hxxps://www[.]mediafire[.]com/file/c14w8fqpeu8ziwh/Nitro_generator[.]exe/file

Analysis

max time kernel
131s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/c14w8fqpeu8ziwh/Nitro_generator.exe/file

Score

8^/10

pyinstaller upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3200	Nitro_generator.exe
2804	Nitro_generator.exe

Loads dropped DLL 58 IoCs

pid	Process
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000600000002335c-574.dat	upx
behavioral1/memory/2804-578-0x00007FFCD8580000-0x00007FFCD89EE000-memory.dmp	upx
behavioral1/files/0x0006000000023314-584.dat	upx
behavioral1/files/0x0006000000023353-586.dat	upx
behavioral1/memory/2804-587-0x00007FFCEBBD0000-0x00007FFCEBBF4000-memory.dmp	upx
behavioral1/files/0x000600000002331c-589.dat	upx
behavioral1/files/0x000600000002335f-593.dat	upx
behavioral1/memory/2804-592-0x00007FFCEBBB0000-0x00007FFCEBBC9000-memory.dmp	upx
behavioral1/files/0x000600000002335e-594.dat	upx
behavioral1/files/0x0006000000023313-599.dat	upx
behavioral1/files/0x0006000000023318-601.dat	upx
behavioral1/files/0x000600000002335d-606.dat	upx
behavioral1/files/0x000600000002335d-607.dat	upx
behavioral1/memory/2804-603-0x00007FFCEBB30000-0x00007FFCEBB5D000-memory.dmp	upx
behavioral1/files/0x0006000000023363-609.dat	upx
behavioral1/memory/2804-612-0x00007FFCEC6F0000-0x00007FFCEC6FD000-memory.dmp	upx
behavioral1/memory/2804-614-0x00007FFCEBB60000-0x00007FFCEBB79000-memory.dmp	upx
behavioral1/files/0x000600000002335a-613.dat	upx
behavioral1/files/0x000600000002331b-617.dat	upx
behavioral1/memory/2804-619-0x00007FFCEB860000-0x00007FFCEB86D000-memory.dmp	upx
behavioral1/memory/2804-618-0x00007FFCDA320000-0x00007FFCDA354000-memory.dmp	upx
behavioral1/memory/2804-615-0x00007FFCDA360000-0x00007FFCDA41C000-memory.dmp	upx
behavioral1/memory/2804-610-0x00007FFCDCDC0000-0x00007FFCDCDEB000-memory.dmp	upx
behavioral1/memory/2804-598-0x00007FFCEBB80000-0x00007FFCEBBAE000-memory.dmp	upx
behavioral1/memory/2804-590-0x00007FFCF1610000-0x00007FFCF161F000-memory.dmp	upx
behavioral1/files/0x0006000000023315-621.dat	upx
behavioral1/memory/2804-622-0x00007FFCDA2D0000-0x00007FFCDA312000-memory.dmp	upx
behavioral1/files/0x000600000002331f-624.dat	upx
behavioral1/files/0x0006000000023359-625.dat	upx
behavioral1/memory/2804-626-0x00007FFCEB830000-0x00007FFCEB83A000-memory.dmp	upx
behavioral1/memory/2804-627-0x00007FFCDC4A0000-0x00007FFCDC4BC000-memory.dmp	upx
behavioral1/memory/2804-628-0x00007FFCD8580000-0x00007FFCD89EE000-memory.dmp	upx
behavioral1/memory/2804-629-0x00007FFCDA2A0000-0x00007FFCDA2CE000-memory.dmp	upx
behavioral1/memory/2804-630-0x00007FFCD8200000-0x00007FFCD8575000-memory.dmp	upx
behavioral1/memory/2804-631-0x00007FFCDA1E0000-0x00007FFCDA298000-memory.dmp	upx
behavioral1/memory/2804-632-0x00007FFCDA1C0000-0x00007FFCDA1D4000-memory.dmp	upx
behavioral1/memory/2804-633-0x00007FFCD9FB0000-0x00007FFCD9FD5000-memory.dmp	upx
behavioral1/memory/2804-634-0x00007FFCEAFD0000-0x00007FFCEAFDB000-memory.dmp	upx
behavioral1/memory/2804-636-0x00007FFCD9D10000-0x00007FFCD9E81000-memory.dmp	upx
behavioral1/memory/2804-635-0x00007FFCD9E90000-0x00007FFCD9FA8000-memory.dmp	upx
behavioral1/memory/2804-637-0x00007FFCE8C70000-0x00007FFCE8C7B000-memory.dmp	upx
behavioral1/memory/2804-638-0x00007FFCE8020000-0x00007FFCE802C000-memory.dmp	upx
behavioral1/memory/2804-640-0x00007FFCE4910000-0x00007FFCE491C000-memory.dmp	upx
behavioral1/memory/2804-641-0x00007FFCE28D0000-0x00007FFCE28DB000-memory.dmp	upx
behavioral1/memory/2804-642-0x00007FFCE2880000-0x00007FFCE288C000-memory.dmp	upx
behavioral1/memory/2804-643-0x00007FFCE21B0000-0x00007FFCE21BD000-memory.dmp	upx
behavioral1/memory/2804-645-0x00007FFCDCD70000-0x00007FFCDCD7C000-memory.dmp	upx
behavioral1/memory/2804-644-0x00007FFCDCDB0000-0x00007FFCDCDBE000-memory.dmp	upx
behavioral1/memory/2804-646-0x00007FFCDCD10000-0x00007FFCDCD1C000-memory.dmp	upx
behavioral1/memory/2804-639-0x00007FFCE6EC0000-0x00007FFCE6ECB000-memory.dmp	upx
behavioral1/memory/2804-648-0x00007FFCD9D00000-0x00007FFCD9D0B000-memory.dmp	upx
behavioral1/memory/2804-650-0x00007FFCD9CF0000-0x00007FFCD9CFB000-memory.dmp	upx
behavioral1/memory/2804-652-0x00007FFCD9CD0000-0x00007FFCD9CDC000-memory.dmp	upx
behavioral1/memory/2804-651-0x00007FFCD9CE0000-0x00007FFCD9CEC000-memory.dmp	upx
behavioral1/memory/2804-653-0x00007FFCD9CC0000-0x00007FFCD9CCD000-memory.dmp	upx
behavioral1/memory/2804-654-0x00007FFCD9390000-0x00007FFCD93A2000-memory.dmp	upx
behavioral1/memory/2804-655-0x00007FFCD9CB0000-0x00007FFCD9CBC000-memory.dmp	upx
behavioral1/memory/2804-656-0x00007FFCD9370000-0x00007FFCD9385000-memory.dmp	upx
behavioral1/memory/2804-657-0x00007FFCD9360000-0x00007FFCD9370000-memory.dmp	upx
behavioral1/memory/2804-658-0x00007FFCD81C0000-0x00007FFCD81DC000-memory.dmp	upx
behavioral1/memory/2804-659-0x00007FFCD8180000-0x00007FFCD8195000-memory.dmp	upx
behavioral1/memory/2804-660-0x00007FFCD8130000-0x00007FFCD813E000-memory.dmp	upx
behavioral1/memory/2804-661-0x00007FFCD8110000-0x00007FFCD8126000-memory.dmp	upx
behavioral1/memory/2804-662-0x00007FFCEBBD0000-0x00007FFCEBBF4000-memory.dmp	upx

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
337	ipapi.co
338	ipapi.co

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0006000000023285-354.dat	pyinstaller
behavioral1/files/0x0006000000023285-417.dat	pyinstaller
behavioral1/files/0x0006000000023285-418.dat	pyinstaller
behavioral1/files/0x0006000000023285-571.dat	pyinstaller

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 910247.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2196	msedge.exe
2196	msedge.exe
1500	identity_helper.exe
1500	identity_helper.exe
5356	msedge.exe
5356	msedge.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
2804	Nitro_generator.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	Nitro_generator.exe
Token: SeIncreaseQuotaPrivilege	3440	WMIC.exe
Token: SeSecurityPrivilege	3440	WMIC.exe
Token: SeTakeOwnershipPrivilege	3440	WMIC.exe
Token: SeLoadDriverPrivilege	3440	WMIC.exe
Token: SeSystemProfilePrivilege	3440	WMIC.exe
Token: SeSystemtimePrivilege	3440	WMIC.exe
Token: SeProfSingleProcessPrivilege	3440	WMIC.exe
Token: SeIncBasePriorityPrivilege	3440	WMIC.exe
Token: SeCreatePagefilePrivilege	3440	WMIC.exe
Token: SeBackupPrivilege	3440	WMIC.exe
Token: SeRestorePrivilege	3440	WMIC.exe
Token: SeShutdownPrivilege	3440	WMIC.exe
Token: SeDebugPrivilege	3440	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3440	WMIC.exe
Token: SeRemoteShutdownPrivilege	3440	WMIC.exe
Token: SeUndockPrivilege	3440	WMIC.exe
Token: SeManageVolumePrivilege	3440	WMIC.exe
Token: 33	3440	WMIC.exe
Token: 34	3440	WMIC.exe
Token: 35	3440	WMIC.exe
Token: 36	3440	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3440	WMIC.exe
Token: SeSecurityPrivilege	3440	WMIC.exe
Token: SeTakeOwnershipPrivilege	3440	WMIC.exe
Token: SeLoadDriverPrivilege	3440	WMIC.exe
Token: SeSystemProfilePrivilege	3440	WMIC.exe
Token: SeSystemtimePrivilege	3440	WMIC.exe
Token: SeProfSingleProcessPrivilege	3440	WMIC.exe
Token: SeIncBasePriorityPrivilege	3440	WMIC.exe
Token: SeCreatePagefilePrivilege	3440	WMIC.exe
Token: SeBackupPrivilege	3440	WMIC.exe
Token: SeRestorePrivilege	3440	WMIC.exe
Token: SeShutdownPrivilege	3440	WMIC.exe
Token: SeDebugPrivilege	3440	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3440	WMIC.exe
Token: SeRemoteShutdownPrivilege	3440	WMIC.exe
Token: SeUndockPrivilege	3440	WMIC.exe
Token: SeManageVolumePrivilege	3440	WMIC.exe
Token: 33	3440	WMIC.exe
Token: 34	3440	WMIC.exe
Token: 35	3440	WMIC.exe
Token: 36	3440	WMIC.exe
Token: SeDebugPrivilege	1628	taskmgr.exe
Token: SeSystemProfilePrivilege	1628	taskmgr.exe
Token: SeCreateGlobalPrivilege	1628	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe
1628	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4828	2196	msedge.exe	43
PID 2196 wrote to memory of 4828	2196	msedge.exe	43
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2484	2196	msedge.exe	87
PID 2196 wrote to memory of 2404	2196	msedge.exe	86
PID 2196 wrote to memory of 2404	2196	msedge.exe	86
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88
PID 2196 wrote to memory of 2456	2196	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/c14w8fqpeu8ziwh/Nitro_generator.exe/file
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffceb6d46f8,0x7ffceb6d4708,0x7ffceb6d4718
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8148 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7244 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8665176380230787346,18206806238257270305,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3172

C:\Users\Admin\Downloads\Nitro_generator.exe
"C:\Users\Admin\Downloads\Nitro_generator.exe"
1⤵
- Executes dropped EXE
PID:3200
- C:\Users\Admin\Downloads\Nitro_generator.exe
  "C:\Users\Admin\Downloads\Nitro_generator.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
    3⤵
    PID:6048
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3440

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
66bdbc2475fd0c7e14c092b313d5ebaf

SHA1
0646d883f12622660ee64c141dfd0a9fc1409397

SHA256
17418e89b4565fa1e01d17d511819deee40155057bede543b988954cc865e888

SHA512
28e8eb2e696b10fbf5003ceabd4a0bd8894a0f473f6fc42ca4a1485438f2e089694f10f3d2ea100de9342a7a7c4e986d46a7f08db08460839867ebe3b07024ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
a4a094cbb6a347dad8c1fe05f915081d

SHA1
775c6a60feacf98fc4944cd7f115c0fc06ceddb8

SHA256
c7bf4dc9dae81b91495976f9f4c38609cf4a8ce212789c6c6593a48422bba6cb

SHA512
393c31556c0510c086e9f90149c05e00a19721df19c68d99f60c9db04cfed2f618f965e19dccbcc8a34af9055acc11ed525b4056ac465f4cccc014139e2fe834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50a19cfe496567042cd1fb166c94a92b

SHA1
46cdc797154d1898010616f4662e8d435b79b4f7

SHA256
9e608440e9b0ebf9a89307cd8a5215810d4d5ff485a2184878959fe275bb1b2b

SHA512
5f7018f912ee648cde376e8f458ecc3787aa84b9dfe0cc550c7a93fbc2dddb92db21241f424ce9956174acfaa1bacca6f59b3405b81db20336ba8ac58104ecc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
54ee02dd646a8cc4c6106564e5e86a65

SHA1
f46a862c55b686c331d2e90ecacb731a016f13d6

SHA256
10f629cb57e035bd8da52cafb4360ff9c78c730cea14218ed73152d460ebe168

SHA512
1325ca9560c9008bdd5d4d825f05d7b09459639197f747cdf0f3c6d6c63e8454b6564fff7a01be851ad5946f95ee3de7d56faf1455517f5010acb656b4020ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d52aedc9295f1d968103a274d1036277

SHA1
fc9c52471cc1bc3dba78b37f46d0ff768afbedbc

SHA256
8464d7a3c417fb091f3e4885508045fba7d3b957b8e91edc21e2bb1da1e7cb98

SHA512
e1d688ce660542357c3f7c0a434124ceca2546d1cc06abd263e00d55f83dfa59a94d594fea8a816e04bef0f2d615dd177aad4e7120953e2e647c0369e01dd9c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
9a73c821ce9b5486962f128caef3643e

SHA1
b4346b5a582041635744a460b0fedf74b304a820

SHA256
eba6d8fc97aaa4b569571668d562c52e2387d47e9f3257a6feae58cf244be998

SHA512
4d4f0961045d8203042e5b6e29ea5ad5e47b943175aa18b0f5f71469613cd68465586f24b300ee670736fb7435d1a8e43d7a9bd90081f4e7e63a5c172e040105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
911016b8fc9e811d790adeb773218e13

SHA1
bc5e4cba05b4df2a890eb3d3645a749153ba3443

SHA256
8431b24ca0615c3180837f4c9624c2dfd2ad2349bdbb186e37e64e77d19e1c52

SHA512
7a1f0c3200e94a520648d01cbdeb10815acc76ba02ab3f278e2b9f871b3f76f1c86d2880ea3ef9ff262574e24b782a871b2bcc972a85eb36ff6e644d8a8463c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5f68e01904503e29923a5ed1584e662d

SHA1
e2fabc56a77cc24f2d0900d144393b8dd2c6a54a

SHA256
85215a85808eadd37f56609b626a90804be50dbe6205d65d5ddac58042b8edd9

SHA512
775fe307c92befef0953e9d8c384c38490a780b97e4591815498725d0addc8babc63846b8915c4cfe1dfb4125d1e7889bfba5e0198e105f902cfd3f177fe8209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ac10231038c0dec0d1153231784ba915

SHA1
a4746a42f2112ec095bd466697c306cb35c0574f

SHA256
49c84d67be13b048f9be66ccefb872c572fb9d276b2b1b2027e3b825f6769631

SHA512
9bb76ff24d2f2d205b5e9b2607280fdf483cee9656243e08f8b338285021fdb9ca06801e4dc842b9d7d0b0e1df26ebe747ae92527a683256d66d9c41188f0fdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c9b8.TMP

Filesize
1KB

MD5
a144b540a5c75cbdc4f39c9d4bf7e19f

SHA1
0b650faf5fb6fee4e1d7c52befa93284e9b01985

SHA256
f67b4a8bc0a078b0e01fe4f82ebacb28139a7463ff8276ca4f6e48e201835191

SHA512
2f43d9964f8a04a44fdb41a115a41ff69aafac00b4ed0126e3b6ed615a4a29cd94af9a3a027073b04d5c5d34fcc4e1f2aa63e4a906308f82d33a486c8919faad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f97e7f07500c7c0c39bf5c2e762dc8e8

SHA1
f0ec36f9eff63ecc1a4f7579469e98c91f4875c4

SHA256
145124e70d4bfe8e6efb050e8332ab98e59d4edccf781bcbdacb1ca27d37e18c

SHA512
1b02e8b92c1c786b077212ef9a2045092671ad3e172dff54e0471da53a566fdfc7b35766207f51fc578c167d4f8e62dd81eda79a2e2ff1f7509fb77d26ab0227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
86e3951500312f3f52b3172226459293

SHA1
f548d1dd5241ec508c7422cd49ca228529884991

SHA256
55d9f3ee76aa4c3436779ebe69f095421a12c447b938b36f1f74130aac732bc8

SHA512
dc543d1d714793bd5c5890eea217bdd8d907e22589505b67d69737eb54313eea7f5d581978522832254c0ae9af6359dc4d03cf463c18027e16113e712f7fcc95

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\VCRUNTIME140_1.dll

Filesize
48KB

MD5
bba9680bc310d8d25e97b12463196c92

SHA1
9a480c0cf9d377a4caedd4ea60e90fa79001f03a

SHA256
e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab

SHA512
1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\_bz2.pyd

Filesize
47KB

MD5
758fff1d194a7ac7a1e3d98bcf143a44

SHA1
de1c61a8e1fb90666340f8b0a34e4d8bfc56da07

SHA256
f5e913a9f2adf7d599ea9bb105e144ba11699bbcb1514e73edcf7e062354e708

SHA512
468d7c52f14812d5bde1e505c95cb630e22d71282bda05bf66324f31560bfa06095cf60fc0d34877f8b361ccd65a1b61d0fd1f91d52facb0baf8e74f3fed31cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\_ctypes.pyd

Filesize
56KB

MD5
6ca9a99c75a0b7b6a22681aa8e5ad77b

SHA1
dd1118b7d77be6bb33b81da65f6b5dc153a4b1e8

SHA256
d39390552c55d8fd4940864905cd4437bc3f8efe7ff3ca220543b2c0efab04f8

SHA512
b0b5f2979747d2f6796d415dd300848f32b4e79ede59827ac447af0f4ea8709b60d6935d09e579299b3bc54b6c0f10972f17f6c0d1759c5388ad5b14689a23fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\_decimal.pyd

Filesize
103KB

MD5
eb45ea265a48348ce0ac4124cb72df22

SHA1
ecdc1d76a205f482d1ed9c25445fa6d8f73a1422

SHA256
3881f00dbc4aadf9e87b44c316d93425a8f6ba73d72790987226238defbc7279

SHA512
f7367bf2a2d221a7508d767ad754b61b2b02cdd7ae36ae25b306f3443d4800d50404ac7e503f589450ed023ff79a2fb1de89a30a49aa1dd32746c3e041494013

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\_lzma.pyd

Filesize
84KB

MD5
abceeceaeff3798b5b0de412af610f58

SHA1
c3c94c120b5bed8bccf8104d933e96ac6e42ca90

SHA256
216aa4bb6f62dd250fd6d2dcde14709aa82e320b946a21edeec7344ed6c2c62e

SHA512
3e1a2eb86605aa851a0c5153f7be399f6259ecaad86dbcbf12eeae5f985dc2ea2ab25683285e02b787a5b75f7df70b4182ae8f1567946f99ad2ec7b27d4c7955

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\_queue.pyd

Filesize
24KB

MD5
0d267bb65918b55839a9400b0fb11aa2

SHA1
54e66a14bea8ae551ab6f8f48d81560b2add1afc

SHA256
13ee41980b7d0fb9ce07f8e41ee6a309e69a30bbf5b801942f41cbc357d59e9c

SHA512
c2375f46a98e44f54e2dd0a5cc5f016098500090bb78de520dc5e05aef8e6f11405d8f6964850a03060caed3628d0a6303091cba1f28a0aa9b3b814217d71e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\_socket.pyd

Filesize
41KB

MD5
afd296823375e106c4b1ac8b39927f8b

SHA1
b05d811e5a5921d5b5cc90b9e4763fd63783587b

SHA256
e423a7c2ce5825dfdd41cfc99c049ff92abfb2aa394c85d0a9a11de7f8673007

SHA512
95e98a24be9e603b2870b787349e2aa7734014ac088c691063e4078e11a04898c9c547d6998224b1b171fc4802039c3078a28c7e81d59f6497f2f9230d8c9369

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\_uuid.pyd

Filesize
21KB

MD5
81dfa68ca3cb20ced73316dbc78423f6

SHA1
8841cf22938aa6ee373ff770716bb9c6d9bc3e26

SHA256
d0cb6dd98a2c9d4134c6ec74e521bad734bc722d6a3b4722428bf79e7b66f190

SHA512
e24288ae627488251682cd47c1884f2dc5f4cd834d7959b9881e5739c42d91fd0a30e75f0de77f5b5a0d63d9baebcafa56851e7e40812df367fd433421c0ccdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\base_library.zip

Filesize
812KB

MD5
524a85217dc9edc8c9efc73159ca955d

SHA1
a4238cbde50443262d00a843ffe814435fb0f4e2

SHA256
808549964adb09afafb410cdc030df4813c5c2a7276a94e7f116103af5de7621

SHA512
f5a929b35a63f073bdc7600155ba2f0f262e6f60cf67efb38fa44e8b3be085cf1d5741d66d25a1ecaaf3f94abfe9bbe97d135f8a47c11f2b811d2aac6876f46c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\libffi-7.dll

Filesize
23KB

MD5
b5150b41ca910f212a1dd236832eb472

SHA1
a17809732c562524b185953ffe60dfa91ba3ce7d

SHA256
1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a

SHA512
9e82b0caa3d72bb4a7ad7d66ebfb10edb778749e89280bca67c766e72dc794e99aab2bc2980d64282a384699929ce6cc996462a73584898d2df67a57bff2a9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\psutil\_psutil_windows.pyd

Filesize
34KB

MD5
fb17b2f2f09725c3ffca6345acd7f0a8

SHA1
b8d747cc0cb9f7646181536d9451d91d83b9fc61

SHA256
9c7d401418db14353db85b54ff8c7773ee5d17cbf9a20085fde4af652bd24fc4

SHA512
b4acb60045da8639779b6bb01175b13344c3705c92ea55f9c2942f06c89e5f43cedae8c691836d63183cacf2d0a98aa3bcb0354528f1707956b252206991bf63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\pyexpat.pyd

Filesize
86KB

MD5
5a328b011fa748939264318a433297e2

SHA1
d46dd2be7c452e5b6525e88a2d29179f4c07de65

SHA256
e8a81b47029e8500e0f4e04ccf81f8bdf23a599a2b5cd627095678cdf2fabc14

SHA512
06fa8262378634a42f5ab8c1e5f6716202544c8b304de327a08aa20c8f888114746f69b725ed3088d975d09094df7c3a37338a93983b957723aa2b7fda597f87

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\python3.dll

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\pythoncom310.dll

Filesize
192KB

MD5
8c34d0ed66de2d260768f6b4edce70c6

SHA1
9cf9f8fa18f72a2f4180e110e24ae0efb0be61fa

SHA256
c25de0eb437aaee5a3acb50557d46df317ae9fd3653a1599c8c36d03637ed4f3

SHA512
13f74ce06eacda4e217303480806b30ea8e2bbb28afe564fa8052d1b1139722b4f4c5912ab7220a09077522520eebd25904aeecf25e110978046a7636be74244

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\pythoncom310.dll

Filesize
133KB

MD5
910896304e15e54121b2de820e282c4d

SHA1
dc9475c3b303b8465cb863a1c25e793cec4fa96b

SHA256
eb09eeba681e59e155958813cd3fef55b1c0af1a0b41f3e44a57b2af388512f0

SHA512
0e80017fe7efcee9c72300effdd3869ac10c92e2787da0bbe8e9b7617363026b2ef290f67a50ad2d0fa231b4e11187e6ea5016f057a0cbde80f95ee9a7adf04a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\pywintypes310.dll

Filesize
62KB

MD5
6f2aa8fa02f59671f99083f9cef12cda

SHA1
9fd0716bcde6ac01cd916be28aa4297c5d4791cd

SHA256
1a15d98d4f9622fa81b60876a5f359707a88fbbbae3ae4e0c799192c378ef8c6

SHA512
f5d5112e63307068cdb1d0670fe24b65a9f4942a39416f537bdbc17dedfd99963861bf0f4e94299cdce874816f27b3d86c4bebb889c3162c666d5ee92229c211

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\select.pyd

Filesize
24KB

MD5
72009cde5945de0673a11efb521c8ccd

SHA1
bddb47ac13c6302a871a53ba303001837939f837

SHA256
5aaa15868421a46461156e7817a69eeeb10b29c1e826a9155b5f8854facf3dca

SHA512
d00a42700c9201f23a44fd9407fea7ea9df1014c976133f33ff711150727bf160941373d53f3a973f7dd6ca7b5502e178c2b88ea1815ca8bce1a239ed5d8256d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\ucrtbase.dll

Filesize
993KB

MD5
9679f79d724bcdbd3338824ffe8b00c7

SHA1
5ded91cc6e3346f689d079594cf3a9bf1200bd61

SHA256
962c50afcb9fbfd0b833e0d2d7c2ba5cb35cd339ecf1c33ddfb349253ff95f36

SHA512
74ac8deb4a30f623af1e90e594d66fe28a1f86a11519c542c2bad44e556b2c5e03d41842f34f127f8f7f7cb217a6f357604cb2dc6aa5edc5cba8b83673d8b8bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32002\win32api.pyd

Filesize
48KB

MD5
561f419a2b44158646ee13cd9af44c60

SHA1
93212788de48e0a91e603d74f071a7c8f42fe39b

SHA256
631465da2a1dad0cb11cd86b14b4a0e4c7708d5b1e8d6f40ae9e794520c3aaf7

SHA512
d76ab089f6dc1beffd5247e81d267f826706e60604a157676e6cbc3b3447f5bcee66a84bf35c21696c020362fadd814c3e0945942cdc5e0dfe44c0bca169945c

Download Submit
C:\Users\Admin\Downloads\Nitro_generator.exe

Filesize
9.2MB

MD5
59508862a436b0f4f1f15f1729139c28

SHA1
aa364ae3d7c17524ae25ffe6805a98737d09ced8

SHA256
7d5c12d58d28bf9241e55c02129ec9320aeb7c6798a20da2f079b9f43b05369d

SHA512
717408c5271c8fe56cbf46f480d8669fa37261c76df93a28226fa4a43b57c1a4af68822390fb1d3195062b77d93e2b0f3dca45ba72130c155c903ca469bbb123

Download Submit
C:\Users\Admin\Downloads\Nitro_generator.exe

Filesize
10.2MB

MD5
bd0d2b36614c00fbd4db56d07c7fe970

SHA1
43ed6b455bcc7b1f618056378b2a4bb7e02984e0

SHA256
ac606fb7cc73306dc26cf3c7e4585cc4668096f515afcb63b972aaa650203593

SHA512
0899bd653903bc00c0385344327cfc9e3b60b298226d7f9919f665cf47a7189459c1936abff8956ffc63cdec3c4cc14d5b5cd07f20fdb0671c21f7991468bfe8

Download Submit
C:\Users\Admin\Downloads\Nitro_generator.exe

Filesize
1.0MB

MD5
4c7feb1e1aebef9b5b24ed82e25476fd

SHA1
856279b11c46e2f372277fce70b040ead545132b

SHA256
c90e4ff83ca4dc2a2d573afb2dce01f24f270c93bb2a6e09e08dcd65521d6289

SHA512
875e466e1d1331632b116e7cf50c4c038747220ba8ad0efe55129474f55e3487872e5f1918b100a7c2a52ed0f10aa2c4e2c14e910878d669aa490533f9a32c2e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 910247.crdownload

Filesize
17.6MB

MD5
d7667c91a11eb94f5b37e63345d4139e

SHA1
8ec16fbe560509694971ba98fae9205f55452056

SHA256
01110e637d0b9af8b7c39fb1894cd2dc5b9f27b6dee0f8664b1b006665975861

SHA512
a7025a51655b81f7f08f3f133c51807d86b98f332f9e744370b6b0c8d52d4e9aac043c13222639bf8c91439cba657db6836f3c9f994afb119e32b525afe69333

Download Submit
memory/1628-840-0x00000242FAF70000-0x00000242FAF71000-memory.dmp

Filesize
4KB

Download
memory/1628-839-0x00000242FAF70000-0x00000242FAF71000-memory.dmp

Filesize
4KB

Download
memory/1628-838-0x00000242FAF70000-0x00000242FAF71000-memory.dmp

Filesize
4KB

Download
memory/1628-841-0x00000242FAF70000-0x00000242FAF71000-memory.dmp

Filesize
4KB

Download
memory/1628-831-0x00000242FAF70000-0x00000242FAF71000-memory.dmp

Filesize
4KB

Download
memory/1628-830-0x00000242FAF70000-0x00000242FAF71000-memory.dmp

Filesize
4KB

Download
memory/1628-829-0x00000242FAF70000-0x00000242FAF71000-memory.dmp

Filesize
4KB

Download
memory/1628-836-0x00000242FAF70000-0x00000242FAF71000-memory.dmp

Filesize
4KB

Download
memory/1628-835-0x00000242FAF70000-0x00000242FAF71000-memory.dmp

Filesize
4KB

Download
memory/1628-837-0x00000242FAF70000-0x00000242FAF71000-memory.dmp

Filesize
4KB

Download
memory/2804-654-0x00007FFCD9390000-0x00007FFCD93A2000-memory.dmp

Filesize
72KB

Download
memory/2804-683-0x00007FFCDCDC0000-0x00007FFCDCDEB000-memory.dmp

Filesize
172KB

Download
memory/2804-590-0x00007FFCF1610000-0x00007FFCF161F000-memory.dmp

Filesize
60KB

Download
memory/2804-626-0x00007FFCEB830000-0x00007FFCEB83A000-memory.dmp

Filesize
40KB

Download
memory/2804-627-0x00007FFCDC4A0000-0x00007FFCDC4BC000-memory.dmp

Filesize
112KB

Download
memory/2804-628-0x00007FFCD8580000-0x00007FFCD89EE000-memory.dmp

Filesize
4.4MB

Download
memory/2804-629-0x00007FFCDA2A0000-0x00007FFCDA2CE000-memory.dmp

Filesize
184KB

Download
memory/2804-630-0x00007FFCD8200000-0x00007FFCD8575000-memory.dmp

Filesize
3.5MB

Download
memory/2804-631-0x00007FFCDA1E0000-0x00007FFCDA298000-memory.dmp

Filesize
736KB

Download
memory/2804-632-0x00007FFCDA1C0000-0x00007FFCDA1D4000-memory.dmp

Filesize
80KB

Download
memory/2804-633-0x00007FFCD9FB0000-0x00007FFCD9FD5000-memory.dmp

Filesize
148KB

Download
memory/2804-634-0x00007FFCEAFD0000-0x00007FFCEAFDB000-memory.dmp

Filesize
44KB

Download
memory/2804-636-0x00007FFCD9D10000-0x00007FFCD9E81000-memory.dmp

Filesize
1.4MB

Download
memory/2804-635-0x00007FFCD9E90000-0x00007FFCD9FA8000-memory.dmp

Filesize
1.1MB

Download
memory/2804-637-0x00007FFCE8C70000-0x00007FFCE8C7B000-memory.dmp

Filesize
44KB

Download
memory/2804-638-0x00007FFCE8020000-0x00007FFCE802C000-memory.dmp

Filesize
48KB

Download
memory/2804-640-0x00007FFCE4910000-0x00007FFCE491C000-memory.dmp

Filesize
48KB

Download
memory/2804-641-0x00007FFCE28D0000-0x00007FFCE28DB000-memory.dmp

Filesize
44KB

Download
memory/2804-642-0x00007FFCE2880000-0x00007FFCE288C000-memory.dmp

Filesize
48KB

Download
memory/2804-643-0x00007FFCE21B0000-0x00007FFCE21BD000-memory.dmp

Filesize
52KB

Download
memory/2804-645-0x00007FFCDCD70000-0x00007FFCDCD7C000-memory.dmp

Filesize
48KB

Download
memory/2804-644-0x00007FFCDCDB0000-0x00007FFCDCDBE000-memory.dmp

Filesize
56KB

Download
memory/2804-646-0x00007FFCDCD10000-0x00007FFCDCD1C000-memory.dmp

Filesize
48KB

Download
memory/2804-639-0x00007FFCE6EC0000-0x00007FFCE6ECB000-memory.dmp

Filesize
44KB

Download
memory/2804-648-0x00007FFCD9D00000-0x00007FFCD9D0B000-memory.dmp

Filesize
44KB

Download
memory/2804-650-0x00007FFCD9CF0000-0x00007FFCD9CFB000-memory.dmp

Filesize
44KB

Download
memory/2804-652-0x00007FFCD9CD0000-0x00007FFCD9CDC000-memory.dmp

Filesize
48KB

Download
memory/2804-651-0x00007FFCD9CE0000-0x00007FFCD9CEC000-memory.dmp

Filesize
48KB

Download
memory/2804-653-0x00007FFCD9CC0000-0x00007FFCD9CCD000-memory.dmp

Filesize
52KB

Download
memory/2804-598-0x00007FFCEBB80000-0x00007FFCEBBAE000-memory.dmp

Filesize
184KB

Download
memory/2804-655-0x00007FFCD9CB0000-0x00007FFCD9CBC000-memory.dmp

Filesize
48KB

Download
memory/2804-656-0x00007FFCD9370000-0x00007FFCD9385000-memory.dmp

Filesize
84KB

Download
memory/2804-657-0x00007FFCD9360000-0x00007FFCD9370000-memory.dmp

Filesize
64KB

Download
memory/2804-658-0x00007FFCD81C0000-0x00007FFCD81DC000-memory.dmp

Filesize
112KB

Download
memory/2804-659-0x00007FFCD8180000-0x00007FFCD8195000-memory.dmp

Filesize
84KB

Download
memory/2804-660-0x00007FFCD8130000-0x00007FFCD813E000-memory.dmp

Filesize
56KB

Download
memory/2804-661-0x00007FFCD8110000-0x00007FFCD8126000-memory.dmp

Filesize
88KB

Download
memory/2804-662-0x00007FFCEBBD0000-0x00007FFCEBBF4000-memory.dmp

Filesize
144KB

Download
memory/2804-663-0x00007FFCEBBB0000-0x00007FFCEBBC9000-memory.dmp

Filesize
100KB

Download
memory/2804-664-0x00007FFCEBB80000-0x00007FFCEBBAE000-memory.dmp

Filesize
184KB

Download
memory/2804-665-0x00007FFCDA1A0000-0x00007FFCDA1BF000-memory.dmp

Filesize
124KB

Download
memory/2804-666-0x00007FFCEAF30000-0x00007FFCEAF3B000-memory.dmp

Filesize
44KB

Download
memory/2804-667-0x00007FFCD81E0000-0x00007FFCD81F4000-memory.dmp

Filesize
80KB

Download
memory/2804-668-0x00007FFCD81A0000-0x00007FFCD81B3000-memory.dmp

Filesize
76KB

Download
memory/2804-669-0x00007FFCD8140000-0x00007FFCD817F000-memory.dmp

Filesize
252KB

Download
memory/2804-670-0x00007FFCD80E0000-0x00007FFCD8109000-memory.dmp

Filesize
164KB

Download
memory/2804-671-0x00007FFCD7E30000-0x00007FFCD8082000-memory.dmp

Filesize
2.3MB

Download
memory/2804-674-0x00007FFCD8580000-0x00007FFCD89EE000-memory.dmp

Filesize
4.4MB

Download
memory/2804-675-0x00007FFCEBBD0000-0x00007FFCEBBF4000-memory.dmp

Filesize
144KB

Download
memory/2804-676-0x00007FFCF1610000-0x00007FFCF161F000-memory.dmp

Filesize
60KB

Download
memory/2804-677-0x00007FFCEBBB0000-0x00007FFCEBBC9000-memory.dmp

Filesize
100KB

Download
memory/2804-678-0x00007FFCEC6F0000-0x00007FFCEC6FD000-memory.dmp

Filesize
52KB

Download
memory/2804-679-0x00007FFCEBB80000-0x00007FFCEBBAE000-memory.dmp

Filesize
184KB

Download
memory/2804-682-0x00007FFCDA360000-0x00007FFCDA41C000-memory.dmp

Filesize
752KB

Download
memory/2804-681-0x00007FFCEBB30000-0x00007FFCEBB5D000-memory.dmp

Filesize
180KB

Download
memory/2804-622-0x00007FFCDA2D0000-0x00007FFCDA312000-memory.dmp

Filesize
264KB

Download
memory/2804-684-0x00007FFCDA320000-0x00007FFCDA354000-memory.dmp

Filesize
208KB

Download
memory/2804-680-0x00007FFCEBB60000-0x00007FFCEBB79000-memory.dmp

Filesize
100KB

Download
memory/2804-685-0x00007FFCEB860000-0x00007FFCEB86D000-memory.dmp

Filesize
52KB

Download
memory/2804-686-0x00007FFCDA2D0000-0x00007FFCDA312000-memory.dmp

Filesize
264KB

Download
memory/2804-687-0x00007FFCEB830000-0x00007FFCEB83A000-memory.dmp

Filesize
40KB

Download
memory/2804-688-0x00007FFCDC4A0000-0x00007FFCDC4BC000-memory.dmp

Filesize
112KB

Download
memory/2804-689-0x00007FFCDA2A0000-0x00007FFCDA2CE000-memory.dmp

Filesize
184KB

Download
memory/2804-690-0x00007FFCD8200000-0x00007FFCD8575000-memory.dmp

Filesize
3.5MB

Download
memory/2804-691-0x00007FFCDA1E0000-0x00007FFCDA298000-memory.dmp

Filesize
736KB

Download
memory/2804-692-0x00007FFCDA1C0000-0x00007FFCDA1D4000-memory.dmp

Filesize
80KB

Download
memory/2804-693-0x00007FFCEAFD0000-0x00007FFCEAFDB000-memory.dmp

Filesize
44KB

Download
memory/2804-695-0x00007FFCD9E90000-0x00007FFCD9FA8000-memory.dmp

Filesize
1.1MB

Download
memory/2804-694-0x00007FFCD9FB0000-0x00007FFCD9FD5000-memory.dmp

Filesize
148KB

Download
memory/2804-696-0x00007FFCDA1A0000-0x00007FFCDA1BF000-memory.dmp

Filesize
124KB

Download
memory/2804-697-0x00007FFCD9D10000-0x00007FFCD9E81000-memory.dmp

Filesize
1.4MB

Download
memory/2804-698-0x00007FFCEAF30000-0x00007FFCEAF3B000-memory.dmp

Filesize
44KB

Download
memory/2804-699-0x00007FFCE8C70000-0x00007FFCE8C7B000-memory.dmp

Filesize
44KB

Download
memory/2804-700-0x00007FFCE8020000-0x00007FFCE802C000-memory.dmp

Filesize
48KB

Download
memory/2804-701-0x00007FFCE6EC0000-0x00007FFCE6ECB000-memory.dmp

Filesize
44KB

Download
memory/2804-702-0x00007FFCE4910000-0x00007FFCE491C000-memory.dmp

Filesize
48KB

Download
memory/2804-703-0x00007FFCE28D0000-0x00007FFCE28DB000-memory.dmp

Filesize
44KB

Download
memory/2804-704-0x00007FFCE2880000-0x00007FFCE288C000-memory.dmp

Filesize
48KB

Download
memory/2804-705-0x00007FFCE21B0000-0x00007FFCE21BD000-memory.dmp

Filesize
52KB

Download
memory/2804-706-0x00007FFCDCDB0000-0x00007FFCDCDBE000-memory.dmp

Filesize
56KB

Download
memory/2804-707-0x00007FFCDCD70000-0x00007FFCDCD7C000-memory.dmp

Filesize
48KB

Download
memory/2804-708-0x00007FFCDCD10000-0x00007FFCDCD1C000-memory.dmp

Filesize
48KB

Download
memory/2804-709-0x00007FFCD9D00000-0x00007FFCD9D0B000-memory.dmp

Filesize
44KB

Download
memory/2804-710-0x00007FFCD9CF0000-0x00007FFCD9CFB000-memory.dmp

Filesize
44KB

Download
memory/2804-711-0x00007FFCD9CE0000-0x00007FFCD9CEC000-memory.dmp

Filesize
48KB

Download
memory/2804-712-0x00007FFCD9CD0000-0x00007FFCD9CDC000-memory.dmp

Filesize
48KB

Download
memory/2804-713-0x00007FFCD9CC0000-0x00007FFCD9CCD000-memory.dmp

Filesize
52KB

Download
memory/2804-714-0x00007FFCD9390000-0x00007FFCD93A2000-memory.dmp

Filesize
72KB

Download
memory/2804-715-0x00007FFCD9CB0000-0x00007FFCD9CBC000-memory.dmp

Filesize
48KB

Download
memory/2804-716-0x00007FFCD9370000-0x00007FFCD9385000-memory.dmp

Filesize
84KB

Download
memory/2804-717-0x00007FFCD9360000-0x00007FFCD9370000-memory.dmp

Filesize
64KB

Download
memory/2804-718-0x00007FFCD81E0000-0x00007FFCD81F4000-memory.dmp

Filesize
80KB

Download
memory/2804-719-0x00007FFCD81C0000-0x00007FFCD81DC000-memory.dmp

Filesize
112KB

Download
memory/2804-720-0x00007FFCD81A0000-0x00007FFCD81B3000-memory.dmp

Filesize
76KB

Download
memory/2804-721-0x00007FFCD8180000-0x00007FFCD8195000-memory.dmp

Filesize
84KB

Download
memory/2804-722-0x00007FFCD8140000-0x00007FFCD817F000-memory.dmp

Filesize
252KB

Download
memory/2804-723-0x00007FFCD8130000-0x00007FFCD813E000-memory.dmp

Filesize
56KB

Download
memory/2804-724-0x00007FFCD8110000-0x00007FFCD8126000-memory.dmp

Filesize
88KB

Download
memory/2804-726-0x00007FFCD7E30000-0x00007FFCD8082000-memory.dmp

Filesize
2.3MB

Download
memory/2804-725-0x00007FFCD80E0000-0x00007FFCD8109000-memory.dmp

Filesize
164KB

Download
memory/2804-610-0x00007FFCDCDC0000-0x00007FFCDCDEB000-memory.dmp

Filesize
172KB

Download
memory/2804-615-0x00007FFCDA360000-0x00007FFCDA41C000-memory.dmp

Filesize
752KB

Download
memory/2804-618-0x00007FFCDA320000-0x00007FFCDA354000-memory.dmp

Filesize
208KB

Download
memory/2804-619-0x00007FFCEB860000-0x00007FFCEB86D000-memory.dmp

Filesize
52KB

Download
memory/2804-614-0x00007FFCEBB60000-0x00007FFCEBB79000-memory.dmp

Filesize
100KB

Download
memory/2804-612-0x00007FFCEC6F0000-0x00007FFCEC6FD000-memory.dmp

Filesize
52KB

Download
memory/2804-603-0x00007FFCEBB30000-0x00007FFCEBB5D000-memory.dmp

Filesize
180KB

Download
memory/2804-592-0x00007FFCEBBB0000-0x00007FFCEBBC9000-memory.dmp

Filesize
100KB

Download
memory/2804-587-0x00007FFCEBBD0000-0x00007FFCEBBF4000-memory.dmp

Filesize
144KB

Download
memory/2804-578-0x00007FFCD8580000-0x00007FFCD89EE000-memory.dmp

Filesize
4.4MB

Download