d1d5f8c21e7111ca5a3a03d0fc6fed418af963d49b24980e1730057a5e5e8745

Analysis

max time kernel
1760s
max time network
1695s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
29/03/2024, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kiracro-toggle.pyc
Size

4KB
MD5

f86b6856d307e5dc2cbb21a6e0a3ac6b
SHA1

e42a0cee8682050da78f43baab3270c48e6c3e74
SHA256

5007d84253de6d6e9415f343825df58a6013103c3ad3dfc36ecae932448cca45
SHA512

089ed94595e11909ec78d8807f30899443109c3f6dc1af28e7e22edd8763b9f6b5a086d8a17e6ca82eb77c8e3dcc380d8f383a208a6d571e2b45f5cdae63493b
SSDEEP

96:s3np/CJjV15CCnDa0MIXvxDqOPBT+mMINuEln:s3UV1sC20jV8XEl

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000040000000300000002000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000ed30bdda43008947a7f8d013a47366226400000078000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000004000000030000000200000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000040000000300000002000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\pyc_auto_file\shell\edit	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Ref	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000003000000040000000200000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000010000000200000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\Mode = "8"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\IconSize = "32"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000004505b444e564da017b6ccf48e564da01a2bc1857e564da0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\i\ = "pyc_auto_file"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\dhm by @euvh.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\dhm by @euvh (1).zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1176	Winword.exe
1176	Winword.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1556	msedge.exe
1556	msedge.exe
3436	msedge.exe
3436	msedge.exe
240	identity_helper.exe
240	identity_helper.exe
3900	msedge.exe
3900	msedge.exe
2296	msedge.exe
2296	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
4828	msedge.exe
4828	msedge.exe
1644	msedge.exe
1644	msedge.exe
2472	msedge.exe
2472	msedge.exe
3736	msedge.exe
3736	msedge.exe
224	msedge.exe
224	msedge.exe
2640	msedge.exe
2640	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4568	OpenWith.exe
2296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of SetWindowsHookEx 49 IoCs

pid	Process
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
1176	Winword.exe
1176	Winword.exe
1176	Winword.exe
1176	Winword.exe
1176	Winword.exe
1176	Winword.exe
3760	MiniSearchHost.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
4828	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
224	msedge.exe
2640	msedge.exe
1760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 1176	4568	OpenWith.exe	82
PID 4568 wrote to memory of 1176	4568	OpenWith.exe	82
PID 1516 wrote to memory of 2552	1516	msedge.exe	91
PID 1516 wrote to memory of 2552	1516	msedge.exe	91
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 2104	1516	msedge.exe	92
PID 1516 wrote to memory of 1556	1516	msedge.exe	93
PID 1516 wrote to memory of 1556	1516	msedge.exe	93
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94
PID 1516 wrote to memory of 3440	1516	msedge.exe	94

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\kiracro-toggle.pyc
1⤵
PID:3196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\kiracro-toggle.pyc"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1176

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffb371d3cb8,0x7ffb371d3cc8,0x7ffb371d3cd8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2352 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2744 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5600 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1924 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2372 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7420 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11217288132636294471,6408229510858116464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb371d3cb8,0x7ffb371d3cc8,0x7ffb371d3cd8
  2⤵
  PID:4664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
88e9aaca62aa2aed293699f139d7e7e1

SHA1
09d9ccfbdff9680366291d5d1bc311b0b56a05e9

SHA256
27dcdb1cddab5d56ac53cff93489038de93f61b5504f8595b1eb2d3124bbc12c

SHA512
d90dabe34504dde422f5f6dec87851af8f4849f521759a768dfa0a38f50827b099dfde256d8f8467460c289bdb168358b2678772b8b49418c23b882ba21d4793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
341f6b71eb8fcb1e52a749a673b2819c

SHA1
6c81b6acb3ce5f64180cb58a6aae927b882f4109

SHA256
57934852f04cef38bb4acbe4407f707f137fada0c36bab71b2cdfd58cc030a29

SHA512
57ecaa087bc5626752f89501c635a2da8404dbda89260895910a9cc31203e15095eba2e1ce9eee1481f02a43d0df77b75cb9b0d77a3bc3b894fdd1cf0f6ce6f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
34KB

MD5
6e050be3bd6794eba86225c7782d2dbe

SHA1
7ebe1b4291b92f66e4d35bc9109ed5442e35eb20

SHA256
0cd7b67e7bcd622c93226fff7a6232189faea6f63c74aa354ac5e161b152e87b

SHA512
9acb7630e337c3af1de1772bb3c2fc7cdc95c56917ea4c386e58127847880267fc25698b8dc0fc93f2bd9135e20b050a46fc3f02a2bf27ba5f67e281c1076930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.2MB

MD5
8f4b4d5d848b49f72ec9d45000e45fb0

SHA1
6517ec20d81ce901746076948417cfafdbcc2d20

SHA256
dd35fa6ced81d040a5aaa4726885204f44abc7ff1f7a83874b76f34bcc4d1598

SHA512
9704356124a9f7df23cc91ff93b13fbcfbc0d09d92fa0a5d4c1dec65f7ab78ad2786ffd9ddc304bc24df4a0cfe43afa24cc0c6cc3c721088320feb5c6f7e7baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
32KB

MD5
bbc7e5859c0d0757b3b1b15e1b11929d

SHA1
59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

SHA256
851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

SHA512
f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
74KB

MD5
bc9faa8bb6aae687766b2db2e055a494

SHA1
34b2395d1b6908afcd60f92cdd8e7153939191e4

SHA256
4a725d21a3c98f0b9c5763b0a0796818d341579817af762448e1be522bc574ed

SHA512
621386935230595c3a00b9c53ea25daa78c2823d32085e22363dc438150f1cb6b3d50be5c58665886fac2286ae63bf1f62c8803cb38a0cac201c82ee2db975c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
198KB

MD5
cda68ffa26095220a82ae0a7eaea5f57

SHA1
e892d887688790ddd8f0594607b539fc6baa9e40

SHA256
f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb

SHA512
84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
cb1f1305da2f14c10acbac7cb73c8528

SHA1
c3cd8441d05373cb74e724e6e5e8537f1c76e2fc

SHA256
73b20798577aca89cf87db4ba7986c7242bcb72cf903942381c319759d65f523

SHA512
dfa564fb2f7078807836415c65f783d184c7f126bc7bae850bcf994a099ed36e454d285b04279b14ae653612c947dc1ea901906bc4c441abda1c65170e71db73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ed60dc2bf92583025d83f0545951c1b5

SHA1
1298cff3a7fb548812a92e3d3307b19269657673

SHA256
7f735ada3491148918f12c767cc5b65af6f97b593cafcf128870d85c499ff14f

SHA512
6ab10fec8b83153d767e7c123431bedb17d2916bf188132d8f38e2eaaead11ba7f1517d2f76dbfde17093f4b3b9696674906bc7dcbf32926da5b8e7ca7d932e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
6252278009b51713c070c1817ea06dfa

SHA1
34a3684ab453c38b65fb1b4a290e9e8c12b228a4

SHA256
95bc9771302a5cec139f8fdecf350e8c7d521c355d10d7575aaaa706132959b8

SHA512
6da40f542e913dd40f3442c5c463b4550c9d8c5427f606450efcf62f8063cb60b20257c46dd0eecc7b6d67c8146699f489ecc60a9f4cdf9ae86e81a29a3df2d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
826985602620166af339424735801995

SHA1
cbcc7966082305645f2803696943b9ad52776f81

SHA256
e86b61968a67f933c122557041ba48dadd4b55f95bfcb308ebe2bac4c1154e3e

SHA512
4c2e1fa6fb17ad9decb60bdbc96989605000b5137219a2bf486733827530b45f74a5c79f9a6b046c1808409407d23ac9bdb1dfc53e6640261da14431552291b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
449eb91f110fe169a6ef8b7465b4729a

SHA1
a941aa67c3d38384aab09dbfaa8e2d7796b050b1

SHA256
69ade01014741c7c6c09fa9804628c5ef7a9431191f622fc661d09b033af1e7f

SHA512
fc8cbcead49d2fed66a49917745d4e64d1436ad4ec5b4aa366f910415e796c10d214e62c0a55b2c6414cda023a36a2c9530bfa1bbae7cd24d9c9a05c5748e320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5d505f95ed2f3356f42b14a61091b7a9

SHA1
e8832189fc4a6a3c727478ec18e858c735f798dc

SHA256
a789b0d3d53468e5a8e46da8c5f0401af00bf82442be6083d24417d37c0e8c89

SHA512
21dc3bcc63e5a430467216d768403af09f8297c06f2bb0f5dad7384e5f840c3ba4e63e7f24aa5d17209d94e288e359573f5f1f5a4cf707c06eca6a8059d4d891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
bdcf05356015c4c856bfb2c07bca6c77

SHA1
d003a0dccf51ece6608a4e2ffc157a35413f977a

SHA256
8e1a09858e86437bb1d78f455b0a56bae5cd8a7d919484e9fcd845e29df4ecb0

SHA512
a7d7a9b5990ffd89f844de76fd1c192538538d8c56b1bc1efa38e4a1fd605a0339abe19f3090ff540536b9cf4114fc88b87ab4a284c626e9fc1ee1e4d8dd7577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2b071568af830ca5f9c3777cca960cd3

SHA1
d064a852daf0c60fd2da42dc55c51e708dbc6305

SHA256
ed82cd98ab7fd4b5086fe01205d5d7df9463b4e1ca75d41334ece8f5c9c54775

SHA512
2542ff64b2d2a3553565c15ed05a0006fb81c8eaaa070e8c7f7958c053fc950a9af93c124bc661c5ef9c4d241e55c80257ce33ed37dc241a1052b55a27679750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1bffc1526aeaceb4334f75b8f63c4e55

SHA1
ac0bec36d2d77927fb79c1c30b34efc5be7f0bd9

SHA256
f3b453a45d915c762cd8d42faa2e6b95847f1571f617505dfcd939dbf443e47a

SHA512
3da9c5003f51b8d9f528ee70840faf0961354b3c5505982654c83e076f621995f898e4a645b2f2d6f9052ef75dc2ccc9598ce58cc6981b4aa0df8c7fd9243ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
72f0aee3fe8f4a5aedd9935a0fff9ff8

SHA1
a46b603fd4a2374e5016361408cc3a2e65f841cc

SHA256
8a5e9bbe6905ed595c1acebcfb0090e52f8d6ce78b2e5239efed6ed95d4ac25d

SHA512
c681565d41a97b7884b6b1d6dba2f9812996bfdd36e1f4cf1bf3b6359a0ee1af28946800c1618dde2144d687c175b59c753e00d13c000ec531731eead35fddc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
21c31544195acdc94ddb2bff79614773

SHA1
01b3923aea6fa7410bff861ec078b632fc41666a

SHA256
34272b4e246a62e6dce03c889d73f1a73abade6fb2d9c2ac11ee51e7f9f4f59c

SHA512
e0b4809ef42b3c64b0cfe44bcab3a2803fc50ed1c8331b08f34b73d5946f268d04eb3eac4a17364ec54fd08233658620cd730c07b8687e21b35a6767e6dbd5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1b86644beb38a422bd281227a0f0a5aa

SHA1
82fd0414a49903bfe74ecc127d74ab721eb96c82

SHA256
2dcb39519374132d171cc208b71624921b436bc49512ce4478072f67e0846bcc

SHA512
ccfc3b45076f110916ee24717449ed64414be4bbef8519ff60f68616b259e17239544928fde56e8598f1ecf647903b417d33ff511e153ed5dfe816eeeb93210f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ccd5f2fd4e9a0d72603eca565d48e3d3

SHA1
b9074a44d1094a1037047553d9f1534b4b7ffdc4

SHA256
a5ca1c4412c3132d62a0ac1e5f341408d7deed33bde0d4977add08d86aea5b69

SHA512
b2912debafc06660aa189ccbb13a676f53b4f4e255b269f0c8bc355c7aac5ec0baee35c82c2d2eb1b7d9a6b89872fd88464ed9be9e047781e5f8c357da7ff72e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
891c1e920c81ac7672bbd8bfeac19f5b

SHA1
dce1e066207f986f877fc0811d42299be468dd48

SHA256
1cf849cb1e83b72be82d1c7cb1271e6a99b7df21e1ef21170682d8233fc710f2

SHA512
eee9964d418a5a09347ca7638fbcea18c0fc5ee99b60d8aea0c778d35c9a796ad7226983e44b06541b6ea43fa3844fd16d13f354729a5bba6e52b122645f6a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3f2b9eb05143ca0d53699169269b0cc

SHA1
8b552b4ed7933597489ac40aee6506b98ab3c386

SHA256
30c7f66ae2f79a0cbd8f80ad6dcd457c86797611e1954ed2fa3b38dee72e8363

SHA512
9f5682d08668085aeec6d6a83e8ec373dbbb4daae81ffb8aa2b4f43a6a0d9cf99f573fc833bcac03b3bc26f07ec1b2b49b91e72f7c1051114b0d4a9f2c2e5667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f4add026513b117f4f4e89214eb69c26

SHA1
191edb851058a5b852591feae81750ee3fb2091e

SHA256
767a25fb8fd3e617716a11b15cb672c425bec22aa2d51b539e6f62e021323bd0

SHA512
d7976e8cc522cd3e7340138403e7dc248aea0715262ec449e0c54fad035c359ba8c125fb3aa50e28cde3083b039be5f905cdab550829c46174cb81ff8df0cef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e65d1c87f5f49e6a91add6741358b128

SHA1
d27c70a909dbf43e0e2e799e7b6cca6a7417d79b

SHA256
f58d0993481d88fc92dd3594351aeaa5fd4c9816de12d9698bfab02c00add1c0

SHA512
d6a87415a7289ebe8c6266d07fe8caa639a520264f172f0d5a5a82ef6b6e12d60990e9f78083b00e2577f2c2911099c5eed60b7483552d4120ca04c8c260bd7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
c4fe2e36e02ad04a49b5ffa5497c560f

SHA1
a663c1a4911852285aa953c1bad52ec6bc10c132

SHA256
246af7ff5dc01eb3e6d20b20f075fe18bd3138fb963c22e8950a6a88fc982011

SHA512
27043b2b817682f838aaf0b300fc281bd81812e76189c4885994b3d8181c412146db3e5b6963014838950b1167551c7a949eeafa2067d962fa1bbf13b6b765ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
30297c8d8cbdb94b2d88f92b2cf980e9

SHA1
d90405b87f1dcccca23207699e58c2f7af0f5552

SHA256
30f9f0117c060c133d0851141f6e8bd1c95aef01e48cd839e35be868afcf7725

SHA512
1f4dc5e05dd4f086f0b7092588f94e726e6873edb9e5e2f2882ae6fdd26a5a5d37f9eea2a51647a75098869944ab2beb69550124990f99cf77ed1910326c8824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bb78f0d189b39db51398a1c4b6e7c2cf

SHA1
52937ab1fdd6112c0a88e83562ebf35f72e5359c

SHA256
c027813e5a9d6ef8ca92ff10bc3d8ce3a400b5cfd433791addbeeea9f3964348

SHA512
5556fae5cb2bdc0fc39c4fa255693b5f66beb045c2a05f150d0dff1025a4ad8824632de78a57a2b2496a7ed1d49068aee6e9bb0dc1b2b4ca6f7081d7c6ca60a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ba47b738c1ea159e7b6e1197184c1b84

SHA1
ac71e9867c2198be55607cdb29ebcb525007be43

SHA256
c9d2cb4b375fc5fce0718948bb03c741611dd4372c94eb7737eba250657bfc36

SHA512
0a0cef2c95688f935f190e23bf628ad66f3d9b43290b9ff171d25b3f28625b9bf1255925b11810873c28f34797a7590cf56162b1b27af834322936ce32f26230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a8bd2fcc31cd30522416e490908bd3d2

SHA1
5a28f7c7cbde4e2daeb6294b2311a039b56b1c20

SHA256
cc570f539838ce72638422b71a44c79227edd9335eb8f227f0f59afbb58a6363

SHA512
84fe86e74dc7aa57732711c61cf59b75d7dc866be52db0a5011c166225b3caa9da3af430c944884e44659d516dfc436141ce54f36237592c31ccc504efc59dcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ad900f071366129e99f7b2a656ab5cc9

SHA1
bd8db0b20c4b58cd5fbded717f350137b981327b

SHA256
505d1abd8fc836f9aa0ca5ec5d88464d57c33440d889d59e19709669b48c943f

SHA512
9fda1118f5d4b0bed692d6e03f0ff5df5d0c6d723452be23d1e622bd8e9cabb1deb138656390964ba04e37da640c579a6161abfebb1f2b3befdde6ea7059e832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe609138.TMP

Filesize
48B

MD5
2b100b59c9b8411a706d7372c9107d03

SHA1
2949c587f2c63a0e606d5ea56f831ae255f727e4

SHA256
fc24aa2de07987632f1639bcbf72ba7edbdd26abe6d1099297b78926b354a05d

SHA512
9699f767766bab29b90cea0bdef6d3da629820314d6c91dc57451b1229bb4438c2132158b6d8daf6cf421532347360ea993e061fffe97ed63e21ec7ade3996b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3d44b5b7f6f39d46f214d1a3955c3eed

SHA1
60c64dd0ae85a138971550421da73b914cbe8861

SHA256
f0c253213191d203a3557fcdc4a8d03a744ed0b12e66fb96f631b7f50123c26d

SHA512
4a9d7f8d25e9bd5b4e8a915f7e5b4597a2c7a6e0d439aaa078daaf88c5ad96e2f29a8dc9eb5af4b231cec5f2383f4e7f608d3079565d84a99e7a70c29df7fa9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1745b9018b6ac28b9dcca1520670d26d

SHA1
b05ea87541a48bf3321561e4d02ba34ab1f85fc3

SHA256
07c848c23d56efbe80aea64199413ce1ce7711c252b9052ae04e542de63a13e7

SHA512
2db5fd414637669202a3d72f43d090db7406a109c786861e6c71deb4da91fc162661fab8c2998fa645df69f0e4215b3e19b8b00bb860f4876a5b773f7b03bfec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3b7125a2422b65a79f0335fcdc748024

SHA1
eb197fcea6ba5ff56b98ababdbf4fef82eb26e24

SHA256
126946da08e57a396ba41c581d5c412cd64f3821ce6352f8537a31ee9b7a2589

SHA512
0a63386ff573a2ba535cac1b41ffa32618fc91b9b77eac7d4cf4f661ca643387fa785c94e6dd9476ed14834b051ebd75e6ac8d9d867a388f9477c217d193b7e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7421550b21b556ca93eacab1b0507552

SHA1
5a38aa3bc2a2a6f1241010109986389b52955cfd

SHA256
015194679e0161cd380f02194dc71fb66b28054688d2b2b14bc0bd5e70bcfee3

SHA512
91604099b6d6b9c7f068f3a764e2054e13466f0de1829271dd487020958fc466b6142c41111e6e15b23d82c390fb3f3d9d57508798f595baad77785e828bcdc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c4a6e.TMP

Filesize
538B

MD5
5058de61e0dd9ad3928d2dc6da40be49

SHA1
937f5734c427dbb16421d4e7192a1c7bb81c2f9e

SHA256
47cf1f6daad7fb285db4e125be746ebb0d0f80868479775ec7ffc364784bc082

SHA512
d1207ac022d05fb3bb61145dbb80cef7724c34090f8e25ace093bcda19e2567e5631ffa5487689c42ded90c047f7585ed420dc15255498273c35993ba2f27770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3f4544b9a9128baac73fffba1a43bd9f

SHA1
1f7225e12351afc6d9eb3b2e8e75c8e565106d04

SHA256
49afad51b447a2e8f145541d445c258ae67da37f2960675a1389738597bcb8bc

SHA512
708deb9838fbd69a37a7235ec2584dda6ca0c008e297ffc2416077781f6fc1b17d4b52b867873af77b187577fd88ba0bb60360a7d9b110ae25007b85d4b9077d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
214e9f360873fa34055c5ed0862dfb36

SHA1
3b7550919e256a8c9b5629e4ef67ee52b1f9b225

SHA256
c2254170325a5261acb17339f54306e7f70ae1d254432ce0ea8340a675fcee7b

SHA512
75b9b2f0094d320320048cd7bcfebcf7316a3737cb2c283d2f4311f1079ad3fc09cf361cfbd27db690b1d92d4b21f6704defdb0abdb54cb6a6b0b3cbacf9d261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ff4ba0e0980f4bfc9fdca410375f5833

SHA1
5a46ac34c092b03e56fb1f14f78c5e8176b2e8d3

SHA256
288587a7ac16c61c43f3aa62b873f0c280355b0db488aa179cf6f883a6b4bedf

SHA512
435c6590b860b1109b5dd5cfaa6e896da316ce2e7721ca50835a1529fc44aa4f3b1d6fe0bea6b125ba8c3fb6cd75998715c45496dde33da9f496266526ce3d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
127bdf9cac39558108fd962773dfd09b

SHA1
7fd817beec98558fa0a4cf89e474df691b1d04fc

SHA256
d35716797cc71620080d458fc67d391d9f83a77deeda91e09967885808ad583b

SHA512
ae8754acb1d63aa853e16b2f749b061ccbd22c304427ad15856cbbc5bd1c5756f6bcef7f59a175a6a5cbfee899309fcdc4eacb9f994c5884318d48e750e1bfff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f152f2f7be115ea8d3c06c58542d4bbd

SHA1
eb19cdf3d9d151961162a766b7be4bfbe3bf9757

SHA256
245d131a6db36382f12ac04835e074bbabc2d8d8084e1b3d64fdb8af66e8b64d

SHA512
45493d7dab12c7b3a87bc42106db5946364e7886138cdae83c05c284e379d1329ed8eb3932a3cc71961d74854aed549ebcef3180396e5bccc8d77887ed5c7c33

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
d787e644a5c87ff0d529178be370af85

SHA1
1cc3e85b27bb7a602becada3674e2ca3f06cd674

SHA256
609b79e146732b2231318bde6338788a61124f8d22841566ed27d563200bbb32

SHA512
9386d7ef12d90ef90816a80b4c5f6f6f6a840a0745d81aa8bb4e8ec773ca852107d4ff3ae81e4165d2e6695813121aff836404e0c2d29ea44f063a6cd55a02d0

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
5dd2e58c8cfaff1881ff7bc283ef1ddd

SHA1
0ae988c23106f1983d82c01cf135803a647a1697

SHA256
81aacd0916b4d7a8543a99621a36843406e301567f9248877efb1e804fe5ef71

SHA512
d509064e13ffcf45d2833a801195292a2ef0e0fa2f7065459023e8c778e30f1daa64382b9aef9eed5c2de3f0a229924b20d1b6246135c089e257d91bf714852f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 473724.crdownload

Filesize
24.8MB

MD5
20cedc756914f99a7e89b9e0d1b3a55a

SHA1
4ea35fcae2d55c4d5fd4f6ac394bef6355802837

SHA256
d1d5f8c21e7111ca5a3a03d0fc6fed418af963d49b24980e1730057a5e5e8745

SHA512
11fb6f7ea4bea0b3136c6f8cda2b5ae0313fad37077041ee21cb53a85d6f0746f2bffada390a04fab135525d07715eaed91435b5a944f6ef1927c36a29af6182

Download Submit
C:\Users\Admin\Downloads\dhm by @euvh.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/1176-8-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-30-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-12-0x00007FFB1CD30000-0x00007FFB1CD40000-memory.dmp

Filesize
64KB

Download
memory/1176-16-0x00007FFB1CD30000-0x00007FFB1CD40000-memory.dmp

Filesize
64KB

Download
memory/1176-10-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-14-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-0-0x00007FFB1F8D0000-0x00007FFB1F8E0000-memory.dmp

Filesize
64KB

Download
memory/1176-11-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-13-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-9-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-17-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-7-0x00007FFB1F8D0000-0x00007FFB1F8E0000-memory.dmp

Filesize
64KB

Download
memory/1176-18-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-5-0x00007FFB1F8D0000-0x00007FFB1F8E0000-memory.dmp

Filesize
64KB

Download
memory/1176-19-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-22-0x00007FFB5F060000-0x00007FFB5F11D000-memory.dmp

Filesize
756KB

Download
memory/1176-20-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-15-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-31-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-4-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-6-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-3-0x00007FFB1F8D0000-0x00007FFB1F8E0000-memory.dmp

Filesize
64KB

Download
memory/1176-1-0x00007FFB1F8D0000-0x00007FFB1F8E0000-memory.dmp

Filesize
64KB

Download
memory/1176-2-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download
memory/1176-21-0x00007FFB5F840000-0x00007FFB5FA49000-memory.dmp

Filesize
2.0MB

Download