Malware Analysis Report

2025-01-22 15:04

Sample ID 240209-13e94sgf53
Target https://github.com/BlitzedOfficial/BlitzedGrabberX96NEON
Tags
orcus rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://github.com/BlitzedOfficial/BlitzedGrabberX96NEON was found to be: Known bad.

Malicious Activity Summary

orcus rat spyware stealer

Orcus main payload

Orcus

Orcurs Rat Executable

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Program crash

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-09 22:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-09 22:10

Reported

2024-02-09 22:12

Platform

win10v2004-20231215-en

Max time kernel

101s

Max time network

130s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/BlitzedOfficial/BlitzedGrabberX96NEON

Signatures

Orcus

rat spyware stealer orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zOC3E8E0C8\BlitzedGrabberX96 Installer.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 228 wrote to memory of 4292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 4292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 228 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/BlitzedOfficial/BlitzedGrabberX96NEON

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd891e46f8,0x7ffd891e4708,0x7ffd891e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5060 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\BlitzedGrabberX96.rar"

C:\Users\Admin\AppData\Local\Temp\7zOC3E8E0C8\BlitzedGrabberX96 Installer.exe

"C:\Users\Admin\AppData\Local\Temp\7zOC3E8E0C8\BlitzedGrabberX96 Installer.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberX96 Install.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberX96 Install.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File poo.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler.EXE

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler.EXE"

C:\Users\Admin\AppData\Local\Temp\7zOC3E19519\UltraEmbeddable.exe

"C:\Users\Admin\AppData\Local\Temp\7zOC3E19519\UltraEmbeddable.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1552 -ip 1552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 884

C:\Users\Admin\AppData\Local\Temp\chromedriver.exe

"C:\Users\Admin\AppData\Local\Temp\chromedriver.exe"

C:\Users\Admin\AppData\Local\Temp\7zOC3E45259\leaf.exe

"C:\Users\Admin\AppData\Local\Temp\7zOC3E45259\leaf.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14694881717478823973,4470768127949183813,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6392 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\7zOC3E192A9\leaf.exe

"C:\Users\Admin\AppData\Local\Temp\7zOC3E192A9\leaf.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
DE 140.82.121.3:443 github.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.111.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 3.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 private-user-images.githubusercontent.com udp
US 185.199.108.133:443 private-user-images.githubusercontent.com tcp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 collector.github.com udp
US 140.82.112.22:443 collector.github.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 22.112.82.140.in-addr.arpa udp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 api.github.com udp
DE 140.82.121.5:443 api.github.com tcp
US 8.8.8.8:53 5.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
DE 140.82.121.5:443 api.github.com tcp
US 8.8.8.8:53 github.com udp
DE 140.82.121.3:443 github.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 efc9c7501d0a6db520763baad1e05ce8
SHA1 60b5e190124b54ff7234bb2e36071d9c8db8545f
SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
SHA512 bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

\??\pipe\LOCAL\crashpad_228_KFXOSIUFESFQRBKO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7baeb12d89cddd29393f619172ed2c66
SHA1 bff69cb95a897da5746fb5ca984c00f4ffaf6830
SHA256 72cd33c134f8836d132b354eb6aeacc51e61fb9d25dc6cd35f0c5be3d0633165
SHA512 9aa476b2c1a43486a37df010151f709bae0c0f9d81b4dcc069099e8c678604e7b10b8194e83248756fa8d268b95a79ba8dbd4e2e7109baaa2d4cf47ecd4b02e6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c06b20de14158362693c4ae108fadff2
SHA1 360134fcbc353e7ea14b78159e2e8198e3fa04cb
SHA256 60e78ee9033957f099e5278be1ac726aa346b6469ff8ba9d273244d75e2ad868
SHA512 2c013a49c7a8a7a26f24658133294e8242aaa1f3dffb9f21dc67c2357350b54678346a567f9ab70ffb3136c79e7ff5f9b8724ffede9a0a887f6199d89e0ad906

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ded9fb2b3fd3ac66f962dd63cb58dad9
SHA1 c1bd0b1958c3c4a041351f2238cc4d8fdd25a634
SHA256 72191672468727a2141a3aa539058e4bfcba5c08bcd5073e214497b7ddf39459
SHA512 ad46c6d7085dfbf5f758fe12b12278e4364a4b7b5b37c9bc22295bd518e3cce98cafe3897a761395310da17e9c9a0d5a1fb919c237549323a4ae057b443d5607

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 121510c1483c9de9fdb590c20526ec0a
SHA1 96443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
SHA512 b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 bd052dbff4ea6ccece04dcb3e7a6451b
SHA1 2712e3ac19bba806ec14b82e903aa9135af2af96
SHA256 cdc07bd7b5f3a185d9be79bc9dc90d0e3e41a22101c4c8ab8cb751e329c5bd7f
SHA512 aed2c20d7310472152a10a5734e10e6e520582209deb0e1057b3034b375c5e57e9a46c1f5b42f90a371161ae8928bc2117e1be7f6a89314ccc42f3c51e9f1185

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9d375b549097effb4bd642135d68f96c
SHA1 9d975627bd036bb7f7d3c70c9226588f5b15e83d
SHA256 e7690a29ae39c6c2a7cbd6a33144391078a62af6dc53e59d1b33cfbc3a6af088
SHA512 20f5a57373398c7f31ed04f1ec43ed45a9192c62505cfbe3df9ed4577f71cbfaa83023cc5ba990959aaf9a1c5b2cc5dfde93af5529f823b99badbcc1d468aa63

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d93e3e0b12b400d4d3cf1780cbc6c1e3
SHA1 32864598ad0677c26db8c0546583b870a6c9f071
SHA256 68a4d7c52afa43b88347ce1d42a4e12ee48568941550367a05849a6b23c9e26c
SHA512 a28f2879da83896302479ad07fb7b330be7fa8a12caaa1879091960f36106e492f5aa3da57ab19310125a4493be09d46ef70f799559ddb73f06302489f7be2f7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 39c10a91126b5275da4abddac761b432
SHA1 e3a255cc50d67db801b99be185b742e29a86be55
SHA256 dd886451d51901498cc573a5a20e0e2fde86c16d22808cee9b094c190fda741a
SHA512 3697ed01d3bbbbeeadceb60d7d40c671454b7d111912b9897150586ee7065153a21a901a33ffe95707f71f401eb4ca33c77c7ff52cce411c31c78a8a5a7c7703

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d3f3b61b4377ee3176480220932b1b35
SHA1 c42ad771c4cda92eeb344ccdb789121e8e9a6064
SHA256 b49c1f93916d0ec6f539684cb1a875d849c1097a5e3ef0f04659f1f9f325ccde
SHA512 3e8558bb663e34892e7dfd0db2eff876bcda216ace4712a0489870c4dde325c1294ffa14d98877efdc6283985818ae0012be2d646af5c8de5038f2d0e985967f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bf25.TMP

MD5 cae762b422ea5f344ab7b637b64ce437
SHA1 ec91c6e2348da228ca88ecb5a59bde99a2e20407
SHA256 84946fe9a386700453d1fcd1a043868ad687231ecc3efb79559e18932100d439
SHA512 1c013c934d8e691ebcfcc8d93e8a00e9bc1b0b3aa7665d418d716436f62d008d58b7fa7beb025e2c856383ce2dc03517e1cfc793f4fcb4f22e528a0488de80f4

C:\Users\Admin\Downloads\BlitzedGrabberX96.rar

MD5 03d7ef1468e0bcdb1f95f506d0a3df0b
SHA1 4ea30fa4e823ed1eaba5f7845fb20bd8bfe75ab7
SHA256 f039961be33068c56d308be22a7c3c993303bda4e659905833698a860be49eac
SHA512 2a7c032d23976ddb99c75df6b0de98c74f20bbdf181120ef67479ce3c9c66ba55a7763caf17a527cd63022f7c1f4d58e54fc871f775d678f3ed70ab253d397f4

C:\Users\Admin\Downloads\BlitzedGrabberX96.rar

MD5 c2e0e1a27c4c95470f778120589dd718
SHA1 3bd28b3fa02b1d0de2640f9dfdff5ade31800bbf
SHA256 605d6c182f9328bb9c1100180694517b9e679e99385e5c8a5fc51cb0eaf841f3
SHA512 3e944521499dc532f76696466329df5bb584f2863f0d105c7809a6d80189b1052bb28173527fad915c1f4d460e8f9710caaf6504842d09601c8a31e29e8dac6f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 89df32e256bc47f860d6656ea2c2b7fd
SHA1 2f1163072d0da76f6bc6ad0fbe4ec4f2fa02ee7e
SHA256 ae3a030bfe37c1082b5854a57a2317b2f9d3ce6e7f87ab637a0729fde07f73c7
SHA512 7b6d109def48beab2fb78e85c366713771ab629a9c835e267beb28d0fbbd59b6e3a137f6b83426c4ff1936098328fee3267e0d9d67e50c7842b536ad9437802f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a5aea4f7f6e133348779785c946d4a0d
SHA1 542574af6d7b11d8561182bec89d93c13d556e04
SHA256 a541f9c5ae8923e022551df3a00c806b32ad5b909a10911f247036bb7ed7bde1
SHA512 345730b82254c8e1e82b4f087d80de26d2a62f3cb198ed26fbb202e5f848a27ae9abcce5d4b32e16f6a0f742440549feaa3e84eb84d71dd03f9c58e1f1d42bd6

C:\Users\Admin\AppData\Local\Temp\7zOC3E8E0C8\BlitzedGrabberX96 Installer.exe

MD5 919e5a24beff5c28e1e9d77ace2d2ea2
SHA1 26c3cc8bb71428d63d7d0eecfb265a2cd100e4e5
SHA256 bdd92a880b2fe8f065c82097572a1268ae1c762818aaf6fb49017f9639a20454
SHA512 b40e9dd36f41d79ea97235be3f3587048634a139426076639a2d8af22d6de30a8ba6b3e1a5751027fcbf65bc48aaf3b5cbe47ee7f6c83ab041b7b4205a1f74bd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 15c6b54f36fb6a7038d90b9c8f39d9a2
SHA1 0bd0e0c2e3c86ff7d0113337f943ef83acb9c594
SHA256 c101af3b104f661839e0a64d6bb5b6b9e9f75649482df31282faeaa63bafb17d
SHA512 1cb2e40f12292a566f1ec7dee6a75381dd1d2206248a5ae3b666031efcd0f98ea060a5f713f17a9871afd255d09f1c2b8dfc24063228c52496bd40c9ad06e5e8

C:\Users\Admin\AppData\Local\Temp\7zOC3E8E0C8\BlitzedGrabberX96 Installer.exe

MD5 09adadde76692d3bb761ac552c97f973
SHA1 1fd3153df7e9cfae3a446208e4e9aed6a4bdbf60
SHA256 35f01ef5aa53f40ef967de15371e5e25ec673692fb9de3f797b0173cc0f9e43d
SHA512 0095bf203d2bf553c57e3ee70120094b773ddf712d448bf369cc9d19040c618e7f88d04ff54f11916bbbfd895041a59372a9828ab6f839b11705f9b79ec56585

C:\Users\Admin\AppData\Local\Temp\7zOC3E8E0C8\BlitzedGrabberX96 Installer.exe

MD5 6c6698b5ec1d29600b045144a71e88c8
SHA1 8af42ebf6f28109d4f71acaa4734bc83970ac780
SHA256 073da6f92e8711ddc10cd375ef43ffe71dd0d1a7ab53f0f6e52951555e939add
SHA512 22e835514065e48bf2e5e66a5fe4cdc8fa393e00216e26ec10cb4d24f0e93498f3ed2add819778d4e4f4f89fd59793ad065b6566753ae54597df3f8a914df01b

memory/3112-338-0x0000000000320000-0x00000000007BA000-memory.dmp

memory/3112-339-0x00007FFD76680000-0x00007FFD77141000-memory.dmp

memory/3112-349-0x000000001B360000-0x000000001B370000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberX96 Install.exe

MD5 aa258be24e7d2f99f7cce4c713f403bf
SHA1 9dadbdb7cb2d320ebb5a74f6a12d180e6e38bde7
SHA256 0da6c54ec166465dc03bdb3c9f35bdbd42aa2214e383a15bbb644af3e2e4f35e
SHA512 2a58847a0beeeeba8f91de79b1401d430bf11385a98c2e8236bab4046e7190e56b4558f97bac8ff912dbfc2eecb3f4f19c5b33407d715980e170998e37471068

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberX96 Install.exe

MD5 3396e3da65bb933fa8053438f557d28e
SHA1 1e078e9d212b24c5709f05f98e580afa34c29495
SHA256 4d4d1c47fedb31c3b456dc3f323587cb51150cbca326bf75ed2a6d54c294e29a
SHA512 a71438265f02778c1ea158d02c4de46203dd6df13454c9433fe3b7b28678af212449b498fb0065072f305871d896df27dfe8366f615d012b6269d5ef9facac90

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler.EXE

MD5 69d38e100a96e520a4ae4fa79189c519
SHA1 3893fdeb3456b604617e79f8554197208bbcdad7
SHA256 7df120cbc7e37faadfc441e70c0c6ffec1194d49a3da0f144365e86128eee66f
SHA512 85177553131c0fa2b33d373a80c897c0fc5eae5da54ac6052b3bfe040028f15a5d14dd7a6230c21d5061a7ee0f47cee2ba8b4d4ee62f466bdabeb33c084d725b

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler.EXE

MD5 a0dbe69361f116d9cbd558d7ae0b6aae
SHA1 ce11bb2edaf3435889c602b8d77bfdf3f08d88d8
SHA256 dd60c400b1312d803f9a74917adf38a1a4a0e9d545fe8c0b34d74949075f466a
SHA512 b614a665bb942ef00a8941064660d8c7833c91d8edb0505472d2ea59a0d692eb9498d2b78e8fbd78d182a80a94a6341f97d6561f01ccf4086c5e335f823e15ab

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberX96 Install.exe

MD5 f7424067a1256919d12c41acc6188b64
SHA1 432f741804b9d99e29207e05c6282a1009395ea7
SHA256 f9f6417afe1a3f30bf6c642ff289b3a34400c02d11fa83fda8d8d14611595589
SHA512 4534bb9d8ec01121d73d5a6471df57a1d2d282157816fbb425b782db54e17edd3c41e50d23bf8f377d1c0ae457e57554ac34e437bd8471ca11c26e49112e1eeb

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler.EXE

MD5 731ff776ca4b5668c9e2a6573fbdb036
SHA1 f06497c09d8a87cf9da6ad72ae8b728337f53ab6
SHA256 2d85522f57508a92392b0e4699c07000487ae6fc2e29c8538b2b8865c2e70e42
SHA512 f186b50c4324fcfdecf0aa2ad769198e779580956c4e0d7d0c88a29ab46e2a5acf8008650a6b3c7a852165fc957b8542053c1a1415d1c68cf27882051c84455b

memory/3624-374-0x00007FFD76680000-0x00007FFD77141000-memory.dmp

memory/3624-375-0x00000254B1040000-0x00000254B1050000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jybyjguc.vkg.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3624-385-0x0000025498960000-0x0000025498982000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\poo.ps1

MD5 5d792fc7c4e2fd3eb595fce4883dcb2d
SHA1 ee2a88f769ad746f119e144bd06832cb55ef1e0f
SHA256 41eccaa8649345b33e57f5d494429276e9f2eb23ca981f018da33a34aabfd8eb
SHA512 4b85fe8205c705914867227c97aa1333421970d8e6f11b2ac6be8e95fef1a0f31f985547eafe52e382f13c2a16afa05462bd614b75bee250464c50734d59a92e

memory/3624-387-0x00000254B1040000-0x00000254B1050000-memory.dmp

memory/3624-390-0x00007FFD76680000-0x00007FFD77141000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zOC3E19519\UltraEmbeddable.exe

MD5 b6b77d0798d39d7fadd69784c4e47c30
SHA1 967af699bd9e0f2f20b0743323e5cdd6c3767ea2
SHA256 e5c9880090d757207a5cd373f5e1d20c42d7486c742b3a30a2ee741a7aef5ef8
SHA512 5140dcebbeb53c8e74364de824d78d6c5fddcfa08f0ac38ff0d898e71bf4f8630f3b529571a7f64be00981e83af7f85a9b6665aedfaf7f0720995fae8a8e28d6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6137af7290bf2ba89b279084d9c43c4f
SHA1 24ed94ab9636e6febd62c35117dedf43a7973ae8
SHA256 acdc4f966671a28300bd82ef90e784c3cb960393f56759c826c4852757f8ae65
SHA512 c4444d4ba8ac2d5b9f8036b45c8e6ef2d5b91d1341cdef037e135a01281c21592ab89bbef80c81f2e6356bf38b76996e91e33e7d6c3e06ec2d043ff50340b633

memory/1552-412-0x0000000073EA0000-0x0000000074650000-memory.dmp

memory/1552-413-0x0000000000010000-0x000000000008A000-memory.dmp

memory/1552-416-0x0000000073EA0000-0x0000000074650000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5bd0c011cc6e0a82515b93e2739f0333
SHA1 22fc7461853a86dc7fb7b79187ca5acb195c6f6d
SHA256 174cf8f73e05a8f8cfd2274d224a182b55654caddda7a64a4f5fa4bf283d3a98
SHA512 82339380f8069b0dd6dd08c94a19ed1854c95d5801dd7cef2f74761d8a8410a45ae499604b13f8994d320db77ccc339d93d60fdb630a1702c6825827cc57bc8e

C:\Users\Admin\AppData\Local\Temp\chromedriver.exe

MD5 1d5e0e22f77867d118b306b43b72a50a
SHA1 999c4debb650276bdac50305935c12598f24bcba
SHA256 27c332ad3867b1346c3ba22cce312e844630b40164e0a854a4a01885fa56d93c
SHA512 4a0db8579a95395b287e2900ae0262e7b464294fd7fbbf883ba6c0a53da2abad714a760fcfb406c560e7ebfde8a44a03b13f26f731664239255378112e3bd3e5

memory/3112-434-0x00007FFD76680000-0x00007FFD77141000-memory.dmp

memory/3112-435-0x000000001B360000-0x000000001B370000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zOC3E45259\leaf.exe

MD5 2a62b2d78f2c0f2efd39f07641d231e1
SHA1 30e17f27edb951a306fd907e37aacc170bf3c7be
SHA256 b4b1dd5fc206b0089ca1e7d613d6475a9a06bbcf4c207830d7c0cf02a94ae79a
SHA512 4246bb79753f803aaeef24ec6bb9f5ec23859f2cc24d3cfb58c901722cd089b98cf8a2eae6763d18f1a2a330f71887aa8dfbfbd2bb92865680c2f1135a371ca5

memory/3332-445-0x0000000000560000-0x000000000056C000-memory.dmp

memory/3332-446-0x00007FFD76680000-0x00007FFD77141000-memory.dmp

memory/3332-449-0x0000000002570000-0x0000000002580000-memory.dmp

memory/3196-461-0x00007FFD76680000-0x00007FFD77141000-memory.dmp

memory/3196-463-0x00007FFD76680000-0x00007FFD77141000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\chromedriver.exe

MD5 b941de6a8c85398a4e9fadac787f1c10
SHA1 3969849997861e3624b6f85c3e5fc5cd04b3109c
SHA256 5c8add8c343f3619eef9abe3354a2cdcda0d101c1ef8ad323755f5086ec7db66
SHA512 e7a3bdc061d94541e78bb0a161633da39c950598e2d3f19a2c4f7b9567b2dab8ef1786f509c1513eeb014460d4a555dd68425fe02747f1cc48ec80e276782c54

C:\Users\Admin\AppData\Local\Temp\chromedriver.exe

MD5 cad087c5d035534932687240fd2f06c2
SHA1 34e06bd81dbd61a4d88d5dd3414eaf4b866607b8
SHA256 af08d5aa706ceef11de9d122b2c7b5b36d890e31b5b340b1a75c465f0f6ee61b
SHA512 82b4bf7b2626f9fb890486f89555754ee032894e3f381ad63abbc9a7f545162029e9574196003d035da4493d2f0014747fa922b8eacc588e1ef247b25bccce01

memory/3112-468-0x00007FFD76680000-0x00007FFD77141000-memory.dmp