445b16424d5421c

SHA1
d28968a4170443dbf334655e0fa876e8efd535d4

SHA256
7a6ff361f220effe547ec6f47b15c2d4fe55ec7f53ad530498af84982c4b7eff

SHA512
06f2b26fc93ab6f52b58419e4021be2f638b22e44b416f3ea6677bc375a44daea27644a1a9b8a192834895a7837e48ed0be5f9682ff729c7ca3ee82016040346

Download Submit
C:\Users\Admin\AppData\Local\Temp\IMDISK~1.81\driver\cpl\i386\imdisk.cpl

Filesize
125KB

MD5
6ec6f677d158935d7cd5f72c4a634d92

SHA1
923c7b593905fb7dd9f0d314092c5ea64f509090

SHA256
004daa5c0ea6ef576bc879508247d9334a7aaa95bebeacb494b11eecc9f0d2d0

SHA512
dbb5626e9f098c7adbc7e40e6eee9ecdc6953ed5cd5086568fde61843c2daea43a755b33c9e348204a490dc166d5a8d8ebab32a0784f8e0749298c879e79158c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IMDISK~1.81\driver\deviodrv\amd64\deviodrv.sys

Filesize
37KB

MD5
dd48cd537c487af53ac674cc9c17dc8f

SHA1
4bc2e2e91e74d41f6dff612e402d3c9b3f56d16b

SHA256
5b4867f3a86ac3cd0f07d7ccd381a00c2ad77bdb355df406c36126c9f394ffb5

SHA512
852e96ca7b1b5ae80dda0a1c0cce06b85b0cc9f4a27c88215d5990ab7256379239426a02d1c86d790e68fab987a16ef5cef8b5b68f293810da69c5209d4b34e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IMDISK~1.81\driver\svc\amd64\imdsksvc.exe

Filesize
33KB

MD5
9dd9fa88f6961948b6f40ee3981debd0

SHA1
a0fdaf916a791fbc3ed62268debb00846a1fb962

SHA256
107c7537cf4444a6b815e23cc0e496ddf45b8127aaa0bf22265bea4ec6a49e33

SHA512
ce06a52b2a11ebb820a61c069fd398940fa5c2df96f33d63b18fdd13fb2f7e7c1f2bd14ddd8bf3a3cf33d8a79a048450d15aadd3210ce2e86ceff2bf10540be6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IMDISK~1.81\driver\sys\amd64\imdisk.sys

Filesize
62KB

MD5
e8f81f9ba6245ecae906957117cd7204

SHA1
409e03f912d7822dfe63da2cd739bf92a2563c73

SHA256
9840607b61897acbc5af13f12d013494d0507e0a80e9be063525bcb22369b560

SHA512
537dc9165371bbe24499b3634040c6df719eceed18022c20458aed20e0be86dce4b3e9296025288293758785dd88f481006b264f4d09144865c88b1e7ad11a6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IMDISK~1.81\driver\uninstall_imdisk.cmd

Filesize
1KB

MD5
c617b2ad808af8f0d23cdb64f01b9d00

SHA1
ab292f2be3ee521f9419af6f8cffc5580c44d220

SHA256
c3b21ac0c3bea333b7257a76638d2d52f455ddad8a9f2185910a32fa0b453ca8

SHA512
700146ce07fea44b1aa3ddb7e40fe538ab8941e0d2d4de4bf4bd863a1c60818bed109be15ff402c1223c5cdb2395625655d6a51f91f6a1bde623aff75074c857

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\209AWE~1.SYS

Filesize
20KB

MD5
ea8714e533d5a8ffdda4d99abc24bc51

SHA1
a6fcbcfbd4034286f712562c5083bedc5148bd74

SHA256
8e966e1fd804771631739dea4a2a39063a57796bbdcbf1a113f0187564c14a72

SHA512
56803f1d97eb84d17d15e7c2841519305fccacbad656c67ea21afa2ef1372d14212706ac4671b69c09ef1941f3021a4e6ed5178cf1723e3d595179b3c2ff9a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\DevioNet.dll

Filesize
34KB

MD5
27f3e92a01b1505a4dfd871a50076ba2

SHA1
aff152317a56754d2ba25fa762dc1fca47469142

SHA256
62d5336808f413b841ab171fe28da55608af24b6594ebeed38240ec1dbf71743

SHA512
47502ceca23aaa51d73a7b9e8f5784ea4ec4a9c4745b1791fdd1052483f75330c206c84ea860df170ed93aed4e293fe8bac0f6475a7e99968e8b988f3c8544cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\DiscUtils.Core.dll

Filesize
179KB

MD5
1f155d112e904822196f83825dff9b56

SHA1
a105a496b6fe0eedc65c7fa8722eaac2bf100b34

SHA256
3aa631a83875ffe69e1ebc23803e10a63ae54b9b591cc9e761d6204ccef4c180

SHA512
60eb331fb16f7efcfe4196f7535df190299ec52c1fab69642ed0e5fca493db7b61d40bb7740e68feb5b8274c82b50d8230ba7b976ce33684e30ccccc5386f7ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\DiscUtils.Dmg.dll

Filesize
20KB

MD5
b043f5a1c085a11c11a24f96b6050d0b

SHA1
4db8169090542981fca31dfd4a37e692640284f7

SHA256
316ffa9b138a7971413c671bd2c99b484d34a2621e0f15010dd820d28a1c4781

SHA512
70c9617824aa57bd3585eb1d837b8d54af07b504bf28ddfd5a9f310603c5d03a0106b61c5db37866a80932ff29edf47897f54c1b11aacece48837399bac139e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\DiscUtils.Streams.dll

Filesize
76KB

MD5
a9abbdf32c695a771b7a3760ab47c964

SHA1
de075a6da812862452e841451f947e8bfb132635

SHA256
8b37d25d9bc583a2f2e73a32637a7502586877e05703d9ffa01cb0660c80b81d

SHA512
4eb8a0a66e45c2869680d4ac77513a8bf9ebfe3cb352de21eebd1d59ec6699b3bad6d32852d742d1f3426dc66cfd6ba930249bcfbd71203aa5b4baa05a4c0a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\DiscUtils.Vdi.dll

Filesize
19KB

MD5
64ca76209fd68767634c5f4c7f9ba1a5

SHA1
01b6b9fadc8cd5e8de6c02396831aefc910ec293

SHA256
8fac1f3f63561bf66cb8445be499ee56e624771ee172391b18ecedfc9fce41e2

SHA512
37bfc00fbc693f3b41862bff9b3eb429bc28626519391d283b08143fa66b471a5e1be56ca65dd2631d127c5096dfd58ecea840f0e9e5506d5611babe26a7d14b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\DiscUtils.Vhd.dll

Filesize
44KB

MD5
12005e9deef95c7f85379cabac60af57

SHA1
932a183aed17519a2815c21e232d34edc7c7a7fa

SHA256
d66630216a52b1c800c490e17ef407f4ef7c26c67508e18d5fc4a6769c2f6fea

SHA512
e12cc5dce77caec0e2dd4006fc1fb86f9873c23e7f348f8f287a8bfaaee4e4bc1c82c33230a62064ebb3af4060960fd10c2953f14bd8f6bef83b5b66ce41e605

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\DiscUtils.Vhdx.dll

Filesize
59KB

MD5
f015a9a019e3b663f3c331fcc4a5938b

SHA1
9109df352002ec1842000fbaacfaa27358d8c494

SHA256
8ebe092a74403b0b5fb41c979e823c4485baa7dba3df5ea7598cd382b09ba502

SHA512
630d4e489a5b46ce6fd7c85a7c345e7ef74abb07f4e72e4cfb1ab64e72ef14d067364c16f4c8664b003fe2bda96e81d1f308e5450d8d412f2ea46f753a3fa1a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\DiscUtils.Vmdk.dll

Filesize
55KB

MD5
694fb312ccbad0d7bfb18746e32553ae

SHA1
6597f71aad2b22878a5c4f4caaec3d886b8d0e82

SHA256
c6e7c7eabe0ba8403b17276e83833d431fb0f35eb53428bbc597be9edc89f001

SHA512
719f98f6dd05f524c4b2527d46b89fd2732d884ea8f55ed07ee1cd455fc12a296c4f45301586cc2f34137864e225e1258bf8dd538896d4bc9458302fa6cb586e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\DiscUtils.Xva.dll

Filesize
62KB

MD5
284980543b012f2317a45ecd2a6f0d67

SHA1
ea7abef73273a4d6bff245c3b7247e8f113b998d

SHA256
27aeaaf7768b4fa71c2329d95ae1eb770c5b449e7b384b5ce5c382c7874f81c6

SHA512
1817fafa5f1dd4394644b9558e17cfb7d52a1cf02e5ce2ff0fefc2efd89e2543f7edcccc86386008dcd6114b33516ed6fcc6d821d87dfb08f7d1f19bd42da6d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\DiscUtilsDevio.exe

Filesize
18KB

MD5
bb37c24bf77efbfc4d42d4f150da477f

SHA1
09e7227bc82a602b75b8a3d41737ffb46e16be71

SHA256
1142927d985cf17a9ef1a420a82770db2f6c1cda9e42ccfa7f72af42d1d43d77

SHA512
28815812f8b2ed89a1bdb8d6f9bb3211d260c3c7ca4b7b2c0214880cc5807522c52fb5c86ee762130a17df77d00cd963140fec7b6f5aeaa44aa77c0e888caa76

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\ImDisk-Dlg.exe

Filesize
41KB

MD5
ef1d832505b10724d3ded9758286286c

SHA1
92318ed2576f0db29354500864180ddf2352e8ca

SHA256
bfb1eb778adf80602d936781c3f4b846e7a31876a094dca5a8e22dedf82cf3e8

SHA512
50aa44efa4b7e60ba62ac0cceb88c2eb31da8548c8670100c931ebab80cb326cfcb3b46af58b4e29581d5df5323c38f70b688e941f6bc5a0c8542035c12702f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\ImDiskNet.dll

Filesize
50KB

MD5
20e448d23b36de35b045d2b61d44f258

SHA1
f31ce83ca6f6e655149a8c93ca68ba1470b40021

SHA256
69c3f0ebb9883e9c7f024866fe0b97e08cf28158e2ad7f9d854d422228c1d0e4

SHA512
533d8e3e59140208a99e0716b5afb3909118a34ad67ba5050106351d3fb2ca4e6f6b64b637b9d6f421ff406652462433448d9dc1278426c2407814ef993445f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\ImDiskTk-svc.exe

Filesize
11KB

MD5
b770098cc17ae54e7b3e54c4f7371865

SHA1
f91ba6480757a24f256c023c4d17054a43b31e37

SHA256
d503060d45e1d58d7d2f21a46e5da8ea1c5c7ee521f6d9509f7a978884c6e356

SHA512
0ad7027f28312b5e7b7ae00b41d23c99c03b45ce3f543d0ff4f29fc618aee67b0ba448b8e626a2f18c48f34bb8c8d00c4e052759512105326361b6452c14cd66

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\MountImg.exe

Filesize
55KB

MD5
a1f89dbe8abd9882fe193f30a2573088

SHA1
a2ebaf075806cbe6ef2a4fae9b93f2aeef86f56b

SHA256
bf070a5b618ccbc5533a6fc10d89a4e6014ca15a3bdf8ac1fa56c56a821b132e

SHA512
9f527289451ae951ad081d76936a351bd19e31c7c3becc5c86952e83dd70b9e48d6650ee32d972c6be32bf747e3e066ef875a4175d8eb2775a02fbb0f7cae10d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\RamDiskUI.exe

Filesize
67KB

MD5
e8beba83e216609b18f4c66c68a1fbef

SHA1
966253811c021301ed486e83e8bacdf876e1ee0f

SHA256
e23ea1b9fd07a5d389f89e057ea973389a0253812729bdc410d414f17267e395

SHA512
fabdd08164e74501496a11398d3507c03a4ebabb83e5a3ef5a8058d338b823741eaa295c2206dc5011684c14bbd4c4f4df0c35479b077045257c7c4cc60e41d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\RamDyn.exe

Filesize
20KB

MD5
2f217fe9fb040bebe0f4dde871dc54bb

SHA1
f28c84f1771fd782c29db5465fb570ea1e78a45e

SHA256
8db6bb2782c91db1d738090149e5ff6d36b55bf5879b42e25ffc78134e757917

SHA512
1ce2fd5767e82f46368386d330d367cea5a8d2ba0f0509f6831be9623a8cd6317557c7ec71fa6c3519af5f0b5196671e2b546af8e433bf5ac46db358c6a49fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\config.exe

Filesize
64KB

MD5
34ebbbc5576bb4b92e8a455b95e876d3

SHA1
0d51c0393b14ae5cbe458a5312eecfd77704d74b

SHA256
70bfe7f6c62bb1602b9852c16b71dc463f0bdbdd55ab422ab559b9d0337470a7

SHA512
4c7889c57170f10342c7378779b01d1eeb790cbf6375e9efc05407b81498467b59f92ec0495ef0d1a7a51072bc620c696e9587390f3c741280d63624b5d6892a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\config.exe

Filesize
64KB

MD5
34ebbbc5576bb4b92e8a455b95e876d3

SHA1
0d51c0393b14ae5cbe458a5312eecfd77704d74b

SHA256
70bfe7f6c62bb1602b9852c16b71dc463f0bdbdd55ab422ab559b9d0337470a7

SHA512
4c7889c57170f10342c7378779b01d1eeb790cbf6375e9efc05407b81498467b59f92ec0495ef0d1a7a51072bc620c696e9587390f3c741280d63624b5d6892a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\config.exe

Filesize
64KB

MD5
34ebbbc5576bb4b92e8a455b95e876d3

SHA1
0d51c0393b14ae5cbe458a5312eecfd77704d74b

SHA256
70bfe7f6c62bb1602b9852c16b71dc463f0bdbdd55ab422ab559b9d0337470a7

SHA512
4c7889c57170f10342c7378779b01d1eeb790cbf6375e9efc05407b81498467b59f92ec0495ef0d1a7a51072bc620c696e9587390f3c741280d63624b5d6892a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\cp-admin.lnk

Filesize
700B

MD5
e723cb81db13b6cf5568278355a036e8

SHA1
9b84c1e6be0362e41d7dbc16628203ce4a401a69

SHA256
898c1ec81db585bb645ba8290c381947245be0e35fb6b2946b9ce5cfa166a722

SHA512
135363e04d7a4f8b81b48d1b0bed143cfd67b93f49fa8ec613fa073e1826a04f325b12261d289c29b10187be9a7d626c66696a623fc1418a47c77ad1deff55c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\driver\imdisk.inf

Filesize
7KB

MD5
db65dbc03190fa9b2102492dbb2bb474

SHA1
e8d53643ec75d404be5d298e22450d6ffd2b284d

SHA256
0342cb2ab773b6d537c00c4444261246ae8689b76f84a7d1d27f1511551994b9

SHA512
20c18a8f876f9166b67b235e1289067df63b6462dd38af7f05e7a71db241ee4cb4c6b7f7179516d464bb0940aaabfde7f5ddd1869f214795f52b193782282d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImDisk215106.81\lang\english.txt

Filesize
26KB

MD5
29734b8612ab04dcce08dd54b9d21a8b

SHA1
86540469457771b2e877473f990f66869fdfaf34

SHA256
6168a7763d7d8450fa67ad515e67f278860362878630bc017f8c3aa8296ba1e9

SHA512
aa6fa131e238cc6a506eeeb279602aa88c5e870df80ac1fce40db118b864154e34f86ce096a9eeb250e33501e3f22434944e5146eab785e1ac1530820daa566c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mpjhaf3g.xiq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D1TTI.tmp\WebCompanionCHO.png

Filesize
19KB

MD5
992545a06d801d0fd6ef0390c147cae8

SHA1
c5e560ae740cb7da673edf2e7a9df0c31f2cfdfa

SHA256
ae499b9cf3d8b41a47c2b46abb0685230ab04ba0fc0dbfad92c3fc59cc188ea6

SHA512
e4d4211ff3f26d93e0e7bc9f07bc5f3db6ad2818d4044bdf8a457bb3e2f703e71c042a6c3e30f5131d47379c4c7418185084f88d5d3372d7ffaa2a09e6f0ef15

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D1TTI.tmp\logo.png

Filesize
258KB

MD5
6b7cb2a5a8b301c788c3792802696fe8

SHA1
da93950273b0c256dab64bb3bb755ac7c14f17f3

SHA256
3eed2e41bc6ca0ae9a5d5ee6d57ca727e5cba6ac8e8c5234ac661f9080cedadf

SHA512
4183dbb8fd7de5fd5526a79b62e77fc30b8d1ec34ebaa3793b4f28beb36124084533e08b595f77305522bc847edfed1f9388c0d2ece66e6ac8acb7049b48ee86

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D1TTI.tmp\zbShieldUtils.dll

Filesize
2.0MB

MD5
fad0877741da31ab87913ef1f1f2eb1a

SHA1
21abb83b8dfc92a6d7ee0a096a30000e05f84672

SHA256
73ff938887449779e7a9d51100d7be2195198a5e2c4c7de5f93ceac7e98e3e02

SHA512
f626b760628e16b9aa8b55e463c497658dd813cf5b48a3c26a85d681da1c3a33256cae012acc1257b1f47ea37894c3a306f348eb6bd4bbdf94c9d808646193ec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ImDisk\ImDisk Virtual Disk Driver.lnk

Filesize
700B

MD5
e723cb81db13b6cf5568278355a036e8

SHA1
9b84c1e6be0362e41d7dbc16628203ce4a401a69

SHA256
898c1ec81db585bb645ba8290c381947245be0e35fb6b2946b9ce5cfa166a722

SHA512
135363e04d7a4f8b81b48d1b0bed143cfd67b93f49fa8ec613fa073e1826a04f325b12261d289c29b10187be9a7d626c66696a623fc1418a47c77ad1deff55c3

Download Submit
C:\Users\Admin\Downloads\CheatEngine75.exe

Filesize
3.1MB

MD5
877c2a855319e77c07d8962380dca29f

SHA1
91e0408d343a944282cbebafe8f6e52ff0ac49d5

SHA256
622c762fe693102c0bed6e79a31c261ba4be2ecb4e5147ca56c6d5407a7041cf

SHA512
f9716bb36ec4f3a2386e9ee28e4d0b8eee833afb80dbc5f9a033a5c66dfb3baf165b7f978c4cbdee879ab91b486d5cb4a3efa843a581e9c11b4127b68acc4d5a

Download Submit
C:\Windows\INF\SET647.tmp

Filesize
7KB

MD5
db65dbc03190fa9b2102492dbb2bb474

SHA1
e8d53643ec75d404be5d298e22450d6ffd2b284d

SHA256
0342cb2ab773b6d537c00c4444261246ae8689b76f84a7d1d27f1511551994b9

SHA512
20c18a8f876f9166b67b235e1289067df63b6462dd38af7f05e7a71db241ee4cb4c6b7f7179516d464bb0940aaabfde7f5ddd1869f214795f52b193782282d93

Download Submit
C:\Windows\SysWOW64\SET657.tmp

Filesize
64KB

MD5
fe7911be7f2cca37cb4d51efe545e3c0

SHA1
e12aa937f0f1b9578614385731b408281d88c398

SHA256
5fb13fbb8e3211ea945777c327da9e2c1aef887b22186de3aed4a82d78cd1649

SHA512
42dc722ba84198ae2f1173cdb3724fc18e0875d57a0aaffa622c00b488e441f1eafc3c4887dd75901bff3e4e27f25af217af08c2da267166c9e0abf68acd7723

Download Submit
C:\Windows\SysWOW64\SET658.tmp

Filesize
125KB

MD5
6ec6f677d158935d7cd5f72c4a634d92

SHA1
923c7b593905fb7dd9f0d314092c5ea64f509090

SHA256
004daa5c0ea6ef576bc879508247d9334a7aaa95bebeacb494b11eecc9f0d2d0

SHA512
dbb5626e9f098c7adbc7e40e6eee9ecdc6953ed5cd5086568fde61843c2daea43a755b33c9e348204a490dc166d5a8d8ebab32a0784f8e0749298c879e79158c

Download Submit
C:\Windows\System32\SET643.tmp

Filesize
64KB

MD5
935e5daf2c65c0694c9b346ad051fd02

SHA1
36012a3b255c91bcbc0c47e600b88e3f72dae227

SHA256
e080f0a7748d247b39e7b508a0afcce23e0d7de00794b29079952a62c343f8d0

SHA512
a1f797a3cf7b65be75bcf69404eceb04d6ab30abd66a072337de10d2da9acdac609862502503d6def14f29be342c118c7ebade9131e26c52ec3c40118cc8d025

Download Submit
C:\Windows\System32\SET644.tmp

Filesize
137KB

MD5
c4d4ee2e46cb53aa2445b16424d5421c

SHA1
d28968a4170443dbf334655e0fa876e8efd535d4

SHA256
7a6ff361f220effe547ec6f47b15c2d4fe55ec7f53ad530498af84982c4b7eff

SHA512
06f2b26fc93ab6f52b58419e4021be2f638b22e44b416f3ea6677bc375a44daea27644a1a9b8a192834895a7837e48ed0be5f9682ff729c7ca3ee82016040346

Download Submit
C:\Windows\System32\SET645.tmp

Filesize
33KB

MD5
9dd9fa88f6961948b6f40ee3981debd0

SHA1
a0fdaf916a791fbc3ed62268debb00846a1fb962

SHA256
107c7537cf4444a6b815e23cc0e496ddf45b8127aaa0bf22265bea4ec6a49e33

SHA512
ce06a52b2a11ebb820a61c069fd398940fa5c2df96f33d63b18fdd13fb2f7e7c1f2bd14ddd8bf3a3cf33d8a79a048450d15aadd3210ce2e86ceff2bf10540be6

Download Submit
C:\Windows\System32\SET646.tmp

Filesize
1KB

MD5
c617b2ad808af8f0d23cdb64f01b9d00

SHA1
ab292f2be3ee521f9419af6f8cffc5580c44d220

SHA256
c3b21ac0c3bea333b7257a76638d2d52f455ddad8a9f2185910a32fa0b453ca8

SHA512
700146ce07fea44b1aa3ddb7e40fe538ab8941e0d2d4de4bf4bd863a1c60818bed109be15ff402c1223c5cdb2395625655d6a51f91f6a1bde623aff75074c857

Download Submit
C:\Windows\System32\drivers\SET630.tmp

Filesize
37KB

MD5
dd48cd537c487af53ac674cc9c17dc8f

SHA1
4bc2e2e91e74d41f6dff612e402d3c9b3f56d16b

SHA256
5b4867f3a86ac3cd0f07d7ccd381a00c2ad77bdb355df406c36126c9f394ffb5

SHA512
852e96ca7b1b5ae80dda0a1c0cce06b85b0cc9f4a27c88215d5990ab7256379239426a02d1c86d790e68fab987a16ef5cef8b5b68f293810da69c5209d4b34e6

Download Submit
C:\Windows\System32\drivers\SET631.tmp

Filesize
35KB

MD5
4db300dc68d6313671e122b3fc6b2411

SHA1
ef616f847e050c1c2f6ef6ff3c2a6b8e512a3af6

SHA256
5493a502f5ece4f3fa5eaac23c7d8e747535396835087e175041067b72607255

SHA512
eebff0d1afe4bdd5529dcedd917b60f60c47e1a48353cbd552928cc9e0ea7a8b9575131cd84578c81b3d62860f1578ec46973df65ec76ae8291b2ba8b8e012ff

Download Submit
C:\Windows\System32\drivers\imdisk.sys

Filesize
62KB

MD5
e8f81f9ba6245ecae906957117cd7204

SHA1
409e03f912d7822dfe63da2cd739bf92a2563c73

SHA256
9840607b61897acbc5af13f12d013494d0507e0a80e9be063525bcb22369b560

SHA512
537dc9165371bbe24499b3634040c6df719eceed18022c20458aed20e0be86dce4b3e9296025288293758785dd88f481006b264f4d09144865c88b1e7ad11a6b

Download Submit
\??\pipe\LOCAL\crashpad_1380_HDBIFNPSCBZKZKOJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1880-1852-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1880-2498-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1880-1682-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2720-1015-0x00007FF71F2E0000-0x00007FF71F308000-memory.dmp

Filesize
160KB

Download
memory/2804-1178-0x0000000006DD0000-0x0000000006DDE000-memory.dmp

Filesize
56KB

Download
memory/2804-2507-0x0000000007040000-0x0000000007140000-memory.dmp

Filesize
1024KB

Download
memory/2804-1215-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-11-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-1245-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-10-0x000000000B160000-0x000000000BBEE000-memory.dmp

Filesize
10.6MB

Download
memory/2804-9-0x0000000007A00000-0x0000000007E06000-memory.dmp

Filesize
4.0MB

Download
memory/2804-8-0x00000000074B0000-0x00000000074BA000-memory.dmp

Filesize
40KB

Download
memory/2804-7-0x0000000005B10000-0x0000000005B76000-memory.dmp

Filesize
408KB

Download
memory/2804-1346-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-6-0x0000000005980000-0x000000000599A000-memory.dmp

Filesize
104KB

Download
memory/2804-1214-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-139-0x0000000074E40000-0x00000000755F1000-memory.dmp

Filesize
7.7MB

Download
memory/2804-5-0x0000000005710000-0x0000000005774000-memory.dmp

Filesize
400KB

Download
memory/2804-1181-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-0-0x0000000074E40000-0x00000000755F1000-memory.dmp

Filesize
7.7MB

Download
memory/2804-1180-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-1179-0x0000000009770000-0x00000000097CA000-memory.dmp

Filesize
360KB

Download
memory/2804-1177-0x0000000008C90000-0x0000000008CC8000-memory.dmp

Filesize
224KB

Download
memory/2804-2784-0x0000000074E40000-0x00000000755F1000-memory.dmp

Filesize
7.7MB

Download
memory/2804-1176-0x0000000008010000-0x000000000803E000-memory.dmp

Filesize
184KB

Download
memory/2804-213-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-1216-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-1018-0x00000000015E0000-0x0000000001646000-memory.dmp

Filesize
408KB

Download
memory/2804-262-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-4-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-263-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/2804-1021-0x00000000087F0000-0x0000000008B47000-memory.dmp

Filesize
3.3MB

Download
memory/2804-3-0x0000000005770000-0x0000000005802000-memory.dmp

Filesize
584KB

Download
memory/2804-1020-0x0000000006BF0000-0x0000000006C12000-memory.dmp

Filesize
136KB

Download
memory/2804-1-0x00000000003E0000-0x0000000000C44000-memory.dmp

Filesize
8.4MB

Download
memory/2804-2-0x0000000005C80000-0x0000000006226000-memory.dmp

Filesize
5.6MB

Download
memory/2804-1019-0x00000000071F0000-0x00000000072A2000-memory.dmp

Filesize
712KB

Download
memory/3252-2487-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3252-1686-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/3252-1853-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3252-1705-0x0000000004450000-0x0000000004590000-memory.dmp

Filesize
1.2MB

Download
memory/3252-1851-0x0000000004450000-0x0000000004590000-memory.dmp

Filesize
1.2MB

Download
memory/3252-1850-0x0000000004450000-0x0000000004590000-memory.dmp

Filesize
1.2MB

Download
memory/3252-1706-0x0000000004450000-0x0000000004590000-memory.dmp

Filesize
1.2MB

Download
memory/3252-2497-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3252-2482-0x0000000004450000-0x0000000004590000-memory.dmp

Filesize
1.2MB

Download
memory/3252-2483-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/4292-2783-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

Filesize
304KB

Download
memory/4292-2785-0x00000000074F0000-0x0000000007B6A000-memory.dmp

Filesize
6.5MB

Download
memory/4292-2792-0x0000000074E40000-0x00000000755F1000-memory.dmp

Filesize
7.7MB

Download
memory/4292-2789-0x00000000049E0000-0x00000000049F0000-memory.dmp

Filesize
64KB

Download
memory/4292-2509-0x0000000074E40000-0x00000000755F1000-memory.dmp

Filesize
7.7MB

Download
memory/4292-2508-0x0000000002470000-0x00000000024A6000-memory.dmp

Filesize
216KB

Download
memory/4292-2510-0x00000000049E0000-0x00000000049F0000-memory.dmp

Filesize
64KB

Download
memory/4292-2550-0x0000000005020000-0x000000000564A000-memory.dmp

Filesize
6.2MB

Download
memory/4292-2535-0x00000000049E0000-0x00000000049F0000-memory.dmp

Filesize
64KB

Download
memory/4292-2788-0x0000000074E40000-0x00000000755F1000-memory.dmp

Filesize
7.7MB

Download
memory/4292-2782-0x0000000005C90000-0x0000000005CAE000-memory.dmp

Filesize
120KB

Download
memory/4292-2786-0x0000000006190000-0x00000000061AA000-memory.dmp

Filesize
104KB

Download
memory/4332-1016-0x00007FF71F2E0000-0x00007FF71F308000-memory.dmp

Filesize
160KB

Download
memory/4372-1863-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/4372-2477-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4860-1858-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4860-2478-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4860-1860-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download