99a13b46fc5ec89169132f3ec365c77eabcb31ea07efab203c7795da948b1774

Analysis

max time kernel
99s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CustomRP.1.17.22.exe
Size

6.3MB
MD5

fe6ac7ec692ea6a41c12a5b96de2b5a6
SHA1

8a1bfd9276b1838cc859dfd443a3ae8c63c7ddbc
SHA256

99a13b46fc5ec89169132f3ec365c77eabcb31ea07efab203c7795da948b1774
SHA512

cff9b7918e3f98b5709f8fdbc87e9ed12b026360b231e8772512e66c67f28826e7e3cad23fa16d8baeb42821464b26015f63737a8982128fbd49aecfc75ccb27
SSDEEP

196608:O1TeFQbXLA+GHUe/gVyikWTAgO5KtTHCx7h2:cTbcBH74VyikvgOot1

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CustomRP.lnk	CustomRP.exe

Executes dropped EXE 2 IoCs

pid	Process
868	CustomRP.1.17.22.tmp
4212	CustomRP.exe

Loads dropped DLL 25 IoCs

pid	Process
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe
4212	CustomRP.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
26	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 48 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	CustomRP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	CustomRP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	CustomRP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\.crp\OpenWithProgids	CustomRP.1.17.22.tmp
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\.crp	CustomRP.1.17.22.tmp
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Applications	CustomRP.1.17.22.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	CustomRP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	CustomRP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\shell\open\command	CustomRP.1.17.22.tmp
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Applications\CustomRP.exe	CustomRP.1.17.22.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	CustomRP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	CustomRP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	CustomRP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	CustomRP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\ = "CustomRP Preset"	CustomRP.1.17.22.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\CustomRP\\CustomRP.exe\" \"%1\""	CustomRP.1.17.22.tmp
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	CustomRP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	CustomRP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\DefaultIcon	CustomRP.1.17.22.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\CustomRP\\CustomRP.exe,1"	CustomRP.1.17.22.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	CustomRP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	CustomRP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	CustomRP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp	CustomRP.1.17.22.tmp
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\shell\open	CustomRP.1.17.22.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Applications\CustomRP.exe\SupportedTypes\.crp	CustomRP.1.17.22.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	CustomRP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	CustomRP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\.crp\OpenWithProgids\CustomRP.crp	CustomRP.1.17.22.tmp
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	CustomRP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	CustomRP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	CustomRP.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\shell	CustomRP.1.17.22.tmp
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Applications\CustomRP.exe\SupportedTypes	CustomRP.1.17.22.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	CustomRP.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
868	CustomRP.1.17.22.tmp
868	CustomRP.1.17.22.tmp
960	msedge.exe
960	msedge.exe
1928	msedge.exe
1928	msedge.exe
2996	identity_helper.exe
2996	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4212	CustomRP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	CustomRP.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
868	CustomRP.1.17.22.tmp
4212	CustomRP.exe
4212	CustomRP.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
4212	CustomRP.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4212	CustomRP.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
4212	CustomRP.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4212	CustomRP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 868	4892	CustomRP.1.17.22.exe	85
PID 4892 wrote to memory of 868	4892	CustomRP.1.17.22.exe	85
PID 4892 wrote to memory of 868	4892	CustomRP.1.17.22.exe	85
PID 868 wrote to memory of 4212	868	CustomRP.1.17.22.tmp	90
PID 868 wrote to memory of 4212	868	CustomRP.1.17.22.tmp	90
PID 868 wrote to memory of 4212	868	CustomRP.1.17.22.tmp	90
PID 1928 wrote to memory of 3552	1928	msedge.exe	103
PID 1928 wrote to memory of 3552	1928	msedge.exe	103
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 752	1928	msedge.exe	104
PID 1928 wrote to memory of 960	1928	msedge.exe	105
PID 1928 wrote to memory of 960	1928	msedge.exe	105
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106
PID 1928 wrote to memory of 1052	1928	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\CustomRP.1.17.22.exe
"C:\Users\Admin\AppData\Local\Temp\CustomRP.1.17.22.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\is-ETD7S.tmp\CustomRP.1.17.22.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ETD7S.tmp\CustomRP.1.17.22.tmp" /SL5="$F0060,5486258,1081856,C:\Users\Admin\AppData\Local\Temp\CustomRP.1.17.22.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Users\Admin\AppData\Roaming\CustomRP\CustomRP.exe
    "C:\Users\Admin\AppData\Roaming\CustomRP\CustomRP.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ff985c446f8,0x7ff985c44708,0x7ff985c44718
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9f3d539c9d8ef56c9d56c281207c520

SHA1
1bb2848d712fb41d59e5f206e7cfd9c8f5ead12b

SHA256
2824934da6d468017e047099be87a40bfbe9c8584d41a0b9c5e98eb0f2267913

SHA512
d3d37c39c5964d856355dc78fdf5ea1017bcece0f8335632ab65a0d0e586df966ba9aa4c79b127b4ecd2017105da305db965a10b7b768abfde9130b4104c2cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0140d44ad4a8964ddb6d9643998e3fe

SHA1
dfc653fcf3f2820f657eaa8a28835456a9f17ab5

SHA256
40de60bedbb00a783c6380cc1c780c38d3ab1a76328b5248efe57dbd41cfaf6a

SHA512
d3b1fe326987ff8590048f948b5f5be731cc6deee6181de0652c2e3cee6e1787bbdf48f0b010f8d322b2a4726f1b42745717c9d89491a2ebd4e9a9dc0285341d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6285f0db590b7844811cded949cf63dc

SHA1
d4bf2080ee854148ee5104bfd434168e5c533901

SHA256
84f5599a7311714cdd68904a4588c14a3c2d7f83751e1b6e760a9756706a6831

SHA512
b95c29c81c843ea3f5af57a9d84ba8aaa83a58a42c773eabd70c78b7c63c7a1c2600da1f28f69874b9a3c68613e2b79f31f97b9cd403e16926eef2dfcf67f167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
fddeb5083332a17d1fc09cf6894344df

SHA1
8cbd987ee0c9fd3c617146bd7a352c1cb59d9608

SHA256
0e74f0255517ca7175d2ad7526cd53e1ffa2722fc53af276fc45830f9e8b5695

SHA512
f1d1b49f76a916763e78d7201932498004f0f897071847cf7d1bbb35d5062f381e0914930e2016f360ba9be8228e2c00f08b0ffc524aef7ceeecc166b904c165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
7e889f15b3f844a031b98d1311af4157

SHA1
6c3a266a98fc6dd8f1dfb3a1ca06ca32aadfa609

SHA256
3da1814969d2d1860adae86f94ab4b5eab6327db33416131adacbe53b39dc601

SHA512
f69912e61278be82b6cf7a562dd0d4991e5f254716ad2ed0e1a86c1fc5844087912fe579ef83868a1961d561161363a6defe5d15be4cb7002c2c0a2460207fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ETD7S.tmp\CustomRP.1.17.22.tmp

Filesize
3.3MB

MD5
4c84ad73c9fd6c0d8590e40be75a7117

SHA1
8285d51da90a963e5e6002e3d2fc1b735a9cdf83

SHA256
a656e1ba87b2fcc64dbbb9fabf4c486ed85162187b529587bdefd5e37fca6a51

SHA512
e996e4f718ddbbfdb225e643a028d13ff0a6272da12570ef76cc30f5051007ac2b4084702170215bff37c28e1288340bf7752553d00a143fd9182ea0e3c431a7

Download Submit
C:\Users\Admin\AppData\Local\maximmax42\CustomRP.exe_Url_r15q51hssngmokjllmk3xsx1r0qzuwow\1.0.0.0\user.config

Filesize
453B

MD5
5e29d3432a03230ff4221c385be12138

SHA1
591c0e6bb41588dcebe7b94b82fcccfd1126e661

SHA256
fbdf3ca7933fdbac1bb082bacfb043f3b7b2669babbcdd33176ca60877ca29ea

SHA512
472f4bcd76e6d69c219a3ccca2f21ee522c7c98685361a7e77324b18a5adb8a9b7814781c1b2f2da68032b025d71a22987bc758c9487b1f18c5f68309b8cce50

Download Submit
C:\Users\Admin\AppData\Local\maximmax42\CustomRP.exe_Url_r15q51hssngmokjllmk3xsx1r0qzuwow\1.0.0.0\user.config

Filesize
957B

MD5
8b6ef5ae2a9f025e086a656e1971b0d1

SHA1
4387cb230ce1963a4347d9b603e633c6abca633b

SHA256
a15c7acdd7c4545e238b1ec6e9aa8ddc7f3ef82cbf14bf878ac08ae90f3c1a20

SHA512
52a85406c63415f46630ae9845a20fd49477566bd27bbf819d822b44ef71f4ff7d8421e163ab4e4eaea1f4eeea1a9c0587e7c69c18b355fd47f5d86620bf07bf

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\CommonMark.dll

Filesize
147KB

MD5
e39cd45b2e0390c91b34651c7dd0f7d7

SHA1
172a00f49e8ddb413ade56d46d10c59830ce9c69

SHA256
47c9f22684bae6afd08cdcca386edf8b47fa5e2a749faeb6499dc4b3ca6e5642

SHA512
fd25a41efc0e301049b8b19a7b3fc6122cf187045a32514396603a9ba4305a74c115041583fe86b2b581b2523107b2bd440c9a0e3a1b4d96b22ef632d607ae1d

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\CustomRP.exe

Filesize
1.1MB

MD5
ba03dc0b6e56851842b80b223e54e671

SHA1
917eb9d5d7ffde4674b12dcaf25d305b3112a927

SHA256
333b7d4280c0e6cb139c1d4d1e5dd1b7038540dab7d7f2750bb531605a958290

SHA512
50419c331538c023be0a4f3b659e8dc808ffa94b34a24ffc52aa08020c57427581999133d014b37fb526227756f753011d523d75a2d35751eab9d9eec7fd0aa2

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\CustomRP.exe.config

Filesize
4KB

MD5
b496e0b64ad960a0b13327a350ed89dd

SHA1
d84f215a7c6766c60bb27fc59bddafa6069830e1

SHA256
4691bf30db39d0cb27f0608e1c01de7865b9e7175667899c0dabc57b91908afb

SHA512
b548343b0188adb3c75557722c35d086365ac0a091bef8164a1ee3e52bf7455edbc17fe1d3297e8da117527afa8639de19aa10c875cacd644b5c13725d0727a7

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\DiscordRPC.dll

Filesize
82KB

MD5
2e9f2a132f59cde7f3a888f5fa674cfc

SHA1
441271e6e1c2a65eb43ac8a76be8d7bf5f0b9a00

SHA256
84ef313d2525da8006167fdd8b78556f5038bf1571e3201e619b3d956fe6d842

SHA512
dd420ed1cfebb181c5706ebda1f88c267a40a158b5d22a6bea54710add2cee395a6dd67e9e04c96b387db791aea84ea3b124db5e424d8b3a2d5f1b807856534d

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\Microsoft.AppCenter.Analytics.dll

Filesize
25KB

MD5
4f0eeea40634e091b149e22d098f0084

SHA1
8426f3f5a89dd8a32e07c54362a523825cdd4361

SHA256
29ce7dd433293977386ae132e3a72b60bf32559f5b56b555166b78953212743e

SHA512
415fe0ee2a36ae51420f11afb9d127bc41fba899274be097674059e5b50fc2a5ee206779160191c3cfb2a24f0c4c8799072ab013adae6a557754883066ad847d

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\Microsoft.AppCenter.Crashes.dll

Filesize
52KB

MD5
1fb364c1d622905aebd6e57500c169d1

SHA1
5423fb63ab28a24e1fdef3616e5e0e3301dbbc5f

SHA256
07125de19eb06c67010039448e898c7bb954d25cf0a77b05d95329ed575f24e2

SHA512
ae724010f049989ec006ce71990073834f8d58ebf1133a589ec3de839acde1c07b136deaf9e237c3b5a3d216ea9dbbc5aaaf482df1b549ee786a7a2e27d6bff8

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\Microsoft.AppCenter.dll

Filesize
145KB

MD5
885481ebbec08fa817ada9a5f7a527ad

SHA1
c9390ecd62766338584a0ff45c71d6abd64db379

SHA256
82e14d7bada761bf353929163bde2cf5c12e41727937ae5f0c7314fcee8be029

SHA512
9b2a24f9d30886321e5961d5bd59377a4500bc5f9de23c5a217e94087a8f8742e3754cfaae8d93c6d3bdf7d6b1fa578a103bc6e98571bd201e1dc9564d38ed39

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\Newtonsoft.Json.dll

Filesize
695KB

MD5
715a1fbee4665e99e859eda667fe8034

SHA1
e13c6e4210043c4976dcdc447ea2b32854f70cc6

SHA256
c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

SHA512
bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\Octokit.dll

Filesize
1.3MB

MD5
3348408f1304e3527c7cdbb21194bdfb

SHA1
4a90269be013d2bd5bb9fbee5ab4cc5bb21dce51

SHA256
609fe5f2d8fb3ee6ccec30c5d355f4d97e89ec3d285b3ae7912d0d1477368a8e

SHA512
83afe8465948e448bd9f938610718d762d5eb3793035ceb5f3bc6348107bf0313cc43ff563016e205e2f976962fa3fa7eca71fe8c1d6c880ae812ddf84028d45

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\SQLitePCLRaw.batteries_v2.dll

Filesize
11KB

MD5
59e7b8c38944a8d591363fb5874dc971

SHA1
fdfe99922a4e9aba60ed6b1859ed331bc5940faa

SHA256
4ed2707cc2644d63bbd27cf39840aaa4a8617b6b275008f031e16d3a76c75e4b

SHA512
5d2d3e138588352267ee8f21d02f7ee6dc9353ce4a22e9fcac56e0016bfcb52ffeb4c530dbd5c6d8d1e2fe0855a50fa909c0b3129eb4fb8e13376f4bfc684f9e

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\SQLitePCLRaw.core.dll

Filesize
49KB

MD5
5e45fcc43a6a54b13e1d384c3c6c6e85

SHA1
6b54a3602f37ec3b3204914c58fa53f6453ccd3f

SHA256
f424dc7b2ac7172e3041ac567603a0cea940fbfded8a2a8df53b2aa22d445da5

SHA512
0bb27e39263b2cac625761aeb0db80e4cf43b10573cd8126b250620f82be8508cda948f4dc23693956b39db0af4628f11abd5e28b5b8c6d7a024cf5b30fc7b3f

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\SQLitePCLRaw.provider.dynamic_cdecl.dll

Filesize
63KB

MD5
359189a6345d70dcb4703cd4b75b5be4

SHA1
afb93196574037c1c84a16892e57766097d579e4

SHA256
408749d563fcea1d444ffc35069cc0f9db4c7d10636e08c522b06368e90b5834

SHA512
9f729288d4953413abff0884cb88944b579adbb2ea43d49eeae560d0992ee71e9ef072c872e7edf22235e924ad4fbf41ddc063ad4858704cff4cb3166b7c7a22

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\System.Memory.dll

Filesize
138KB

MD5
f09441a1ee47fb3e6571a3a448e05baf

SHA1
3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde

SHA256
bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f

SHA512
0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\System.Runtime.CompilerServices.Unsafe.dll

Filesize
16KB

MD5
da04a75ddc22118ed24e0b53e474805a

SHA1
2d68c648a6a6371b6046e6c3af09128230e0ad32

SHA256
66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74

SHA512
26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8

Download Submit
C:\Users\Admin\AppData\Roaming\CustomRP\runtimes\win-x86\native\e_sqlite3.dll

Filesize
1.2MB

MD5
e52a4a0a6f61ec95aa51d8ffd682b72e

SHA1
6a3529c7ac873131a766415879b20925ff404b64

SHA256
7dd2e2923e9a988866d969bb5a76a9d3448a11a0f225b83c734161977db564a5

SHA512
0e91687ba8b36cc0a7019ba1bd819f538cd55649914319a074669b7a04fdc9a195d36ba1fd5eeeb6149bffdf46e6dccc6e8d4b8e1cce62aa13463f9410423883

Download Submit
C:\Users\Admin\Desktop\CustomRP.lnk

Filesize
983B

MD5
af507d37923dbc97d36923c9001c4e5e

SHA1
049e3ef2aeef473f8746a18e9af72a03b3e26af0

SHA256
caf697fa842cac3a13ef716efcd44f4c7c1dd54596f2a113f15436fb18f5d43a

SHA512
d228f065c5ac60200fea49f657185a745d48245735c37b64ed9fd035435d3d9b4b8cde59d0585ffceec00e2f88c17f99df0e99eb014016347d193010c54e7229

Download Submit
memory/868-216-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/868-6-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/868-9-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/4212-254-0x0000000009400000-0x0000000009466000-memory.dmp

Filesize
408KB

Download
memory/4212-245-0x0000000008F80000-0x0000000008F88000-memory.dmp

Filesize
32KB

Download
memory/4212-261-0x00000000095C0000-0x000000000970E000-memory.dmp

Filesize
1.3MB

Download
memory/4212-264-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/4212-197-0x0000000000130000-0x000000000025A000-memory.dmp

Filesize
1.2MB

Download
memory/4212-253-0x00000000093A0000-0x00000000093A8000-memory.dmp

Filesize
32KB

Download
memory/4212-244-0x0000000008FA0000-0x0000000008FC6000-memory.dmp

Filesize
152KB

Download
memory/4212-240-0x0000000008F50000-0x0000000008F6A000-memory.dmp

Filesize
104KB

Download
memory/4212-239-0x0000000008F30000-0x0000000008F46000-memory.dmp

Filesize
88KB

Download
memory/4212-235-0x0000000008B90000-0x0000000008BA2000-memory.dmp

Filesize
72KB

Download
memory/4212-246-0x0000000008F70000-0x0000000008F78000-memory.dmp

Filesize
32KB

Download
memory/4212-265-0x00000000094E0000-0x00000000094EA000-memory.dmp

Filesize
40KB

Download
memory/4212-231-0x00000000082E0000-0x00000000082EA000-memory.dmp

Filesize
40KB

Download
memory/4212-266-0x0000000009A50000-0x0000000009BD6000-memory.dmp

Filesize
1.5MB

Download
memory/4212-267-0x00000000099C0000-0x00000000099E2000-memory.dmp

Filesize
136KB

Download
memory/4212-268-0x000000000A3E0000-0x000000000A734000-memory.dmp

Filesize
3.3MB

Download
memory/4212-273-0x00000000091F0000-0x000000000920E000-memory.dmp

Filesize
120KB

Download
memory/4212-257-0x00000000093D0000-0x00000000093EA000-memory.dmp

Filesize
104KB

Download
memory/4212-223-0x0000000008C70000-0x0000000008CE6000-memory.dmp

Filesize
472KB

Download
memory/4212-222-0x0000000008BB0000-0x0000000008C62000-memory.dmp

Filesize
712KB

Download
memory/4212-289-0x000000000B2B0000-0x000000000B2DC000-memory.dmp

Filesize
176KB

Download
memory/4212-290-0x0000000073310000-0x0000000073AC0000-memory.dmp

Filesize
7.7MB

Download
memory/4212-291-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/4212-292-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/4212-198-0x0000000073310000-0x0000000073AC0000-memory.dmp

Filesize
7.7MB

Download
memory/4212-213-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/4212-212-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

Filesize
40KB

Download
memory/4212-208-0x00000000056B0000-0x0000000005742000-memory.dmp

Filesize
584KB

Download
memory/4212-207-0x0000000004FB0000-0x0000000004FD8000-memory.dmp

Filesize
160KB

Download
memory/4212-203-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/4212-199-0x0000000005100000-0x00000000056A4000-memory.dmp

Filesize
5.6MB

Download
memory/4892-218-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4892-2-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4892-8-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4892-0-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download