growtopia | hxxps://www[.]mediafire[.]com/file/e4724wqly5msy28/BlitzWare_Fortnite_Menu[.]zip/file

Analysis

max time kernel
517s
max time network
569s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/e4724wqly5msy28/BlitzWare_Fortnite_Menu.zip/file

Score

10^/10

growtopia zgrat discovery evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 29 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2532-491-0x0000000004A10000-0x0000000004A7C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-492-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-493-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-496-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-530-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-535-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-543-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-547-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-551-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-563-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-573-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-582-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-584-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-586-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-588-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-590-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-592-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-594-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-596-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-598-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-600-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-602-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-604-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-608-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-610-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-606-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-549-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-522-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-514-0x0000000004A10000-0x0000000004A75000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WinErrorMgr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	WinErrorMgr.exe

Executes dropped EXE 18 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeKeyGeneratorI.exeSahyui1337.exeWinErrorMgr.exeKeyGeneratorI.exebauwrdgwodhv.exebutterflyondesktop.exebutterflyondesktop.exebutterflyondesktop.tmpbutterflyondesktop.tmpButterflyOnDesktop.exeButterflyOnDesktop.exeAgentTesla.exeAgentTesla.exeCoronaVirus.exeCoronaVirus.exe

pid	process
2532	Ilkdt.exe
1456	WinHostMgr.exe
1116	WinErrorMgr.exe
6016	KeyGeneratorI.exe
2704	Sahyui1337.exe
1016	WinErrorMgr.exe
5100	KeyGeneratorI.exe
3028	bauwrdgwodhv.exe
2020	butterflyondesktop.exe
5704	butterflyondesktop.exe
5188	butterflyondesktop.tmp
3476	butterflyondesktop.tmp
2328	ButterflyOnDesktop.exe
5804	ButterflyOnDesktop.exe
3976	AgentTesla.exe
4272	AgentTesla.exe
5980	CoronaVirus.exe
3736	CoronaVirus.exe

Loads dropped DLL 4 IoCs

Processes:

KeyGeneratorI.exe

pid process

5100 KeyGeneratorI.exe
5100 KeyGeneratorI.exe
5100 KeyGeneratorI.exe
5100 KeyGeneratorI.exe

pid	process
5100	KeyGeneratorI.exe
5100	KeyGeneratorI.exe
5100	KeyGeneratorI.exe
5100	KeyGeneratorI.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

butterflyondesktop.tmpButterflyOnDesktop.exebutterflyondesktop.tmp

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	butterflyondesktop.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop = "C:\\Program Files (x86)\\Butterfly on Desktop\\ButterflyOnDesktop.exe"	ButterflyOnDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	butterflyondesktop.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

419 pastebin.com
420 pastebin.com
618 raw.githubusercontent.com
619 raw.githubusercontent.com
383 discord.com
384 discord.com

flow	ioc
419	pastebin.com
420	pastebin.com
618	raw.githubusercontent.com
619	raw.githubusercontent.com
383	discord.com
384	discord.com

Drops file in System32 directory 4 IoCs

Processes:

WinHostMgr.exepowershell.exebauwrdgwodhv.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	process	target process
PID 3028 set thread context of 5728	3028	bauwrdgwodhv.exe	conhost.exe
PID 3028 set thread context of 5304	3028	bauwrdgwodhv.exe	explorer.exe

Drops file in Program Files directory 21 IoCs

Processes:

butterflyondesktop.tmpbutterflyondesktop.tmpAgentTesla.exe

description	ioc	process
File created	C:\Program Files (x86)\Butterfly on Desktop\is-870V8.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-CCKIP.tmp	butterflyondesktop.tmp
File opened for modification	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	butterflyondesktop.tmp
File opened for modification	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.xml	AgentTesla.exe
File created	C:\Program Files (x86)\Butterfly on Desktop\is-MENKR.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Briano\UWPHook\SharpSteam.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.xml	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\Microsoft.Management.Infrastructure.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe.config	AgentTesla.exe
File created	C:\Program Files (x86)\Butterfly on Desktop\is-2UDLL.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-BA4JV.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-6SBNC.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-D2I98.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-BP5SV.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignColors.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\VDFParser.dll	AgentTesla.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
1388	sc.exe
3256	sc.exe
4440	sc.exe
2688	sc.exe
2864	sc.exe
3872	sc.exe
3420	sc.exe
3948	sc.exe
3600	sc.exe
2756	sc.exe
2712	sc.exe
2396	sc.exe
5372	sc.exe
4808	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
\??\c:\users\admin\appdata\roaming\keygeneratori.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2368 2532 WerFault.exe Ilkdt.exe

pid	pid_target	process	target process
2368	2532	WerFault.exe	Ilkdt.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5004 schtasks.exe

pid	process
5004	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983155329-280873152-1838004294-1000\{59891412-346D-4721-B9BF-E45E07045843}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983155329-280873152-1838004294-1000\{2FCFAB56-DC54-4DC0-9BE5-7220E68DC80F}	msedge.exe

NTFS ADS 3 IoCs

Processes:

msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 40834.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 392818.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 950230.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exetaskmgr.exeSahyui1337.exepowershell.exe

pid	process
404	msedge.exe
404	msedge.exe
3480	msedge.exe
3480	msedge.exe
2392	identity_helper.exe
2392	identity_helper.exe
3592	msedge.exe
3592	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
2704	Sahyui1337.exe
2704	Sahyui1337.exe
2704	Sahyui1337.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
5372	powershell.exe
5372	powershell.exe
212	taskmgr.exe
212	taskmgr.exe
5372	powershell.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

212 taskmgr.exe

pid	process
212	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

msedge.exemsedge.exe

pid	process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

taskmgr.exeSahyui1337.exeIlkdt.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	212	taskmgr.exe
Token: SeSystemProfilePrivilege	212	taskmgr.exe
Token: SeCreateGlobalPrivilege	212	taskmgr.exe
Token: SeDebugPrivilege	2704	Sahyui1337.exe
Token: SeDebugPrivilege	2532	Ilkdt.exe
Token: SeDebugPrivilege	5372	powershell.exe
Token: SeDebugPrivilege	5436	powershell.exe
Token: SeShutdownPrivilege	6108	powercfg.exe
Token: SeCreatePagefilePrivilege	6108	powercfg.exe
Token: SeShutdownPrivilege	5028	powercfg.exe
Token: SeCreatePagefilePrivilege	5028	powercfg.exe
Token: SeShutdownPrivilege	4016	powercfg.exe
Token: SeCreatePagefilePrivilege	4016	powercfg.exe
Token: SeShutdownPrivilege	4664	powercfg.exe
Token: SeCreatePagefilePrivilege	4664	powercfg.exe
Token: SeDebugPrivilege	5460	powershell.exe
Token: SeShutdownPrivilege	5764	powercfg.exe
Token: SeCreatePagefilePrivilege	5764	powercfg.exe
Token: SeShutdownPrivilege	5364	powercfg.exe
Token: SeCreatePagefilePrivilege	5364	powercfg.exe
Token: SeShutdownPrivilege	5804	powercfg.exe
Token: SeCreatePagefilePrivilege	5804	powercfg.exe
Token: SeShutdownPrivilege	4644	powercfg.exe
Token: SeCreatePagefilePrivilege	4644	powercfg.exe
Token: SeLockMemoryPrivilege	5304	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe
212	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

BlitzWare.exeKeyGeneratorI.exeKeyGeneratorI.exe

pid process

3364 BlitzWare.exe
6016 KeyGeneratorI.exe
5100 KeyGeneratorI.exe

pid	process
3364	BlitzWare.exe
6016	KeyGeneratorI.exe
5100	KeyGeneratorI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3480 wrote to memory of 3860	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 3860	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4112	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 404	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 404	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4624	3480	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/e4724wqly5msy28/BlitzWare_Fortnite_Menu.zip/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb34346f8,0x7ffdb3434708,0x7ffdb3434718
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7444 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8332 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8468 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8444 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8288 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7956 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7776 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8532 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7368 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=8764 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8784 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4179062589567024653,18206421605680818536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8264 /prefetch:1
  2⤵
  PID:5808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4424

C:\Users\Admin\Downloads\BlitzWare_Fortnite_Menu\BlitzWare_Fortnite_Menu\BlitzWare.exe
"C:\Users\Admin\Downloads\BlitzWare_Fortnite_Menu\BlitzWare_Fortnite_Menu\BlitzWare.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAbABpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAdwB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAaQBjACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcgBkACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5372
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 844
    3⤵
    - Program crash
    PID:2368
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1456
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2276
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:384
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3948
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3256
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5372
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:4808
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:3600
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4664
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6108
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4016
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:4440
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2688
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2864
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2712
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1116
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:1016
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDE21.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:5004
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6016
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      PID:5836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdb34346f8,0x7ffdb3434708,0x7ffdb3434718
        5⤵
        
        PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      PID:384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdb34346f8,0x7ffdb3434708,0x7ffdb3434718
        5⤵
        
        PID:1476
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:212

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:3028
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5508
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5240
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2396
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1388
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2756
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3872
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3420
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4644
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5804
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5364
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5764
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5728
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdb34346f8,0x7ffdb3434708,0x7ffdb3434718
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1896 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 /prefetch:2
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:3860
- C:\Users\Admin\Downloads\butterflyondesktop.exe
  "C:\Users\Admin\Downloads\butterflyondesktop.exe"
  2⤵
  - Executes dropped EXE
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\is-8JO8D.tmp\butterflyondesktop.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-8JO8D.tmp\butterflyondesktop.tmp" /SL5="$30330,2719719,54272,C:\Users\Admin\Downloads\butterflyondesktop.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    PID:5188
  - - C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
      "C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"
      4⤵
      Executes dropped EXE
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html
      4⤵
      PID:2788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdb34346f8,0x7ffdb3434708,0x7ffdb3434718
        5⤵
        
        PID:4376
- C:\Users\Admin\Downloads\butterflyondesktop.exe
  "C:\Users\Admin\Downloads\butterflyondesktop.exe"
  2⤵
  - Executes dropped EXE
  PID:5704
- - C:\Users\Admin\AppData\Local\Temp\is-ITJB0.tmp\butterflyondesktop.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-ITJB0.tmp\butterflyondesktop.tmp" /SL5="$80062,2719719,54272,C:\Users\Admin\Downloads\butterflyondesktop.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    PID:3476
  - - C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
      "C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html
      4⤵
      PID:4368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdb34346f8,0x7ffdb3434708,0x7ffdb3434718
        5⤵
        
        PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 /prefetch:8
  2⤵
  PID:5788
- C:\Users\Admin\Downloads\AgentTesla.exe
  "C:\Users\Admin\Downloads\AgentTesla.exe"
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Users\Admin\Downloads\AgentTesla.exe
  "C:\Users\Admin\Downloads\AgentTesla.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,15425905352540590369,4772350789468212683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:2404
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Executes dropped EXE
  PID:5980
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Executes dropped EXE
  PID:3736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

Filesize
3.0MB

MD5
81aab57e0ef37ddff02d0106ced6b91e

SHA1
6e3895b350ef1545902bd23e7162dfce4c64e029

SHA256
a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287

SHA512
a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

Download Submit
C:\Program Files (x86)\Butterfly on Desktop\is-MENKR.tmp

Filesize
698KB

MD5
1fee4db19d9f5af7834ec556311e69dd

SHA1
ff779b9a3515b5a85ab27198939c58c0ad08da70

SHA256
3d550c908d5a8de143c5cd5f4fe431528cd5fa20b77f4605a9b8ca063e83fc36

SHA512
306652c0c4739fce284e9740397e4c8924cd31b6e294c18dd42536d6e00ad8d4c93d9642fe2408f54273d046f04f154f25948936930dd9c81255f3726f31ee65

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
2.3MB

MD5
ad00f798b883ead3c6f59c13a3ee4399

SHA1
18d3204a0375b764889d6b1adf843e0288ba736f

SHA256
c89d42caf24905f904b5acb1244711295398180563f68fd09dadf56cff7a9e85

SHA512
5cf1bea21789fdf584f4ecb5417bea528118a10d10d4b8df67d7d63941318d06868198806ce6460d1446dd8d1b107a8e709022d163370a9b33c5aa1aa2dc4c1d

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
2.6MB

MD5
5a7a3c43bea04a929f306ded49acc618

SHA1
66af91947bae38f2b0615302355b0c44e8d68ee5

SHA256
4517ed0d82e1d47cfcdcdd5f42dbd91cfcfda563280871c109b3d536d2701278

SHA512
8a1808ab1d3a57a2f1e2ec035f5a7ef6600053af032a623b5ba49727935cda865e8d5f08ac53ef491b8d68f82ff3b7d99e2487c693190202382345492a7ce4e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WinErrorMgr.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
296ca2fc16f1322c385592699f153ac7

SHA1
523b919cc32bf4e081cf2a6e9dda64d22b4a8efe

SHA256
2041e8d6c1da8aec31875b5349f8a310e0b95aa5d9cc2479a2b680e528ab7f8c

SHA512
b3bcc4fcb8108ff265c4e25ba3743e76cf729f027f016c04c5f9603a0bbd792887bcc0c4aedef4e634a1544822796edfc94df69d0afe774437774aa1e215bf7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007c

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007d

Filesize
31KB

MD5
f112cd6e39b953adde3e5b348e10b0ea

SHA1
f25a08985722ebecc8cd4f0d0f1a7169cf3ff218

SHA256
3788bcff7edeeb5afa650a82ff0e59f85fc4bdf71625755a14924dbcd465d381

SHA512
823113fd3d5400817c797a4968997f1b4f951516e8481df21bf27cd07502809fbbf050748200f2de509415ebab0d0865da2c32b74f3c1faddbc109cf3fb97b00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007e

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007f

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000080

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000081

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000082

Filesize
1.1MB

MD5
b338779fe22cb7610235427cd289efdb

SHA1
8fc55269772080a862668ea15f343d9eb6a84631

SHA256
48ed615463c65add9a91fcd1f2ef8d99eeccee1b57614ef402854fa80fc3db8f

SHA512
35b381643a05d51eb3d2319772daae8ba4f21f022f16d8b97549f2e22879e1eb4fcbabab56c8454812077497498a301e6187520bdb5ebda93ccb09936b546d57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a6

Filesize
2.8MB

MD5
1535aa21451192109b86be9bcc7c4345

SHA1
1af211c686c4d4bf0239ed6620358a19691cf88c

SHA256
4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6

SHA512
1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
6KB

MD5
a75dae28e58a2085d60c6c7e39a37974

SHA1
701069e0ee7c7ab232ba2ff798f72f77221d37d3

SHA256
1eee89bb6fec775af3e1713130d57d1c0809a9183a28f810b4383fa91e0c66ec

SHA512
d295a6cb825bf04b121c5d8fdfa23b629ceb1e99a9ad03514a8f81bb010d4260b3b793218e5c39d9ce70a0012a8815a27d2c492d2a842af4de36586f6e7c38d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e2ca2ea68f46b372956c9e05803df1be

SHA1
71a4dacee6527a89452579f1c8a7dbc6b8f133dc

SHA256
a97c73e04dcab5e124659c8d775dec830ae4c8829ce595092858404e07392b79

SHA512
7a00a1c06f7075675277a253d253acd23b3f60e729a0156162401304f5e4ba3ae585047db7d1d5243fe3cdb709a1237e7331eaf05c0b0444ce14174cf3429543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
f6750e68ec3cfb3c2ea01c5845e42042

SHA1
19c7dccb3ed394cfbf93bfe440601892fcf82357

SHA256
fdaf49b3505e558be60a0a2c01f1e180e3995068df0829f5898c9a36d0d7e883

SHA512
e4b68838297eb532131c6a3d394ba781821c7ad3284f9dadf82b36395654776993f30cae89f816649cb447a5955ac805bad298959c0ee4bc1c86f8c2ea8df670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
db01fe9530b9a4b3da47eaec63f27d73

SHA1
efbd2391f4535ea3f089ffa36724ccbe56cd9e6f

SHA256
f91973978713d608ad381a7a4b15ef0fd86b6c2ea0124b58fb596358ecc0782e

SHA512
83f28908dc77925e19ec027ab2f2d2c267aaffe8a05ccca4d00836a02ede27a320160c6a6bcc83112cf8da63a2d335290b47905b0a64b0792bc30c1e2d8d0153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
3b4b7f0db3130440fa9ca66fd500dba2

SHA1
b22b90c2ab46edc6417d3be8312fe2610a6a0763

SHA256
1793fac4f84013689bd8be78dd2f4a627b9abab8285c15337c7be3008b820ad7

SHA512
b16f20f656ead05f6b93c5fe9eb36cde148b17953f0f510e3806cbf33af1c3ef9e92982e57cf2a0697169c5d33dcc999402f6864f97dea32b68abb96c2e094e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
32dab78738f51c70b10521368c812c3c

SHA1
2e6457f548f03dc69502d947a8fd2c95227fb1af

SHA256
ac358323543a51770b114f04ee3a0075e30e99c401921a78747ca06fc5068824

SHA512
d6b11fdbb9d538147b610338e6922df7fb774239ab0b4233d0aa3e0c0c17a5e217b31af123ad77ae0a5731fc329c614893c468d693658c4c72833f2f5cf9d2ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
5af55fe6a430149d76b854cdf2be4bc9

SHA1
67273d9df857eed2fda6bc08cb4978a041304f24

SHA256
dfcae5ab8efa4a289e4a47c2adc797da2d2cf2501edeee86290979b83a0091b5

SHA512
5f6fdcfaabceb5930abc6a248d63870668e1323dc7c9cf9d849acab7728ef74cb46f9d1aafe5bde3f5695504c8f08fe9447abca663cb91aaac158b073da588ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c116c.TMP

Filesize
6KB

MD5
7bc45ac539870bb185b8eb616f7c69f7

SHA1
36dedc50c7970cd49eec81db1cbb02c6aca02612

SHA256
f3c0ac6f0e4eaf1678ef3d8c7e79811850d5358cbe8b4195fdfd0d7bbab0a96a

SHA512
d9f46b33f29504813606ecdb0c9d46a6bf579f854e9bf432fb93b361cc288aa9823baa33ff88d1d88eec9a86c6ca88633566c9f9cf94b6f3df547ec75d3ec4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
f77cf3b254dc1ec920e0ed16fb56d943

SHA1
a1709457a0738a77ffdff6475d6b9c1cd0e10ae6

SHA256
0a6d5b3d4cea154f8defd82be46571dc0d6c5b5c1b672f0b8bce754504efd83b

SHA512
b04d2e1bd4b19ea31fe6d9c0d0384f49adb937b9a7f319b4463d4d96ac228f2ba1cd1588ef43f1a5d34a49cb8a3d6049d9d15c77a6a76901c2b5ccec851ca365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
77f0552da1a98fd2e54ee1c09f96f481

SHA1
f28caa4f31d62d7ebc83dbc43a9d32d5b5b33466

SHA256
89f664bb2f1bd00d60b9f92a4e5fd8a43156b4249ae13c791210b0558e1a0fd6

SHA512
9cef32180171f319a495fb8e5ee73a212fcc0f0711abc44b89113603ef82e6b3a4dca3d57de454c260585ecfc5b833b23ac3c26cc460e73e4717d1f408c33d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
79ed842468ffbd3364c6f79cf25409e4

SHA1
27853c71ef5e70b72536693258fd88496b0a2621

SHA256
30cd5cf97163cc3201241a8f27550f5817f55e45184ebc9a5becafee8e0e2041

SHA512
06003f2883caa10e9dd17a4227b1e3c975eca23471b9901690f6d6775a9652f0079cdfb5fca49ccdb6c5271fc7b41186aee42ffdd9dbfedd0898ea0666510c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
16e24900dcc66db2ce6b2e347f3462de

SHA1
22dc6b9381b512412eb265549efb927446c4727d

SHA256
95fe2a334c5b17b1d775652be94ced8e0bdf486e297faeec10e31392c2d5d688

SHA512
09181b88e344650cf234899cdd087627abc756777a9be0d48948bd96ed2fafda6b680239e3f7dc81e7caa976fce9329e71c72d7faa29088f5f1975b996b3c9a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
f58171bfa4adc9485d955358bb60c249

SHA1
dc9e38eee787777fa4e3e0abb291c6eb89b3d2d9

SHA256
64441dd29a1f7322dd4429884c87905083c3163d02ddd31505c5e4b6428f25a0

SHA512
bc76fa1ee0d4bc4543e738ebd8d74a458c6b98909f62f120ed72fbe406d41a6f68e2ffad33d9d94d54aa4e51452674f524be0c58cd728759886367c163b23566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
616b8c01a909cc2488d0189ae92fbe66

SHA1
f44e8a357133f27a74c79e613c3f9a97eb2daf72

SHA256
6f0f2e9a0bbc6f222f0eb4fe1f4fa4ef69d0d71301d20f7462c1bab493d05551

SHA512
be32876d1b4bec5bea4368cae9086e4cf466ca962c42a9e9524d010301280f4bdbcd8ad125b6f8485d5dc92235cdacebb38657151510d488c4c81e6bf60988ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
fb8c1e2925c8334b859aa7260d613932

SHA1
5f4acd6cb2991e87556cf5f8d8106f02670e09d6

SHA256
4aa48cd9329f7d2c4e5eff6403bb709343c5725123a3cf6bf494c1dd9690f6fe

SHA512
76d1a2d0158b2abda7fcecdb623096e7d1b78dc0d19a8ee1e126e9674e6d480ec1cd46710f7a19904772c6ae5f4ad6225921172819045e594720e98282b0baea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
b735b851b08ce23a86c84ac4926bff06

SHA1
1a9cc762baf01de84e800c2a5042df615a647c63

SHA256
a6569af8511d82609b24be4129f8e4f64743015e21261491c7c94e5c5caf42b2

SHA512
83dfae7f145cdf983eb7cb606cf3e99a06b134d566587232fc97d54bc58b5790475d6cd1f0b130b5b84e8bbb58c59fda690cacc30c4088643cefc09110d46d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
671c5531e10bd5b362296314659d673d

SHA1
c907d565209d8cd34c83a86090685f2811b00d0d

SHA256
046e7bf32e9d671189f40e608842dc5627f3baef9e76a09de624220d513aeef1

SHA512
04d640ba0ce442d17f34c16f9ccf30da6e1e84c477d275ff363b3790cc31feb339fc0872273113b71cb85e152cac0a9d5a9029d87814f85e99a79fb503097033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
cceb85ebecd1db7144ec6df1325ef011

SHA1
58396a30c5e5e1561807c0d2205b7cc247f310d3

SHA256
0924c69cd88b381f1985115ce02065262a526c570ce75cf8304d56d3bf565b10

SHA512
a8c9ffc333004a6acfa4307a9ee93b359387be5ba12f4390ab07b2d03877b9bb279e3a58eec9b3fa67165f0ce4648d38851d20f129f2fba6f9b734f401716406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
8d382376bc8f38b5c75ad8b9f7aec8f3

SHA1
1fc06f29dc897cfacac17354c1a87a9e51b346cf

SHA256
016c2a7507847acbad9e5f0d6499a942e121b086d820f0e92cc694abc0872477

SHA512
0cafeb000f0d0b3d87dbbaee228a9c73e6b702a231e3387d11d367bff161992f6176b4d3eaa79c59d54e6c922f6c71ae0208752b2590cfb29ad43af1ddfd7f99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
be1dff538dad5b5a21b0c3ddd0d5575f

SHA1
399307038d463730d7e73a824341a2063d17a52d

SHA256
9f3c483fb468533fad0ce0109db3accc4c6b5ccc8948b1f23968adf00a3fa549

SHA512
e3bdf577000c15770ceb079f5708fbf8d0711cd4ebfc3309a75536142bee53e2b8745cd81421ebeb68461680bba66b8d74ade8796b4e85dea5f914e282d13230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
c6d1b9d600f6fc1b41b13b6ada692b7f

SHA1
23602b7109cf93117b1f9797fddf4b7580cb6c30

SHA256
4fbc51ed79d0f24d8ef8732b6a3c7c2e9320e675f832a4a276588aa610b477de

SHA512
83871e397165870e255fce7721886e152aee48f9ccd7fee4e70651c8c54f40909e92715e653e01fb25bc49e2473927a5084f977f157044dd9211be666b62b599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
8b56966b3ea11c272d0f34de1e67e819

SHA1
647e18afdd87c3906683c0b0b6f311186be0ae68

SHA256
c79145605d55d66d2521c4bd711871bbbe98d9656bf85e6e7121be636a600019

SHA512
7f5266fb7a1ed0771157729b89372668122d57252d8cc185551a0433589529f4ecf5de6a7c2bd50066dd27248a07c08ac25cb08f3642f5230fa6312d49af8a75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
ce4494701ae59e33d403d46672163ecd

SHA1
7930c7b766d14bd46b646960ddcca69bad8854a8

SHA256
2cf448a6b63f277aea2124f9d312ff4da479a87ac5174753b01c24dc0127c9ef

SHA512
1e82c797957a3714eb2dff77afe5d464e0be9b62a13249dd203cdaff26a065adbb615c2d8a9c04ec8a1f0632bc7d60f16a255554a3bef771acae6b9600b264b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
dd314147f168ac20f5113ce3e93a5829

SHA1
b0597c841bb4f41cbc9d98798196e2fe226714d9

SHA256
c81a124e662db2bf5900acdee9473f15b072489ce4d451ae4e2b5b5fcc0dc3c2

SHA512
e75b43aa9ed550bf98139fbbff1471732578ecf0b32b208e2d37e7512c5786dce3521ba475e54dc4e5e44c8d8862eeb121d8375244517054853e95bc078bd26e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
dff8edfde49fb5ab5a3dddc80feca989

SHA1
75a9b0b0494f360c14cf512af64c79207b3ae4fb

SHA256
5a1409307f079f7715f99ea255f5ed42a8554a450dc00dcce28c75c7f96d9a3a

SHA512
fc3a60e917f6b03d6270985568180daed402b2d506651b9a329b311dffac55c3bb3847df1b9def242e322c7faa880d27f5df8da9d184fd4ec731058fdc78f9a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
de223fbdd88f29038651f993f083bf8f

SHA1
ab2dd40bef01003ae3fc3846297adf395a6b706f

SHA256
a8bdfc0ef315e02dd69dd8e98b59bc0d494063fd7aa4afb10b1339acac235e72

SHA512
6b0abef6c8412b570aaf388e24394b6a4c9e4df91e2e0a59cc5672c0a594bcd8a71bf38ca5956e3aa906d188a7bdc332cc74aa21097d648d701d84fdb3a301bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ab97e.TMP

Filesize
48B

MD5
69401de713e9030f124b6a53528c36af

SHA1
09e5f837526bab98f4ad6609bbc5eaa42c09bfaa

SHA256
4fd075fcdd603aa4393f2e0104b551ce4005da81aadbb3455e4130293defbcf6

SHA512
6358b2c2e922bff64987bd8808903696996843748bbe843e0293c71ce874225b3c33e07f08716568bad63eba03f2ba7070fabcf522f8405f9cd36229ad91a04d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
25a0c4b9a6ec098f2dbf8d2ce670d08e

SHA1
b06ec8352ef7772aa1fc027ed6327897d00fc29e

SHA256
b30ac243d9c0f2f2bf3c69c524fc41b771e2ac9da8f0d22349c47e36dad7ec4e

SHA512
29166dd3f9f3b926d0f1158d2bad41c55773b2f5f9bae701f11f54a8165c32cf02c40a64300fa59af3404a3a2d8340c746e1748495dca3dd966f269142f4a11f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
15655787eddfe26983d27b0f10e5ea34

SHA1
8465a065efa466e5376618f85c1dbdd8526b9854

SHA256
e5e9c74113bb4e15e54050c5f12badeb01ed72f4e582b1dba1290cf55668cdd7

SHA512
ddcf292491bbb8628e341c4bf04ba4796fae2427af72301684e9397c291733b823113d9d8a2735deb87086a459f076cab00e5a8fbce2308065c172180e2686d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
feff91a57c18f6fceb6ebbec477f3b2a

SHA1
d5ff97bba96890985037a3c32cf0c962673adfff

SHA256
a1852f92ed7f36f76acda2ee0da927ac16091097b3d0da5e4d6564dae4236ba6

SHA512
c44d55a2261553a12358ee93c54af76e2910e0ed2b9dcbaac736bef6ead717722d6f63df9f2dbb3ec0407c6eac01ef9598f6d7cf6d2ba45c4b7e938c3af82311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
23d2eae795e194da80b1aa71b5133fad

SHA1
a3242bc0dae4c0dbe6eddd28712d5a9a135468d7

SHA256
db9a889f7c35e95265b1a7e3641145fd33c1512e21345233ade49d645944eb9b

SHA512
3b6509d29ecb688451003a18acef4cd04a31046d2d22e1fc59609c62ea6bdff911ae9575d75628b6f4e2877cc09d773365a226200ce90e3fb50531eed2afef1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
50c3c696f1791befac6ea7fd1454a42b

SHA1
8c7a5f5b0d8a000e80523a02fe6a0f586fcc45ff

SHA256
f9f15f9a3d9aad18dad5db529f5900101f9af6fa22c28618553e3834d91ab7cf

SHA512
90b575b4926b14ae2770c1236a106948565e0cf983e91d557d94b956bd473c8f4d7d33622a9d1c067a87cd413fc179c76b93ff0e07da1dd6c0c3a8b0d0a820bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
1ed4fbd9844aaf4780dd7f4724f20860

SHA1
5058a715d634157287e2dfe87ee3de9e624e65b8

SHA256
6b66aa6a358fdcc6da3ebe63ad08b3cd729d23ccc51537f0d3d48d7b8c0c094c

SHA512
78f2d2388f4dec88d246d06742dacb40f738e7848cb36f2abe0ddcd33fb80821f8dac96d222e0d5bc497b860a7463e12070c5c2d496cb07e2e3fd4f590e64055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
e9db0de2ef9b83aa44da8cd31264dff1

SHA1
dbf99e68ae1aaa0bcb2215a59249c5b146ef3008

SHA256
876af60868a681c0b93822760e05a40b9b3498dbbedab30bf5a37e76f4016fe8

SHA512
2702610e0878ec48a3781add39187b62c21706950ec2532ce27820489df1e0806c0213cfd4c01a33c9d7c0329c553fe34e5f3adabeb25f478b5637ad94824a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
121218f136f83c6704b45cf8b182b1cc

SHA1
f023fb851bb997b1f2eb4c0d7c2aa825a78e5270

SHA256
2fc8fb1bab7ac9bb9c91860f76f6890cacc6084cca7a5beab7de4f65905df475

SHA512
4b5c205f331a9230e4aa82396c5f9cb77417e55318f7a52ef0d1d8dbf5873d1ea8738754577f86beb6fbd7552d17d683e30fded3e09e2cf86d956a56ea6b1d9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d8c25ad507332b876f5ac1167946afce

SHA1
0cb70875e702e27e5cc67391726d8ea8eee66563

SHA256
127d2f74ecb6b782946a0ed13166d4d014fe30163c7ef209b77478acaf94127d

SHA512
af084db28416b613c87232a9e298e1daec4dcf3564909c3d95b6b5fa321891a70ca619b6bdc1a5dfa29b7a479f429a56514223a7afc2c53be4475b393d4305c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
3cdebe763ac8538953c7755cc95ed1e7

SHA1
a38fd836ab745047cdbfc4fded3b85c09da7ac1a

SHA256
d9b087a1464c1804b41dc4dacba77c28d96ceb7971997bfd9f522548a47f735c

SHA512
8d7e75aaab18a00a07b8726a4f0e5913652b6dd93b3a962224471163942707a79677c2813b727f906931e7cf18a761084d700ce07710e4b1d5ccb1286906f73d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
8b901b7b24b8e7d69177e974b1451567

SHA1
f8a36863e3ed506b176eb7e069deb64a3ed4214e

SHA256
d0015677d2bc7046efbd0de6ae7362b9fcfe286bff99ee851082321790744175

SHA512
3f601f045536327df0515fbc288fd019a49f26e2b0952d595d499de00d2c6b12d262990b193332b9238fe9a02234c4c36aaa8815fd99a3e7b1e8d133a5f000ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
fe1472aff17cb12d02f335445e6360b4

SHA1
d68ebf72d7f89850823091bbed63e14704b0a0a4

SHA256
1c05e99fb98621d7d12b961efed57cbaa0428ac4e60affb5b07f61a915dff679

SHA512
0d6d00311ed0faa2aaf5f23a9a41b22c03c5224101f0d9ab2ded2c5d6f4bbb201de6ef053c645b92498b1e977ca05bd03e14855428cabcf575ea770320edf5e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
23a2e4ac3eb45c98c027d0a557ae3006

SHA1
921a1145de9f6056112ae70137f43c5da9146669

SHA256
a1238cfff46a9b2ba743aa5843ea9c3ecfc37bcd0be5a9fd941c3dcece44a6c3

SHA512
0009bef0099cedc6fc4307aaf8b33a80a470a013a220f49113d605b57655d6bc6c0a37bfba6b1af0bc7ca2abfcd0397962a2a37392300daf62e935777aeb0cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
aa8f64954747fc99e32d55326edb44f2

SHA1
7a01864c6d9eb8e4e1f0a862bb3c8b059ceacc12

SHA256
b8676d4f3df351e719e6d2dd04813e27b966f2bdee605410e84489cabe071c6c

SHA512
ad7e181e4cba4132d9c862ca6af0fe36ebe0772963878b175493cf09c1ffd0a7960e6c534cfae8dc0bc0854716a2739ee8428ba92a2aa6c77543668a3fbffa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
dcaedf46bbdfc7fec32303f630ff57f1

SHA1
fcdb02031387d192e571585f8946e17de66fb26d

SHA256
476212e7c8778049acd8ad891c70c65edeed000dc93111caf550cf46be71fbe6

SHA512
106d121eb7a48dd97704907fc2217879c1c58a5e2367f789372f3946cd5e39b4d336ef8bd090fb062f6354ac2974276ee999b26c1244b1e963b587eb375b157f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
72f8492b3d2c349892ca1431aff5ceb3

SHA1
aa9b7f06423a84e554b2c6490d1afbce707a7ed7

SHA256
5c235ba315b5851c77c43dcd60db1be3b87b7d015e3b3ff068f14bb9c5619530

SHA512
b56aa7d23b9dd78620c4ace4fee5651ca9c1cdd08d3d373f2f0bbbf336b531ca6441ca0404684def836608719f0bb0ba9945c3975efe562227a570e77d7d3f31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
f3f5e5335054b09102ff90e4fcbc99ed

SHA1
85dfa211355e5514451c9a17283e914074d9dba2

SHA256
59118f0ee727d940a7f20000399157055c58bf727482f1c2342551156c7180b1

SHA512
918cfe0ad9ad3511264c3c982ce58805a8f18db4cf5b2b1ba102b3d86f339657af34374446e3c1cdc8e912d0a178d48ef4450977114172cf70fd796fc75b9ab8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
acca767ca8c3abff00c33650a4a25819

SHA1
f501d74dc0484b4e31c78b9ccdbab950c313d5f4

SHA256
3c0deaee73375eb17b21c1adcc84f7607b83bfd7d56dcc8788dfdc849e1c44a3

SHA512
3bf643ade054716ce3be363f41ed3bd0025137ba73faf8c6cad52023925e07130cfd6e92373440a04fff0d892c71547700761078bb5dcf61c4124b15e7de34b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f349.TMP

Filesize
873B

MD5
5516e4b54a18303a8fb6a4f8c9cff03d

SHA1
6f0c940a22b415e222e8065eed55f9f0c830510c

SHA256
a04ef975d9d9783efdffd7632c88f33239c9a1e0c7dfb580f63f3808eab5082e

SHA512
2e0e481f213ec8418b72cc42ba6cb5e1a5386cfb4e57f7ce2b53695bab720671b000dc458416107ca0993c04f8a51694f8263b20119f405aa67d3b9cd123b388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a5ce0ffca12d84ff4a6c9db1da4bcd39

SHA1
b5ba9eab2dc6db44f0092d224635de11a38b1b95

SHA256
33fa6f70c17eac7a2bab0cf785416b61a84956c947a4d4fc30aac45a590fc41f

SHA512
0bf36a077cad7982b04816a935e042a3f0e0d20d0692633822ec30011ac86c56ebf6d74e08d26406a37367a985deb33212fc68beb8d237b95e4c34946d0dcc9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
528792f1a3f23eb09378a6b13f62261e

SHA1
00339668043af6aac38bff266fb59633faa6c28f

SHA256
d5e7572ade39956252f321c2854a9272fae673ab11e9f1aee48bc976b9cb8b25

SHA512
a152cc83202db371ef188eace0a4d2b93ae3c3639ec900a167343b039df8957955bb3346a064fb0a23d68e29a9802e18b0c7b5af473a8d013be39ca4fed969ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
467bce3facd0cfbf9c7f62d07a953743

SHA1
ec7a41b840721904f3d4440f247652599577b56d

SHA256
b96dfa92b98511612b683e41a73a9b38241156250d3d91b8bbea3234585bd1cf

SHA512
4634b7eef1fc289b3ab912b8310bbf0ba3a6edfa94e2e8603f80de1eed506ab2637ee98809ccdcaa95ae0f1e575b323526534c8920a918d31c1600c2523febb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e9ca7d068de3a23b556edc484c79b2d8

SHA1
f8332817d936f037bbccd630f1ca01028aad888b

SHA256
a2ac07665757b4ce2cb630ca3744e4d732420eb5cf4218f7b4a52e8319b2adb1

SHA512
ea4c452d9118984af3e05402de41736d19f376efd26be7567538b5577e36af8357a2f2c2e42685500d268c17ccb132f7ffc4f2a5ae732f0754add0391698ac91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
421fe976500b33272c84c1ec73120d54

SHA1
9021aa9e8608ca27f3509279bdb78ac2cffc54df

SHA256
3db661f2908f674f9d7a67be9af3cba4d5a3d03419b054b3c94074893090d762

SHA512
c6ce00c78379de4e2383fb01d355e59852de6610356dac34e654967aa95cee733a938af05a87dc454c775023abeefa6dc17d0489b5ba0cb787300dad98457324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
14a88211d29157b7c0a7b4bdfbcb7b5b

SHA1
1a61e85c71bf35b4a4b89459ada95c9da6cf564a

SHA256
1e917fcfaa4cd48ed297ec1accae53b947c2adade27231d965870fb5ae9ad52a

SHA512
a64aa82f524306d62c2a0cece24fff8295725f89528247de11903ffa99f386aa9136578029f80dbf47417ca3d8e4bc396d41252c75b5da621eb4178269504af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.8MB

MD5
2ec1a5a18ba7e67453b9d67c93992ad0

SHA1
8f8ea2c24ab3db936ba31faac74def152bf2d2fb

SHA256
2f4b6aa56c023120a4ba64f6af920487e3f0c20c7aa6fa1616efa360ac4f88ca

SHA512
5ffa75b58f38dbb015df265629d955ac7d84738ffdc23c0d993a650407648c65831160eccb040c4a9172dab9debd2573cb81e5179fcb3e25a605375054dfcd7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.2MB

MD5
6a55c259dd13a058b8b57034a8515803

SHA1
34d5628bd3deca9ca0c7a45daf638127f11433f6

SHA256
a0c5ff326c74584e6cb2b9fb9fe4f03a1d7255b17653f42444ee3185209c505d

SHA512
3cb60047b2f09e589310bfc743b583019667bdea3c5d7667f2af8f3e789c3adf5faa9128d399178cb0060562c27ed278207acd4a40a41425a1d8ec0d9a7f3d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.5MB

MD5
ec35009cb2976f27fb90082186416f61

SHA1
3517239d96f39b630f9350c2fa9efe2c782b9286

SHA256
de9525f76c511087368c17d0dd001b1c23854ffb4be26d8004abdff84292acac

SHA512
9632d09c97701b85c4d8a50db612a1cddded9e8a9477c883f587fea2bd26b42a3285365badad087cc25872e8d25323b0f3375e55c771e6685036c89398fd4e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\_decimal.pyd

Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\base_library.zip

Filesize
960KB

MD5
2a8e953c354d38ea738a1a6d63027ea1

SHA1
64075db27619ce28d14170b74a0a73e1de0d5339

SHA256
efdde8fa331f97a8e7261195f160c02a9f54b9ea23dc0d7bab663320ab3e5344

SHA512
3307cbf984701f85ffdb4f5e57150c17fc6a6c40458f615ef253bc4e41f1181fd7355ccf15ab24e1b2a280a0cdb15a2f814d69422e266e9b3b971d526b2a083d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\libcrypto-3.dll

Filesize
2.3MB

MD5
71f375829eb0e31444a3b96042c12ccc

SHA1
590afd44efe28d3d377463ca2078bae8893e201b

SHA256
9f1088abe2a7e5b88d887a02c1d81311bac46153393cd3abe5ed78865f368573

SHA512
7cee550aad0a69514c71b27becfa7f0fcfe33f3ea32ec52496980e878b4a0257044776684c60f07edf5a0495986a2fdd7d99f9aafbc13c6502456b828d3a0e32

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\python312.dll

Filesize
5.2MB

MD5
0d6799516f1785b753ae0fbad2e0aff7

SHA1
07a547a4cd3786bf5a2e9c674c2648339a01e6f8

SHA256
d8a1fc729d5f1d2522aca702d7e060720017e3a7279009ac415bebc65c5fc7a7

SHA512
2d739c26ca1995e0cf8edadab9266c80c14c44a0eef46276acc004aa326dff1b754e51e91422c3f7909735c2e92bd179b046062738bffac764652137c946c127

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\python312.dll

Filesize
5.4MB

MD5
dd27aff358d633af67d1a20624038c6a

SHA1
a830d0f2bcfd3180a657ac4db8c790c8dfb0b3b5

SHA256
6ded9b5fd0d8379f715700960a7ddfdf7ceb67019059103b9405f5bdac057156

SHA512
b81d0dc19e24f5811760109c2dffde3418941f94cb735d07c970ef39345d9d79fe3d5e7ab01792ea1af0b6d599a57050c5ab54f8837eaaae61eceffa531b05a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI60162\unicodedata.pyd

Filesize
1.1MB

MD5
fc47b9e23ddf2c128e3569a622868dbe

SHA1
2814643b70847b496cbda990f6442d8ff4f0cb09

SHA256
2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309

SHA512
7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vkrfzqy4.vyr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EMFHV.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDE21.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
1.3MB

MD5
a6a7f7673291a4669017ae8d01294bad

SHA1
211e76ab5f020186e71abf1b9e2a0c6c9d4a474c

SHA256
738d78da1d408afc40138b8e0baedabdc8f2664551a85b96a50a3d71b3de496b

SHA512
beab937fcb5784b949f2fe1915cb62e9bc1b22035a5ba70ca171fbad16af4555fa0c1809e2acb9ff54b236e641ab02038b502cdd03b753b393cb4e85d8bbcef9

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
1.2MB

MD5
c74ac452ffb5c428fd222ef8281154c4

SHA1
490c041c3a49dbb59a8928474d80a612a9d17e11

SHA256
284c1047b1edcc1eba700e9f6372ac15d655dba8e27f46fbef4e0378ef7eec7b

SHA512
bd07860fbd6a113c46a0105896f6df6ef37cc07a901aa06de2af1003c7fcd6de502a2bc78a1b4c6a93eedcfe843fe22b4a0110ba38b57ba57b0f2440b7d032fb

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
5.4MB

MD5
900a2caa409ff248b31b4b4f5a0ba1e2

SHA1
fdf2eb64970e71bb75e204f1e7f3a8d265c1be5c

SHA256
ff0b420b00372ad4c1e5648e36072ca7700bd14fddd3f02d5466f874fcd3ad73

SHA512
2e8baae9bf2c3f232e07a5e0474f64005d1d3a1185d86c2542f354853d974ed6aff33d7f3278ff1d64715b25e16102bb007ae33669ad21fc0f9a096634df5a04

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
5cc191ef1e688f74f37d2c7965e126ae

SHA1
0d866e6c2289000548ecc491b9439cff077d7d68

SHA256
e9320b4dce4fd165a870715d04862fbbd6803d0aa6bd439093385faa1405d1d0

SHA512
7401ef30e8b87b486d532e0e594006dc5413cd3e255a7e5d0f2ca9217bc39e45b5efc63959ffc34209f949c30d6f3c486ae5ec919f51ef58f7a542df5cafbd8d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 392818.crdownload

Filesize
2.8MB

MD5
cce284cab135d9c0a2a64a7caec09107

SHA1
e4b8f4b6cab18b9748f83e9fffd275ef5276199e

SHA256
18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9

SHA512
c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 950230.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
\??\c:\users\admin\appdata\roaming\keygeneratori.exe

Filesize
1.1MB

MD5
95140a33b69e3e5d80a1b43e61f0af9f

SHA1
ba68600f6c41949b42cf9e1d860822b06e77d564

SHA256
259022cbccc39cbab5bdf7f7e1d3f8b180bc0e306cc7d36dd3648c2a3d571473

SHA512
fa5eb82109f9f219369fb3dc10341f51777cb8b1cdcbe1552add28e927cbd3311db186cad4c7105095bd36d058a17d5eb379df8f50cdb280abad1867c34464c1

Download Submit
\??\pipe\LOCAL\crashpad_3480_ETRVUSAEKQXSITOP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/212-429-0x000001B136E30000-0x000001B136E31000-memory.dmp

Filesize
4KB

Download
memory/212-428-0x000001B136E30000-0x000001B136E31000-memory.dmp

Filesize
4KB

Download
memory/212-421-0x000001B136E30000-0x000001B136E31000-memory.dmp

Filesize
4KB

Download
memory/212-422-0x000001B136E30000-0x000001B136E31000-memory.dmp

Filesize
4KB

Download
memory/212-432-0x000001B136E30000-0x000001B136E31000-memory.dmp

Filesize
4KB

Download
memory/212-426-0x000001B136E30000-0x000001B136E31000-memory.dmp

Filesize
4KB

Download
memory/212-427-0x000001B136E30000-0x000001B136E31000-memory.dmp

Filesize
4KB

Download
memory/212-431-0x000001B136E30000-0x000001B136E31000-memory.dmp

Filesize
4KB

Download
memory/212-430-0x000001B136E30000-0x000001B136E31000-memory.dmp

Filesize
4KB

Download
memory/212-420-0x000001B136E30000-0x000001B136E31000-memory.dmp

Filesize
4KB

Download
memory/1016-1183-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/1016-531-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/1016-540-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/1016-1411-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/1116-512-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/1116-532-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/1116-475-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/2532-470-0x00000000000E0000-0x0000000000116000-memory.dmp

Filesize
216KB

Download
memory/2532-549-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-584-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-491-0x0000000004A10000-0x0000000004A7C000-memory.dmp

Filesize
432KB

Download
memory/2532-610-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-606-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-608-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-604-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-492-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-493-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-586-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-496-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-520-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/2532-588-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-780-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/2532-530-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-483-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/2532-535-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-602-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-543-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-590-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-547-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-551-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-514-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-563-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-573-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-522-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-592-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-582-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-600-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-598-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-596-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2532-594-0x0000000004A10000-0x0000000004A75000-memory.dmp

Filesize
404KB

Download
memory/2704-546-0x00007FFD9F2C0000-0x00007FFD9FD81000-memory.dmp

Filesize
10.8MB

Download
memory/2704-524-0x0000021C70CD0000-0x0000021C70CE0000-memory.dmp

Filesize
64KB

Download
memory/2704-494-0x00007FFD9F2C0000-0x00007FFD9FD81000-memory.dmp

Filesize
10.8MB

Download
memory/2704-488-0x0000021C56580000-0x0000021C565D4000-memory.dmp

Filesize
336KB

Download
memory/5304-1185-0x0000000001CF0000-0x0000000001D10000-memory.dmp

Filesize
128KB

Download
memory/5372-713-0x0000000007620000-0x000000000762E000-memory.dmp

Filesize
56KB

Download
memory/5372-708-0x0000000004DD0000-0x0000000004DE1000-memory.dmp

Filesize
68KB

Download
memory/5372-580-0x00000000060D0000-0x000000000611C000-memory.dmp

Filesize
304KB

Download
memory/5372-579-0x0000000006090000-0x00000000060AE000-memory.dmp

Filesize
120KB

Download
memory/5372-578-0x0000000005C30000-0x0000000005F84000-memory.dmp

Filesize
3.3MB

Download
memory/5372-476-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/5372-469-0x0000000002AB0000-0x0000000002AE6000-memory.dmp

Filesize
216KB

Download
memory/5372-561-0x0000000005AE0000-0x0000000005B46000-memory.dmp

Filesize
408KB

Download
memory/5372-671-0x0000000074B20000-0x0000000074B6C000-memory.dmp

Filesize
304KB

Download
memory/5372-684-0x0000000006630000-0x000000000664E000-memory.dmp

Filesize
120KB

Download
memory/5372-686-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/5372-688-0x00000000072A0000-0x0000000007343000-memory.dmp

Filesize
652KB

Download
memory/5372-542-0x0000000005930000-0x0000000005952000-memory.dmp

Filesize
136KB

Download
memory/5372-669-0x0000000006650000-0x0000000006682000-memory.dmp

Filesize
200KB

Download
memory/5372-668-0x000000007EFF0000-0x000000007F000000-memory.dmp

Filesize
64KB

Download
memory/5372-696-0x00000000073C0000-0x00000000073DA000-memory.dmp

Filesize
104KB

Download
memory/5372-697-0x0000000007430000-0x000000000743A000-memory.dmp

Filesize
40KB

Download
memory/5372-694-0x0000000007A10000-0x000000000808A000-memory.dmp

Filesize
6.5MB

Download
memory/5372-698-0x0000000007650000-0x00000000076E6000-memory.dmp

Filesize
600KB

Download
memory/5372-515-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/5372-574-0x0000000005BC0000-0x0000000005C26000-memory.dmp

Filesize
408KB

Download
memory/5372-714-0x0000000007630000-0x0000000007644000-memory.dmp

Filesize
80KB

Download
memory/5372-715-0x0000000007710000-0x000000000772A000-memory.dmp

Filesize
104KB

Download
memory/5372-716-0x0000000007700000-0x0000000007708000-memory.dmp

Filesize
32KB

Download
memory/5372-719-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/5372-490-0x00000000052B0000-0x00000000058D8000-memory.dmp

Filesize
6.2MB

Download
memory/5372-485-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/5436-728-0x0000020EBA600000-0x0000020EBA610000-memory.dmp

Filesize
64KB

Download
memory/5436-734-0x0000020EBA5C0000-0x0000020EBA5E2000-memory.dmp

Filesize
136KB

Download
memory/5436-727-0x00007FFD9F2C0000-0x00007FFD9FD81000-memory.dmp

Filesize
10.8MB

Download
memory/5436-742-0x00007FFD9F2C0000-0x00007FFD9FD81000-memory.dmp

Filesize
10.8MB

Download
memory/5460-756-0x0000020E2F550000-0x0000020E2F560000-memory.dmp

Filesize
64KB

Download
memory/5460-755-0x00007FFD9F2C0000-0x00007FFD9FD81000-memory.dmp

Filesize
10.8MB

Download
memory/5460-757-0x0000020E2F550000-0x0000020E2F560000-memory.dmp

Filesize
64KB

Download
memory/5460-781-0x00007FF4977A0000-0x00007FF4977B0000-memory.dmp

Filesize
64KB

Download
memory/5460-791-0x0000020E2F880000-0x0000020E2F89C000-memory.dmp

Filesize
112KB

Download
memory/5460-792-0x0000020E2F550000-0x0000020E2F560000-memory.dmp

Filesize
64KB

Download
memory/5460-793-0x0000020E2F8A0000-0x0000020E2F955000-memory.dmp

Filesize
724KB

Download
memory/5460-794-0x0000020E2F870000-0x0000020E2F87A000-memory.dmp

Filesize
40KB

Download
memory/5460-795-0x0000020E2FAC0000-0x0000020E2FADC000-memory.dmp

Filesize
112KB

Download
memory/5460-805-0x0000020E2FAA0000-0x0000020E2FAAA000-memory.dmp

Filesize
40KB

Download
memory/5460-806-0x0000020E2FB00000-0x0000020E2FB1A000-memory.dmp

Filesize
104KB

Download
memory/5460-807-0x0000020E2FAB0000-0x0000020E2FAB8000-memory.dmp

Filesize
32KB

Download
memory/5460-808-0x0000020E2FAE0000-0x0000020E2FAE6000-memory.dmp

Filesize
24KB

Download
memory/5460-809-0x0000020E2FAF0000-0x0000020E2FAFA000-memory.dmp

Filesize
40KB

Download
memory/5460-811-0x0000020E2F550000-0x0000020E2F560000-memory.dmp

Filesize
64KB

Download
memory/5460-864-0x00007FFD9F2C0000-0x00007FFD9FD81000-memory.dmp

Filesize
10.8MB

Download