badrabbit | 3cc951ba5d33757ea90766b47a7174ed5b1c7600f5f47d418e3b1fcfabe54f7e

max time kernel
468s
max time network
472s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
23/02/2024, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MalwareDatabase
Size 285KB
Sample240223-vbvmtsde58
SHA256 3cc951ba5d33757ea90766b47a7174ed5b1c7600f5f47d418e3b1fcfabe54f7e
MD5 8adbc73e595f87a63b1efe9dc51ce993
SHA1 942d0f1b51055b5f0ae1f319c4509da66f8295d8
SHA512 c70bd77e192dc1c5da185d37b021c0cc23649512e8c9b9b46959fe488438ba3e8c4538bddd076ad232fc02e87727175bd15387c098b695c2f1556445bb0ec8ed
SSDEEP 6144:iDuqJ5fBrVSgE29xxspm0n1vuz3U9ovZJT3CqbMrhryfQNRPaCieMjAkvCJv1Vi/:afBrVSgE29xxspm0n1vuz3U9ovZJT3CU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

badrabbit mimikatz ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000200000002a96f-914.dat	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
2168	EBD3.tmp

Loads dropped DLL 1 IoCs

pid	Process
3572	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
5	camo.githubusercontent.com
48	raw.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\EBD3.tmp	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4900	schtasks.exe
876	schtasks.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\NodeSlot = "2"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2930051783-2551506282-3430162621-1000\{B8B66396-FA60-41B3-9044-56DC58313DE1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 8c003100000000005558466e110050524f4752417e310000740009000400efbec55259615558466e2e0000003f0000000000010000000000000000004a000000000095904800500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MalwareDatabase-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2356	Winword.exe
2356	Winword.exe
484	vlc.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
1432	msedge.exe
1432	msedge.exe
2124	identity_helper.exe
2124	identity_helper.exe
3712	msedge.exe
3712	msedge.exe
4100	msedge.exe
4100	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
956	msedge.exe
956	msedge.exe
3572	rundll32.exe
3572	rundll32.exe
3572	rundll32.exe
3572	rundll32.exe
2168	EBD3.tmp
2168	EBD3.tmp
2168	EBD3.tmp
2168	EBD3.tmp
2168	EBD3.tmp
2168	EBD3.tmp
4520	msedge.exe
4520	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1660	OpenWith.exe
4400	OpenWith.exe
484	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3572	rundll32.exe
Token: SeDebugPrivilege	3572	rundll32.exe
Token: SeTcbPrivilege	3572	rundll32.exe
Token: SeDebugPrivilege	2168	EBD3.tmp

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
484	vlc.exe
484	vlc.exe
484	vlc.exe

Suspicious use of SetWindowsHookEx 53 IoCs

pid	Process
3108	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
728	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
3400	MiniSearchHost.exe
484	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2996	1432	msedge.exe	83
PID 1432 wrote to memory of 2996	1432	msedge.exe	83
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 1000	1432	msedge.exe	86
PID 1432 wrote to memory of 1000	1432	msedge.exe	86
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MalwareDatabase
1⤵
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcd1383cb8,0x7ffcd1383cc8,0x7ffcd1383cd8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4392

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:728

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4400
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\README.md"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2356

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
PID:224
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:4516
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:988
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4124246861 && exit"
    3⤵
    PID:2788
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4124246861 && exit"
      4⤵
      Creates scheduled task(s)
      PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:12:00
    3⤵
    PID:1036
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:12:00
      4⤵
      Creates scheduled task(s)
      PID:876
- - C:\Windows\EBD3.tmp
    "C:\Windows\EBD3.tmp" \\.\pipe\{87DEEBAF-1E4B-4392-AB5E-330D4B25A930}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2168

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\CompareHide.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffcd1383cb8,0x7ffcd1383cc8,0x7ffcd1383cd8
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,15467111450895445291,8449394451267178726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,15467111450895445291,8449394451267178726,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,15467111450895445291,8449394451267178726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15467111450895445291,8449394451267178726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15467111450895445291,8449394451267178726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ReadCopy.TTS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c
MD5 96899614360333c9904499393c6e3d75
SHA1 bbfa17cf8df01c266323965735f00f0e9e04cd34
SHA512 974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e
MD5 19a8bcb40a17253313345edd2a0da1e7
SHA1 86fac74b5bbc59e910248caebd1176a48a46d72e
SHA512 9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 498a177a3e2edbfea97c14353865421c078f73d84e7619bebd36d77c5b1317da
MD5 1423c1a528e7edc20b7f2c4b94e6bacd
SHA1 e7d7285afad7b07ed6805f31d4fc3bb3f7f0242e
SHA512 870217847a95fe38049f04734776fa604f84d830d5b5bf6b753620afde7d0800a26c96c77d66fa6c79d6b369853b27487f010c2e6661acecab858a3156bd3106
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a3753cb5fe6ba511b56ecc69c08f93ee7bd6ccc6d7a89b5e6c68f5c2e0b9e8a9
MD5 2c5433e3aec0e7a9da9726637867fdc3
SHA1 7f93f26c987ce7218f46659ba777e23c5a68660b
SHA512 cf1c3e0c2b46433ecfbf98d0bc831a66a752a2bfa7df8ed336fdbf7220ab7cd6506c73535687271b9e261951f0d825e7335de36afb3967edd96f71161d744f62
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3d71b74401b0b8f590684224cada6d120656336c5e86dc3f35ee070ccc30f84c
MD5 6db23a6609db50f9a9e89758fc9f0e94
SHA1 8cffe9fe37986b2e566ad25e06dc581e92fc37c8
SHA512 8a3d09b8879c50e8bcf176bef4803a12b77bf24d26a1768bf878843e2ddf76c62ff954c44a9277dcc7a4eb143362744092a46d370995e579fe0c13c0380dce59
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e55bb250fc9060948f477bc7c59e060bc565c1674a4b6e618c8cf5c26a66a49c
MD5 f913f6603503b09aa33a156d330f0f4e
SHA1 b634a88b8430e3c40c02ba0bef435e453495bb73
SHA512 be1eebf33196c25ced369faf2aaa9811b93e7d5d74b0be365358e5d6f98db9e5aa90ce7f90d1c3b11de4650329259aee0d919d709a4d8e4356ccd182e7793d69
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 05d6d2458a1254d28993e13c055bf35a331a5f7d93228e4e662d2d9f99ec3e7d
MD5 ff338469aad8d1ddb12918733113baae
SHA1 53160c0aa93921de87613244129052a0ea1060f3
SHA512 d1853a354801d56517810fd5ca25d999dad0c64ce38392857b68bd1c851aefd2018ddba7295116b809bcecaa19214382691fdafa4583ac2af86cba89ff72a364
SSDEEP 96:PBCNqvumavZSq4qJ1mago/1kglX2Drua71Z5O/A8KPhRIf5uncPh:JrevZSlqpgo/ZlWn35KAXPhRgIcPh
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 616c1e381058fef90ae259bc7957870691115d10863ae9544e28f5279be358c6
MD5 0f3fb30e56c501ce2655ecfaf36ad668
SHA1 f1ad109088c3443997168aec4b7b3c3134292179
SHA512 e9d4d26b9d69000929e5f75b41492392577c6b5c16cb95d215ff26cee0b0383e647433049dabe824f98832376ff736707a496a687f2f916c7c4fced39ace8925
SSDEEP 3:MsEllllkEthXllkl2zE1l08lt:/M/xT02zL8l
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 116KB
SHA256 9f636fef9c528b2ba556cc79208b94fde0bc6627b577edae6b7996618d19db28
MD5 aa65ba3c00f7082a3197c4fcf2228708
SHA1 47695b4b068d561fac5eb1b1e471a2ba060e3f54
SHA512 2a4f19dc750f8d012b56d2cc75c7f46c08ff6cd704bdaf6c25a04c9c459ef22d49e40418e814612565c7b58f00ea708563c7919399b5c439bf88cee8445fd988
SSDEEP 192:Bgm+vZnvDqJ5+nF2+bDo3irhnydVj3XBBE3u20vZw:Bgm+vZvT/U3iVy/BBE3u20vK
MD5 SHA1 SHA512 SSDEEP

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 5KB
SHA256 69cab2387585350897fe02894252c019ddac58e2adfca8ede9c2aa537c802190
MD5 f000813e46f597f20348b738c18cf7e3
SHA1 8c61c63f402d0a1becfb24e9c9fda579d075f57c
SHA512 be2f64935ff12c2d64bd2f8fcddcaa5528b0c10b11a96d4b8acfd44f5c356e387316f9544c9ed417acf13ac456dac116b43a9459c8e6a1ba165efd85acf9d2a1
SSDEEP 96:TKjr0ucpQImbDrAv0CxaX+Exo6V1yh5vP3c/fWUqzfnplkcjduxdRUmavZYFmBC7:Ar0u7ImPrAbxaX+EGbvPTV5j0xdRcvZQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 23KB
SHA256 ecf82b7d753327d87cc7be201def1b84bda71b5851e3a340045dfc5afa45c617
MD5 30255d7fb39e2482a068fb264166721c
SHA1 ed5d5cb16162ae175410a0bb7f28cdbed81cebd0
SHA512 23b98cedf06b504d5434ff1b58eab1b615fe39c133f57eba0a734ddc768c8d3d5791db6d6ab8d9a791431e8e838149a2cf36a9c5924a7de055eac0655ffd9d14
SSDEEP 384:8HEzKpB++dCd0eTeKUEzKpB++dCd0eTeKqdUl8lJPMPEJv:oEzAEzWdPp
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 f4d628a21b36bfc82326b90f37a41d9f6dfe5ee6e5f064ec9cde589fa69d20d5
MD5 daa7de75b15cc8c030cbb239ad0c7317
SHA1 59001a3c6cf8a1fe2756d04e764172207020a843
SHA512 93bed54e8b14ff62f13a5198bb94a8379cb06d57bb8931164385d382ea2a8d84fcc066da35176c4156ef341cb290de783c8fc9bcb4a8115b815601a8e5584fbb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 57d33ee3b16f1e7c8615d753737e8dd8f06007ff07937d7ab42ec9ed36b53d0c
MD5 58850e3e79a79fb2bf5fc5c5e66ddcee
SHA1 6f9c90aabd2ad73ca071fa38d08f4587dce32c2b
SHA512 2aab3bad19d642a309bc9f9ced6ac20105fc2984c6e4b90c6327508c9dbc7d6f1516fd97ab4c2ddc3c918d2c9c8ed03e1ee8e1704ed7b29b1198bcc0fb5d14ab
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b8b56f20bfe41e3488b44cded9cd6f16fe122de6b1b2c081d5ab2e7f50b29f87
MD5 885b2c2be8c22a9066ad2a859c0ff96e
SHA1 3ae6242a17af56baa4b302c31348eb8c2e0a9b24
SHA512 21373dc6c16df6c3ac85457ff7e6de73f9194cf7a68a5172ff09d8216669a281efc7f2a9b44ac85ef6526510ba18dd232b0f8053ec4a727fcf9268fbce99cb0e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 656fd2063b705baebe4ff12696151eb98bc816574868816ad249cdbbb2501c93
MD5 8400a8c3f08335ea8738d295430db0df
SHA1 4633a8ff4cebf21c77379795e0cf2d15575bab3c
SHA512 2d2fa093eadbc620aa03b143684f378c18c1002413c0c7ea73da912c1b94d5ef14efefabccb581ad42b7c5ea41d3cb752a15527359a69f2a47cf1188472c8310
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 609a31311249ed856522b73c30c57a8baa02cb2eff4e01ff96f95f59d5c289c5
MD5 ac5c9812e0fccd6929276cf5e0a45b6a
SHA1 7bce710b318551cb8de327b8715453bca21d2d96
SHA512 9089a8f5b680b3f5ac716aa051b99e478e306106896116347fe3a67441fdf51be55b8bae4098217698350e17487b193a255d40140418bfcec851cc3bedb50012
SSDEEP 96:nGk3DSxm/FrmtDLk7FwSSk00MoiVmdFuC1jI1lJ6kJ40WQyV+VpAiX3wI3:nGk3DP0VLk7FSZ0MEuChI1f6kJ4Le93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3f5707025213184595a6258ad8aa5e5124caf5761f8426a1b0243bde6ffe9417
MD5 ba754f5b3d960fc4f0b35abfb5f38091
SHA1 d0519f0e834e91caf673f5a2f6cb11c6a31768c4
SHA512 d70f6bd206f7b53d0e6d2c78fefde2adfd5a493d3c2ea3f68816d98b1914ac934575bd9708538cfe2a56ec4a9a0c3f49b2ca70522c36d290697e6d775a45c0a4
SSDEEP 192:nGk3PQVWk7Xv0MzBvYlbuCs9LO1ctkJnLx93:nGe8Wk7/0x7/1ctkJnF93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dbaebdd6a2b859e95914194f540a77b632a06179d4d85063adab81a1931a4f08
MD5 5a914657d2d882697f9c7d1732640e23
SHA1 dbf75d2df1e505bbec32ecc9b49b321fe0133e87
SHA512 2e14e1da551c4c9ed156cc80bee5f65c2f8b0d2c32f64badb61c8695c213a0e211773a1540d20f79cba568219e17d3d4aecffecdcd242e0df4ff5d0ba91e8540
SSDEEP 96:nGk3HSxm/FQYmtDLk7rwSv0MoiVmdHI1nJ6kJ40WQyV+VpziX3wI3:nGk3HPOVLk7rv0MAI1J6kJ4Lx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0b13c8096857b5d9218dc88722578dea9ba41a159e2511018e72295bff802074
MD5 e740e63cef3ea6ec9252f1ec4e4648cc
SHA1 068f794d1c7e39f0167d255e7d3144b75fa8cb26
SHA512 a86a5e5ebb9104133550685286f93ac6b6f7b7255741385bcd3edc59f5466aa03277c29a6f7970cef89f8387838a04c5e8f918af00d784091ecb3ff92d6251f0
SSDEEP 192:nGk3PQVLk7XzF0MzBvYlbuCs9LO1ltkJDLe93:nGe8Lk7R0x7/1ltkJDC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 20073e130b7995ed4afa04f13ace5edac063a039775efdda6c29d0fb5b5585ed
MD5 c554eb748d58b3ad646f4fce63412fa6
SHA1 fedb22a8e3fcb335bf74af235876b12b1cbf4425
SHA512 2e136e9eb1fbfe88859b65691633a3b4ca84bb764db1fac278fc506b68a82106b2f19662efcecc137625af88998b251248081349ec0eab5af233baac597040c0
SSDEEP 192:nGk3DPQVLk7/zF0MPct7uCs9I1K6kJ4Le93:nGeD8Lk7Z0xbP1K6kJ4C93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a5e8a8a93cce4a7966ee18ad3538ea3750775028fc6ad763c97b9e48368c17d6
MD5 739a353f0bbdd3554e954bdf5e15e479
SHA1 e880d01cf91f4672548cce3ee53b7c85028a2342
SHA512 d6244d0d1a735ab1709c4efc454832a261239229054c4b0265ab461ef3f9564070f3dc5b2e760de0870020ee0e32f4365cda7e0d6a09b8403fa5f8368272c61e
SSDEEP 192:nGk3DP1VLk7EzF0MAyb87uCs9I1B6kJ4Le93:nGeDDLk700VbP1B6kJ4C93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 16bc74fdca77ef1a0bbcedbbcc19a266d98808d53a2251d96b7064511745a0eb
MD5 5172fdc07c81fbe79a441081a58fce84
SHA1 138a2cb8a9e734b347ad596223bcc10442770f0e
SHA512 f80ce41dd77f8c266b814c8b454cf8ef797a06aa95799b5b20c3569fd6395b29290e5e1f691c4cf3be85ec994b03a458489d95278c2e23dd78337cfe4b6c1b70
SSDEEP 192:nGk3JZVWk7Bv0MzBvYlbuCs9LO1l4kJOLe93:nGeBWk7t0x7/1l4kJOC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 1KB
SHA256 dab1d4231597bab682369881af6ed31ec8ddf7ea2223d7bcf7718df673c3fee5
MD5 e743b3218370ce3514b2c795800acd6f
SHA1 5bef0066821e425de244f4451bef43f009500198
SHA512 c8277b88865896e3cad44c6d501717c111d6d3c50fd7e4406af214182304bb5b021bad6ca5d9809c590ae10a57488b97dadf64e09294b337ef3c538df5f32663
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 d2d006d9d8d8094ca576e05af5d59118751fe6c08c8f9b450403d32c0f8164ca
MD5 f9b70bfed906c357b09c06923c55691b
SHA1 8cead4ee4ae8292e9f701990f896660f24176763
SHA512 440e55345d4bc12e72d33dbd4902578401d204bbe97f4e444f545c894b927e241d023c517b409de2f9c38947a0b339f310a6851f58e8b34233bb2de43954ad77
MD5 SHA1 SHA512

Submit Download

Tabs_13353180614991135

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13353180614991135
Size 19KB
SHA256 aafd7b6b5dbd0499c8f8fb1b1870ddbad0ceb0525981e836ec595ac669a63ea3
MD5 74e19a817afd717f7916d6b95ec2d485
SHA1 15f8c1c1ca77ca4eee34030001312331d80418a2
SHA512 ce42c7e5073fe9810eb264eb280cdafc8cd1fcbcd77c1aa13b7a2a8b1cf0e487bf2a36ddf0bf797c80a0b50306f5f9d982516ccc4d0703dc66d65f287180ff6c
SSDEEP 192:36p7Gph4web08xpg5bXf264wi4wOCvZqdqqR83cN0di+iZAoGfIT:q3web0YahXCwFwOCvsP1N0di+0Ao+I
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 187B
SHA256 27b94b35f4a468f1cfb1c78a8e95a3592e47f56d270e4d986f87f56ae0b61396
MD5 6dcd48b04c9fca2417eda3993076fdb8
SHA1 6aeb83383089d9976569eee9a46498707e5cbe2d
SHA512 2185d1685aef4a8d96438583e42950717ed77df36387730d5970aa9180c1014ce56edc0382d74b6f5ca419d07504f194ffd9db61715674251cfe4deabf2f02d6
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 3caafc1bdd15662224da2bbcb781b49d15a3188479136c7f71f34dcc0eb6ab63
MD5 0521f8ff98caa24fed1db103e7b422b0
SHA1 0b31ea2ec178a23851c10ea6dd7b22f89fd64db6
SHA512 ceb7539a1ef295934d5e7bf0179be173846e3e5bdcbdb307fb576e26ffa87183425740094de7f5ba56da215b2cb7f5d20b308e16dd2be8d793af9a3d64e6a37e
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 c7ab8073e45fbcd22a66da4c7f142d3915f1d75907595abb3e58505520630b2c
MD5 5baeb8fc81ed5d88a94ec3c9823753c3
SHA1 0c122a5ce48d44f9af25d17ad02898c9cc70dd89
SHA512 54eb7f246dc482c066d632ca59b4c4dec5292c68d46007a431f1c54d53f0744ed53ed8f74c5a3e172af7be10abe10c2af1038da4a0c4e6d591bf8e9f91150740
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 768e140d37eb079ce6dc90d63888f662ece5ff20bb9ef5b73a8f005526659276
MD5 8c270f70d725d9133310c1e20760e77e
SHA1 03b72a74390e318fd946d8d9c25211ae18f9d808
SHA512 6558317dffcb393eeeca9ab9aaabb001d800c710464a783389a062bb023102ea82d53df70be94922ff2f2958176b16c4f1946991e0c0b860b260554b896112b9
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 cde009317fafc48e3bf866d78e60ba5d4de32b24906907e20305cb15b810350c
MD5 d1f1b386fa45c004c2c99dde4fd915b9
SHA1 7d42537122abcb7fec630d79bdbfb662c21c2173
SHA512 4cdcc9ed6e4ecac00ad803183779db19efdc2fa753e87b4d35b81e9b5fd116b032b708c05ee4f30392c7b96a6e3c0b3456f31d5d4470a88e057f5b7715393221
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1d6270c7423a64c2fcf2b54cabdda6596f7ebae0d135e38adcf5195405839750
MD5 6180c9aaa0ca2232ef62f747baeae884
SHA1 036d8f19077cdaf964bb446589b1599b87b94a89
SHA512 2f312eabe8174d41ed42789e58c1aed88e9832cf4ff6e9d7cfe4a4a7affb311409ae31eb3d41f138c83496f141820cb383caf4fdeba00689f42e5a318ddabc3f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 7509d1d40ef2b79bc7d23993612a102a1e81a7602b7e1bc16ce9dbfd9a7203c0
MD5 29ae73b1cca7a3b38b7e2af3655bbeab
SHA1 b7f0f330b1e9becbd0797c8789267a1f4feb4464
SHA512 21069a5a99d560e89efb17d6d46060cfbb5c38c9e366df834239cdf2e532c76eeb64d246a6a8ea05c5c52c4451c02e58eb093e372c461e195c374ae05625e3dd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1729a6c5aa4eb93b16a0ae30ecf766e0cec0af8687310bfb4f012402f433bde6
MD5 948b92f625043bebc3827b12ea59bce1
SHA1 f9def4d5d1eec483eac1a6c5f8aa8f1e44c8f5f8
SHA512 d6b3a10c691aea1f8070bd4e8e721c4e32d95e1a6ff2ea29e7d53ce99eeffdcb4fffb540227e70461b2364f6ea6f88ce96a07f8506c1c973ca9de5ec94991c43
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe580105.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580105.TMP
Size 1KB
SHA256 c9f7252231efbb85a49706d73f519ae8037b68be0ca801e39cdf648f6d2c27a1
MD5 0e758ee849b9aebb6ed459ccae032bd0
SHA1 9c7705804eadce5b71cd7d89bcd79a5817f6898c
SHA512 cfae4ee0120e29a8a1e463f34a241a123f8d0b3f334adc19b6ac22fdc41452b32d01323d333a3181103f969c521f3d3d3813be94e68a5d8402499874cef6bdad
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 47287506ced4c07dc26f021798ce57a5e6abce4ef2bc1e2bda8b0f5b5ac42480
MD5 47d44df2fd9bd6669e1f54d3f171811d
SHA1 e55be61277f98289f1861e83046d53c61e82efa8
SHA512 f700a5993b1691649ac9599eafc9a1b76533f6e9b7fcfee77be8b4e2e8b769e3a4e31e1f41bb0f4323e9f4661c53fec5ed1c5afe14879f234cec26adc85f8440
SSDEEP 3:ImtV4SzNguXlAh/GPl/ll79PaBUz+mCGYtiOiLl/:IiV4SPChOPl/D5KUSmHvnl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 112KB
SHA256 b62bbe6ef6aa0438aabf207e51857d52cfe854c0e59f76e9fdd669d61e9bfe42
MD5 354780499b81b1c238eb4bae699e1a13
SHA1 dc911d84c275e899fbd1e7da87894335f40ea292
SHA512 edfd31497d5d27aeebe95bdaabcb9951430a47260e8d66c9ce87df068fdaf377c839e27f5831ba56d8bef86de3243afb11e179605aaa5c0b2572581cc71cd81c
SSDEEP 192:9ogLUJAIH9IqR2nrQTjHbRmn8HKuqrTPN2rsdWVumQ6:9ofJAa9Ijnh8HKuqrTwsMVumQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 88KB
SHA256 d0805996c1f321b8212059aa36f2a1fe1625ce486dceff6e20f6bc752ba46cf7
MD5 a5f748b9d8cd3018469f7c6bc22ef783
SHA1 d6d9510e306e37e7873afbd5752be731216f11fa
SHA512 6beb07525081f102d01c2a925201614defbb4873be68f0eedafdee3104f8220cab6fa1f8defe6a13d73442a5312d931e652ec621ebe6253c8fd7d75fb6ec3165
SSDEEP 384:YL+DcugHaBMsmxCKabQzHL9KYVxpBPujCC5M+OIXyhA+u1H1i:G+DctgIayr8YVomaM+1H1i
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 135KB
SHA256 53500e5765697b2fdeab74c885b84f120de7529799ecaf38678e530ab8106229
MD5 0b41ce1d456ad55e8b9bd9d71da69054
SHA1 94226789771433cddb3925859056f942b9534932
SHA512 d90df668ffd94621369fa591cd241f5ac1961aa32e7b533639c74c4f2603fac49b8d10088e0f1f7bf42ddf322859cf8c234606482674fc9ee593514d65b5b52f
SSDEEP 384:0bfBs8Eqj/JF/fWdquiNnV34Q02rn4lxNKzuvcUiT5QtCbmOwx3Q/pgbtqvsre7j:2bggz/Dn
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 cd1f92f274f46e61924f4d90b20c6ddeaa6244be26148cdd3cedbe2545419d9d
MD5 0102cbc334453394fa7f16e04e61dad8
SHA1 254e2e05a11dd7189e8d3ed16ebbd618eebf3123
SHA512 995879d063bea0ecb4a73427f0fc7f7976b6d4a941aedade306a174e422f0c4611aa2244093af58df7e9c9b731edb7a8f2b57fd1769f14d9ff27a446de3efa56
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 cf91682a919e8ca0f17ca145006ebaba014b7814ee6d8f210f9ed8555f9abf0e
MD5 e36925d061760f5478a78d86dfe699d8
SHA1 0b545251558c3158b8bb8933d925947acf22e3f3
SHA512 3610e8711c51220646a1d19519c208ad47d3cc6f8b63f94e1547c92b4ce0dd68bc57c1aaa7fc4e0a1153514088e14eaee8f7cccf88ebe66e2203127a88d05ae3
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4
MD5 b29bcf9cd0e55f93000b4bb265a9810b
SHA1 e662b8c98bd5eced29495dbe2a8f1930e3f714b8
SHA512 e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2bea8959194a7a83c85d265f54a53f9f7cd3a461d08c52b79fe02d52887ab54c
MD5 f92f98c293e065b2d92cc696fd8fcbf1
SHA1 17b9c736ea7aee5e50286792366e8d72eca1d28d
SHA512 820906fa81343c506b2eb3554dc41a7cb7f20dbb52542bbe409c8a5829cdd4615dad00302b3a503350c371ea064d6ca712dd328595a838acf12f3197b361ef36
SSDEEP 384:89iIxuERzA83h09RZxASGRFPt/ybzeptE7ZPIMr6hrK3jC5:nIxuERzA83h09RZxbGR/OzevE7ZPVehd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fbdfc9f17d778dcd4501d484ecb0967935563d22630c050e745761eab2a39b26
MD5 811b8a558823ff0609c240809e083953
SHA1 dce70876b61dfed4fdbaee33aae37605e54ab58b
SHA512 9c5ad6efc6f4ebb3fd5b9846766f1f22579cef49dd88e75265b2145b24aa5c9f04d40468089518c4c73da9b62cfe9e9920cf45f407b3a3e0689fa1ba939daf6e
SSDEEP 192:loCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGFzFP5e2RU2ybSOmY+PkE7Euy:p9iIxuERzA83h09RZxASGRFPt/ybikEQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e3e7f4c072fc98ad0123a1e2fbd4c9f1fb2a2ce35948212dbd99bd1fa1a12aac
MD5 67acec440f0c71d9e2fd4cdd8fb7f633
SHA1 ea60cda22c09428d972638b8b25caabec1890de4
SHA512 1f55a2571efc240408c3e31ad2097c9e021784828c2167dd79b48a7b1c2339392e5c2d3f97a21d46a2c85a02e0503fa166885633ca5ef11f570f243bc9370363
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGFzFOe2RU2yTRmY+PEE7Eu/PC:M9iIxuERzA83h09RZxASGRFQ/yaEE7Za
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4bc7b423a767f2a67fd99d3d583ea3404ad2b2127fd27d9369419b521a53fd92
MD5 fda2729fd1a9535d1dffb7931733f696
SHA1 4eadd556236283d568d92eabfaf7060bc6dd77d4
SHA512 7bd6404fc8c3a256c7ba11dff7a40bf05b23376ca4ef85f9eaea81b73fe19abd534b29aa8e376ed286f0a77eec9e06be0ff67197044da7247a759a636915cf46
SSDEEP 384:k9iIxuERzA83h09RZxASGRFPtyyLUzeAtE7ZPIMr6hrK3jC5:vIxuERzA83h09RZxbGRyMUzeCE7ZPVeX
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 ae7fa00fbc9de161f17b9bcd558ff8c6f8b8cb94c2b30932b29a95dda12d71c6
MD5 9bb610c5e2ce573b706fd0c8324b3c1c
SHA1 8de20b459deced623413960d9ea332763e884fb1
SHA512 d9bfe763c9ee676dcc1411dfa48a1428a5684dfcbc618c4ed06ada454e989da6ac2575b1923d8a26a4ece4e275fca6ab338939264991b169bd02e06dc062a4ee
SSDEEP 3:MsEllllkEthXllkl2zE1lWq:/M/xT02zZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cfe8bfe6-960d-42a4-86d7-80ad525267d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cfe8bfe6-960d-42a4-86d7-80ad525267d1.tmp
Size 12KB
SHA256 63004f7a63ac0416d42d08b85254ab3e357d37e513145458e570944c530f8178
MD5 774682f588889ce94dc496b95f4530e0
SHA1 6ea008b8904f6d2f24f083aa484cc61d8f30f4fd
SHA512 e39ace090823f0550475c52cfdc860d7842a582d9e1d57a06d7d8c16fb3f0aec3ace90d44f9870bda1fcc52a8d7e6eb4af0c1db6ac7f12328568c9bb9e8b3eee
SSDEEP 384:Y9iIxuERzA83h09RZxASGeFPtyyYz/k227ZPIMrMTSj:DIxuERzA83h09RZxbGeyNz/k227ZPVAO
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 10KB
SHA256 0ea7613fb69bc81d4d2f515d22ac9b132e0a82c227785d225bb2eee0f147fc9d
MD5 405fc71d90ddaa1a11a46a82f45ec8a3
SHA1 145d5254a4838d1a93869d23586b9d13362d0895
SHA512 39803466888e1a00257a17dd9651c3c3b8035dda76f3c86d59a83045be87a210f88538c815d2a0076444eaac6140f9e5d5bd133a6a1150abee9907320e78e8fa
SSDEEP 192:3Jn49siyi7vi12YJrVkp1NDuJAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1NuJNIha:3Jkq12krVuJHpmXmlJVjeQ8RJoR8
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 10KB
SHA256 4a9b70f7113d5c252937ad9bbfa110031124ffe3643648db3f944111b61bd559
MD5 eebfb84605e05222e3ad98f4b9f62db2
SHA1 36ddd440df5b2776281ad245a6a57e7a183c09a0
SHA512 90e6f46d36c30783af4032f72beb58eb157849a8197e39945542da8a0c1313cb87e91f18a732f5718ec6a676fcd790458419bcc22c608824416fa6df14bf5ba6
SSDEEP 192:hJn49siyi7vi12YJrVkp1NDuJAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1LuJNIha:hJkq12krVuJHpmXmlJVjeQ8RJon8
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 243B
SHA256 2e5d271546d0d7a41d7450d900f299bba642f75233347f654164af150a25735e
MD5 0b13b335adfd3c2e8bc18b5492d0d229
SHA1 92e785434cceb51e231e463ff174760f0e819fdd
SHA512 7b2242fec4f67d581fefd7f2f35d5ea4177554d8a366d73e7bfdec148a3bf5b580e4add2b7da392e154317922b085a7ddc2ac2b7dcf8a7f20c07896621a98dc1
MD5 SHA1 SHA512

Submit Download

MalwareDatabase-master.zip

Path C:\Users\Admin\Downloads\MalwareDatabase-master.zip
Size 23.1MB
SHA256 2aabdae461a5807b251628ca9a360d153fbe010fa0c633e7240f2bde9f091348
MD5 7adf86df8229fce0b1a5754bbeb765af
SHA1 f7af84ad1c28a13d043f4886dbb168553ebd540d
SHA512 b177d6da8b8b27b89677e27d51f5c4b7a6b3a0f46e6ff4e0e17988e6c7c006ff5287552a1d447dfce3fb6f7f37085b4dd77c683121890e868280acc32d4b7f1e
SSDEEP 393216:HD4TVy+S+J2CKfF55cGh3wKLZwAXXZpjl4XQgMFINQc8vFYnRfSmygRWkBbz2PzN:jygfjeGhAKNlXXZp2H0INPGyqm7RP3Y5
MD5 SHA1 SHA512 SSDEEP

Submit Download

MalwareDatabase-master.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\MalwareDatabase-master.zip:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

EBD3.tmp

Path C:\Windows\EBD3.tmp
Size 60KB
SHA256 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
MD5 347ac3b6b791054de3e5720a7144a977
SHA1 413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA512 9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
SSDEEP 1536:QeRCKjey4TTGLeBYEUW1SIUDoCB449rHUV:KKjey4TTmeBZUGSIUDoCq49oV
MD5 SHA1 SHA512 SSDEEP

Submit Download

infpub.dat

Path C:\Windows\infpub.dat
Size 401KB
SHA256 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
MD5 1d724f95c61f1055f0d02c2154bbccd3
SHA1 79116fe99f2b421c52ef64097f0f39b815b20907
SHA512 f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113
SSDEEP 12288:GtDjvhNTc/cq4RKZZKfArRuSA80m+/6sXRnfPGp:IjTc/cq4RUZaArbInfPGp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/484-1083-0x00007FFCD89A0000-0x00007FFCD89D4000-memory.dmp

Download

memory/484-1082-0x00007FF6552F0000-0x00007FF6553E8000-memory.dmp

Download

memory/484-1084-0x00007FFCCF930000-0x00007FFCCFBE4000-memory.dmp

Download

memory/484-1085-0x00007FFCCD9F0000-0x00007FFCCEA9B000-memory.dmp

Download

memory/484-1086-0x00007FFCCD290000-0x00007FFCCD3A2000-memory.dmp

Download

memory/2356-704-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Download

memory/2356-720-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-701-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Download

memory/2356-702-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Download

memory/2356-764-0x00007FFCF1680000-0x00007FFCF173D000-memory.dmp

Download

memory/2356-763-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-762-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Download

memory/2356-761-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Download

memory/2356-760-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Download

memory/2356-759-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Download

memory/2356-741-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-740-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-739-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-724-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-723-0x00007FFCF1680000-0x00007FFCF173D000-memory.dmp

Download

memory/2356-722-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-721-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-705-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-719-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-718-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-717-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-716-0x00007FFCAF600000-0x00007FFCAF610000-memory.dmp

Download

memory/2356-715-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-714-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-713-0x00007FFCAF600000-0x00007FFCAF610000-memory.dmp

Download

memory/2356-712-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-711-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-708-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Download

memory/2356-710-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-709-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-706-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Download

memory/2356-707-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/2356-703-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Download

memory/3572-908-0x0000000003010000-0x0000000003078000-memory.dmp

Download

memory/3572-897-0x0000000003010000-0x0000000003078000-memory.dmp

Download

memory/3572-905-0x0000000003010000-0x0000000003078000-memory.dmp

Download