orcus | hxxps://github[.]com/BlitzedOfficial/BlitzedGrabberV12

Analysis

max time kernel
256s
max time network
255s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/BlitzedOfficial/BlitzedGrabberV12

Score

10^/10

orcus agilenet execution persistence rat spyware stealer

Malware Config

Extracted

Family

orcus

209.25.141.181:40489

Mutex

248d60d8a7114264bce951ca45664b1d

Attributes

autostart_method
TaskScheduler
enable_keylogger
true
install_path
%programdata%\Chrome\chromedriver.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
winlogon.exe
watchdog_path
AppData\svchost.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe	family_orcus

Orcurs Rat Executable 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe	orcus
behavioral1/memory/2212-1451-0x0000000000DE0000-0x0000000000EDC000-memory.dmp	orcus

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

UnityCrashHandlerV2.exechromedriver.exesvchost.exeBlitzedGrabberV12.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	UnityCrashHandlerV2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chromedriver.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	BlitzedGrabberV12.exe

Executes dropped EXE 12 IoCs

Processes:

BlitzedGrabberV12.exemxfix.EXEUnityCrashHandlerV2.exeBlitzedGrabberV12.exeWindowsInput.exeWindowsInput.exechromedriver.exesvchost.exechromedriver.exesvchost.exeUltraEmbeddable.exeUltraEmbeddable.exe

pid	process
4160	BlitzedGrabberV12.exe
4664	mxfix.EXE
2628	UnityCrashHandlerV2.exe
3700	BlitzedGrabberV12.exe
3392	WindowsInput.exe
6088	WindowsInput.exe
2212	chromedriver.exe
5260	svchost.exe
5996	chromedriver.exe
5388	svchost.exe
1404	UltraEmbeddable.exe
5140	UltraEmbeddable.exe

Loads dropped DLL 1 IoCs

Processes:

BlitzedGrabberV12.exe

pid process

3700 BlitzedGrabberV12.exe

pid	process
3700	BlitzedGrabberV12.exe

Obfuscated with Agile.Net obfuscator 33 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/3700-308-0x0000000005750000-0x0000000005942000-memory.dmp	agile_net
behavioral1/memory/3700-345-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-347-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-365-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-379-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-375-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-377-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-373-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-371-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-369-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-363-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-361-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-359-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-357-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-355-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-353-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-351-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-349-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-367-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-343-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-341-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-339-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-337-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-335-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-333-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-331-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-329-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-327-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-326-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-323-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-319-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-321-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/3700-318-0x0000000005750000-0x000000000593E000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mxfix.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	mxfix.EXE

Drops desktop.ini file(s) 2 IoCs

Processes:

UnityCrashHandlerV2.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

52 raw.githubusercontent.com
120 discord.com
121 discord.com

flow	ioc
52	raw.githubusercontent.com
120	discord.com
121	discord.com

Drops file in System32 directory 3 IoCs

Processes:

UnityCrashHandlerV2.exeWindowsInput.exe

description	ioc	process
File created	C:\Windows\SysWOW64\WindowsInput.exe	UnityCrashHandlerV2.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	UnityCrashHandlerV2.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Drops file in Windows directory 3 IoCs

Processes:

UnityCrashHandlerV2.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe
File opened for modification	C:\Windows\assembly	UnityCrashHandlerV2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

6000 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1500 1404 WerFault.exe UltraEmbeddable.exe
5280 5140 WerFault.exe UltraEmbeddable.exe

pid	process
6000	powershell.exe

pid	pid_target	process	target process
1500	1404	WerFault.exe	UltraEmbeddable.exe
5280	5140	WerFault.exe	UltraEmbeddable.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

msedge.exe7zFM.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{45A9CEF1-9BF4-4976-A830-1E4C79AA5D07}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	7zFM.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

3316 NOTEPAD.EXE

pid	process
3316	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe7zFM.exepowershell.exesvchost.exechromedriver.exe

pid	process
3744	msedge.exe
3744	msedge.exe
3968	msedge.exe
3968	msedge.exe
4776	identity_helper.exe
4776	identity_helper.exe
2748	msedge.exe
2748	msedge.exe
4780	7zFM.exe
4780	7zFM.exe
6000	powershell.exe
6000	powershell.exe
6000	powershell.exe
4780	7zFM.exe
4780	7zFM.exe
4780	7zFM.exe
4780	7zFM.exe
4780	7zFM.exe
4780	7zFM.exe
4780	7zFM.exe
4780	7zFM.exe
4780	7zFM.exe
4780	7zFM.exe
5388	svchost.exe
5388	svchost.exe
5388	svchost.exe
5388	svchost.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
2212	chromedriver.exe
5388	svchost.exe
2212	chromedriver.exe
5388	svchost.exe
2212	chromedriver.exe
5388	svchost.exe
2212	chromedriver.exe
5388	svchost.exe
2212	chromedriver.exe
2212	chromedriver.exe
5388	svchost.exe
5388	svchost.exe
2212	chromedriver.exe
2212	chromedriver.exe
5388	svchost.exe
5388	svchost.exe
2212	chromedriver.exe
5388	svchost.exe
2212	chromedriver.exe
2212	chromedriver.exe
5388	svchost.exe
5388	svchost.exe
2212	chromedriver.exe
2212	chromedriver.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exechromedriver.exe

pid process

4780 7zFM.exe
2212 chromedriver.exe

pid	process
4780	7zFM.exe
2212	chromedriver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

msedge.exe

pid	process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

7zFM.exepowershell.exechromedriver.exesvchost.exesvchost.exeAUDIODG.EXE

description	pid	process
Token: SeRestorePrivilege	4780	7zFM.exe
Token: 35	4780	7zFM.exe
Token: SeSecurityPrivilege	4780	7zFM.exe
Token: SeSecurityPrivilege	4780	7zFM.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	2212	chromedriver.exe
Token: SeSecurityPrivilege	4780	7zFM.exe
Token: SeDebugPrivilege	5260	svchost.exe
Token: SeDebugPrivilege	5388	svchost.exe
Token: SeSecurityPrivilege	4780	7zFM.exe
Token: 33	3340	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3340	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zFM.exe

pid	process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
4780	7zFM.exe
4780	7zFM.exe
4780	7zFM.exe
4780	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

chromedriver.exeBlitzedGrabberV12.exe

pid process

2212 chromedriver.exe
3700 BlitzedGrabberV12.exe
3700 BlitzedGrabberV12.exe

pid	process
2212	chromedriver.exe
3700	BlitzedGrabberV12.exe
3700	BlitzedGrabberV12.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3968 wrote to memory of 624	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 624	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 1292	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 3744	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 3744	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe
PID 3968 wrote to memory of 5792	3968	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/BlitzedOfficial/BlitzedGrabberV12
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d51846f8,0x7ff8d5184708,0x7ff8d5184718
2⤵
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
2⤵
PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
2⤵
PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:5240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5496 /prefetch:8
2⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
2⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
2⤵
PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
2⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
2⤵
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
2⤵
PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5564 /prefetch:2
2⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
2⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
2⤵
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5544 /prefetch:8
2⤵
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5884 /prefetch:8
2⤵
- Modifies registry class
PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
2⤵
PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
2⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
2⤵
PID:512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2504

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\BlitzedGrabberV12.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4780

C:\Users\Admin\AppData\Local\Temp\7zOCA275B38\BlitzedGrabberV12.exe
"C:\Users\Admin\AppData\Local\Temp\7zOCA275B38\BlitzedGrabberV12.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4160

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6000

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
PID:2628

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uewher5f.cmdline"
4⤵
PID:2440

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE9B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAE9A.tmp"
5⤵
PID:2936

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe" --install
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3392

C:\ProgramData\Chrome\chromedriver.exe
"C:\ProgramData\Chrome\chromedriver.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2212

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe" /launchSelfAndExit "C:\ProgramData\Chrome\chromedriver.exe" 2212 /protectFile
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5260

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe" /watchProcess "C:\ProgramData\Chrome\chromedriver.exe" 2212 "/protectFile"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5388

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3700

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOCA2714D8\README.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:3316

C:\Users\Admin\AppData\Local\Temp\7zOCA23FF98\UltraEmbeddable.exe
"C:\Users\Admin\AppData\Local\Temp\7zOCA23FF98\UltraEmbeddable.exe"
2⤵
- Executes dropped EXE
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 880
3⤵
- Program crash
PID:1500

C:\Users\Admin\AppData\Local\Temp\7zOCA28FA69\UltraEmbeddable.exe
"C:\Users\Admin\AppData\Local\Temp\7zOCA28FA69\UltraEmbeddable.exe"
2⤵
- Executes dropped EXE
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 872
3⤵
- Program crash
PID:5280

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:6088

C:\ProgramData\Chrome\chromedriver.exe
C:\ProgramData\Chrome\chromedriver.exe
1⤵
- Executes dropped EXE
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1404 -ip 1404
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5140 -ip 5140
1⤵
PID:1172

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f0 0x324
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3340

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
397120f5a71b2f5fb31a42656d2d7e49

SHA1
6f0ff453d0b5da25cd8f11b160eab8f968ecb04e

SHA256
709c26e563c871ea66a712420bd8fd08a35dccce42ba58edf816941c081e844c

SHA512
3e9336fb2fb54bbf21de3be2df33d50d3efe4a8640283278d0fe9fcbf084d9360cace0f42299f4b570a1ec36295f2b90f1bac490b3fb45543d55b239e88a21a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
12fe095c7beb9e61412cbf7248962a3b

SHA1
59c6d5e6111592bb985a59750ae761fa72929094

SHA256
700be6e264e2466fbb562200d442712fe78988213038c2674189c7623e785e5f

SHA512
fe27996ae6721b7adae6765bee6327f3902cdda01ef3d5b7303ccd5d32e6e88b5d059114a8288f5cda137bff61fa6780aab573bc998648fbdc40e4e700497e22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
4b66e372540d01e6c410f3e7d9d24107

SHA1
776d31ac11e9db4341f64604984925c3b8799880

SHA256
4938c0302c4dc438c44c62d9f0990d39e4fae6fd8680a0e0a83820eed54589a0

SHA512
a55004661c39ed235b66bc171715c2c3ed55a43148082b827c93362968d91823f7ab1ac88f245620c613caa7be13df74a7aafa1f89df8496784422d262a0eede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
358B

MD5
8096c6fda10904aabeb07f339e1d36c8

SHA1
50bb52158acd9b2113640866af009b1460629737

SHA256
6ffd1fbd47451c45209c555fdc13fc91fdaa0e78017f938e83f55d4eac70790e

SHA512
c1921eb71c846300e1f8ddf85d41c504a5f67ae3e7e8b740dad2c6f23428805ad782c1b228efb583a2e34e3fda76ffc9c17fd2bd5fa5a255e9ed1285f7d3e72c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1001B

MD5
e67cdc28bc67d278dad45fe115a3ad47

SHA1
eb4f88169c316f5d7a04b79df54131c866afeb77

SHA256
cfd70a86c44a74e29f27ba7eb52b384289d80450394844ec22b5e26a42a67079

SHA512
7deccc14f01c0c3f7ebad0da30baceffaab78f8914ef0eaf5424f402a3430d3f65682f58eed6003c66d6b3cddb9ffb58dee4bc808936ce0d97ba614aab561881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0bed0996dcae814b3dd3c0f9022e5664

SHA1
06be915f6f5be50251ba88709da4ea2e484ab5a3

SHA256
68dbf834ff9cf2ef57c8cceb4e0efbadf973a9e27969b74062c744cbe431ac7f

SHA512
c67dc7f3271cf84bdef4d7b4334313b6bef36d708a412eaecbf1c380a4560715c57a60cc1d156c83033bface7214824e2a47f267d18861e4bc4b8b78a818c1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
cc4cc89856b60d0a9e47a9d6b4f22700

SHA1
265747b649d48a02ff532faf13baa38fe0ba56f8

SHA256
60f716bec1a67609be0f67bfc1b4d8624dc2ca267a6663f665876cf14bef97d4

SHA512
79d8dcf376f39ca869b0afa600b848e56de0ec8c62e02e11db9f6ccfa4eb4de33efc4d1931490f56f86b74d62e477898271388b3787c1f50f7bf44a3c51da7e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1818969041644c6aa024e64b638c3ed8

SHA1
fd3dfe0ee2c502e9a236bf33f6d2e9e3188a4609

SHA256
745d18dc137992888aafb553e05b685e089108d7f88bd46dd91a2a17a22514a8

SHA512
420575b7d03fdcbe4ffb5338c18f2a3a36ce1f81bccc07261570ace0aa35f8d3eb73faf59a368d54625d3b2cf8675a60cb91213f8df3b05ff6012417bf4fb382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
d0fe6230169b6d46a068a2b0423fac6d

SHA1
2b90df48024717e067885b26ba5be0a94cb48c64

SHA256
25cda71e10aaf5d482fbf53eb2ee01d3f1e64e4dd24cd8481c2da1b5bf7207d7

SHA512
39457dd048ab06f7c9818299e37afd89ca85d15096bf5d74919823fd8dd37cfa9b9caafa6da731f77f92fd4557f175f43a5ff76e7e086aca1e7e451491b8b9e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
706B

MD5
4a442db49333a17d4f3a02e2a9adfad0

SHA1
c95abad6cbfaaa6df22ad70190598da5ec93c7be

SHA256
db662b7ff1db4e6e5d0228c4e1a69b76d5020f8c5adc7ac1569e9d845f434995

SHA512
fe7dca2c7f03d572027922a61a39d26b2b5709df9fabb2123cc210a63673d71fa7dd02fcaad28cff9a69d72b4130f03158cb43e4fceb5b9ebbca8733284f51bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
f0cc260e48820c5db1d8e81f51b4d3e5

SHA1
ba5f201f7af0c3366134767c292436d331d2767e

SHA256
1052baef74594077a7e5c7da438d6b83852dfdec2d520bc49986186e8d49e1ea

SHA512
3ee9d1c7fa30b775cceb17f3778358c2b8df30c3f5fd1c0ea7268a9aa464383b8c7083588ab34a7f7035591ff0fe38b4b7a4c68b514f13b51eb6e804a3203093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
22ca8747bb1d64a1053936457ca3fd18

SHA1
732c54c933d4bfa68a122cbad192741777310f87

SHA256
fa7becb55f60748a0ad234412a3f498afe62cfe233eca13c2944c59627e12514

SHA512
42b46183aa893401f25c011cdaf2cbfde9494e5b165826af4f005e4e867211314f3f6740ae59f17c2b8eaf3c6081a8f9ad2a6e1e3ddfd1b693f8cfb4df9740ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
304ac30cc63984d7a96b42e099bd530a

SHA1
f26f1c4e2e4d3ef018d4482862f304576bef42ef

SHA256
c9565f64b267accf7c2977f34a86c6c1500e3fb808c39e4e336646a75790b337

SHA512
773e19e2f3c87a43e9b5ac8109aa5d54c0375f5e7a49d1010471d9fd0a6ac6996449abc27b98cdd85869a7bbc6258eba56482ac478296fa0ee8dabcfdb4c8bc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
928393be9f4a1095e3ac651d3641b877

SHA1
b532c10506f21651c4da426dc8ee1eb738170d96

SHA256
154ce7c565c066f1a0f509c5cfa00634eee3c889f2871805bab42d83f64c41fd

SHA512
0153d5dd86642a794c62d6379056f80098afbce66cbf6f43623e0998bce48b0c6a7527be6df6d23ce963d2cb873e057116c086ee7b38f1ed4c5becb35f6666b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
17a4c479660256461f44caa15c665d14

SHA1
3fd0c1595e78db00ed1418ea5d685aa06c6f963e

SHA256
1eb279344eb0d876ea7abbc74f237436e680e57ad01c05375880fc0df69f9cdb

SHA512
1dbd9cf5b32706791ee987512d2bf5bc1989085035a05646e1fcadc512a97a8597cc1d6534a5e8a86b9b1b72a8d975841a87940ae769432502fe3850c08402ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
e2d02e8d6d3049e3aac78273c8b1b419

SHA1
62d741f56ea7811a5e96ccfe7a872b882c4d7a3e

SHA256
d6d8e4dce1bbc6e66d692f9bfa8952af4bb679eb6ce96bbce8f769e8ff0be7cc

SHA512
21817d3de22f0f9dba30bbf616d7bd790544e5dbe19074166a2e7b95c4ca6a10eb4f5abf92fca9fd47b16c650c086f10b16e341425d9298ec0aabb7be11e4de1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5793c4.TMP
Filesize
538B

MD5
6c32ddd8426e32aa28ec954e0ddeee34

SHA1
d67f30e024893c81d864bb8660c48f7cbac38035

SHA256
e212c59990b0c3b64198ddb9f3572c475f8d9a86a00c1deda4402e07ceaeee7e

SHA512
9b342a664d79d44ee76ee410b749f4c7fa6fc09c2f98e10fbdf98a7269986662b033a5479a63c54860c913952a93bd1fc4d74bd8b86171c7af16d187a28b5c01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
f832dfbd9c17f35372b17a301bfe1eec

SHA1
2281b45f29de0803663c2f56d593cf17360ffc38

SHA256
58bfae23399eddbb9ce27e39f8eafe87b9ae66b2190fb86a879405de1497030c

SHA512
c1953a68f26b1275096fb8cb088891167d3cbb1136fcc43ad184bd3d4f13154d4b58d4830344307e9a80fec3fb9175abf1a3c9381e5934eeb72770036753d11b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
9df2198a71ad38ecdb2a1546960af67c

SHA1
94c77ea1fb2abd18b4f599795ba20f2ceaf0c63c

SHA256
8a105ab108789c72bfdd4363a401569fe2302b2974b546feeccccac753914f24

SHA512
3745e55a644a7c4a798a281692149c822f317698b7c1704e277e20c107e92d4bb8b7d7a6c70e5edeef2b081af98f76ed6937a59054790ca612635b831854f8c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
79dd10fef5eec6037d9981f6edecf043

SHA1
aa70160f2ac3e321a3baf01aedc93d916271607f

SHA256
4c5fdaddc88132148b8e753f0aaed1fe13b48ec60ac553cb09f1dcde615b9d03

SHA512
6e84906fadaaa59bd2a1ffb1ba9ad389d38dff66190865825d40c78d1581c73126232252e380a476250b1aa86ba3b8d42d0e6f693d40b2c2770940b561d4791c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOCA23FF98\UltraEmbeddable.exe
Filesize
465KB

MD5
b6b77d0798d39d7fadd69784c4e47c30

SHA1
967af699bd9e0f2f20b0743323e5cdd6c3767ea2

SHA256
e5c9880090d757207a5cd373f5e1d20c42d7486c742b3a30a2ee741a7aef5ef8

SHA512
5140dcebbeb53c8e74364de824d78d6c5fddcfa08f0ac38ff0d898e71bf4f8630f3b529571a7f64be00981e83af7f85a9b6665aedfaf7f0720995fae8a8e28d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOCA2714D8\README.txt
Filesize
1KB

MD5
110a464be52a150056f184348f09a6c6

SHA1
c7516032dbae3d9e3c0342da0bd690318b93be6f

SHA256
97b778580fd7487beb8062a777a654b718a3b16622d8bcf46594ac9048dd3e6a

SHA512
04c97df944b110f6c481f2b06b406d7ba5b2b3a6176a2527ae8b9820d925a341fd106e20dd3694353effa4f623c8eeb3f858de478ebc13fa6c68d6ab04db85cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
Filesize
1.6MB

MD5
228a69dc15032fd0fb7100ff8561185e

SHA1
f8dbc89fed8078da7f306cb78b92ce04a0bdeb00

SHA256
920bec9d500f6446b84399ab4c84858d0f0d7d1abb2e0377399ebbc4bafad709

SHA512
373621c4743fa72571b3c8375aa6f7852303a821558b016b002d2af07154787d978f66696db89eeed8fe41f4aed5d66b690d4f87469939f9b1dea2ac2b9101f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mxfixer.ps1
Filesize
35B

MD5
5d792fc7c4e2fd3eb595fce4883dcb2d

SHA1
ee2a88f769ad746f119e144bd06832cb55ef1e0f

SHA256
41eccaa8649345b33e57f5d494429276e9f2eb23ca981f018da33a34aabfd8eb

SHA512
4b85fe8205c705914867227c97aa1333421970d8e6f11b2ac6be8e95fef1a0f31f985547eafe52e382f13c2a16afa05462bd614b75bee250464c50734d59a92e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAE9B.tmp
Filesize
1KB

MD5
6191d32334e5ddf3c0c27b5f79169062

SHA1
9c2f961629494ef4a3352ac64981d5e7c4d242b3

SHA256
dddb4b315c2831d5c9909544e2a70312de814fae169472c0e050187099d04676

SHA512
eff46a64428d7eb38af514a60cadfb15a76a0c1dac936d1574977d8d82b1ee31f2c729453b5e58213907f1dfb8a09e1a4a3264fbf884e7ef90076b68bae464b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
Filesize
6.0MB

MD5
3926c7b8fdfb0ab3b92303760b14d402

SHA1
b33e12ef4bdcd418139db59d048609c45fe8f9eb

SHA256
c101904ec19b45612213c2b398892a4523f63862bb3e24c245509db2417585e7

SHA512
4a022be27f58b1735f3a0ac9abdedbd769adb4e3ca1dacdcdc98700b17e138b647f9059585c8ef37fdd7072ad6283e95f10def171584097eb8c70e7d1212ce0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ezt10bt3.w1w.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcfb00f9-5ae7-4197-ba59-e48107e40d35\GunaDotNetRT.dll
Filesize
136KB

MD5
9af5eb006bb0bab7f226272d82c896c7

SHA1
c2a5bb42a5f08f4dc821be374b700652262308f0

SHA256
77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

SHA512
7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

Download Submit
C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
Filesize
155KB

MD5
b4ec612c441786aa614ce5f32edae475

SHA1
3a264f8daeec9b156ddb5ed576d490dd8fbd8e7d

SHA256
e18ba6573b9aa2d139ed5c30f18ac2ece3ce8287d1651db4bc632dbc816f53bd

SHA512
c6800371cdc2b571061e6e755a2c95f49dcb233c3999976f180cb7cf95fa2c62d03b52a3c497a2cd7ae46ec72eaf823db25bd291ca676724194c05966f2bce16

Download Submit
C:\Users\Admin\AppData\Local\Temp\uewher5f.dll
Filesize
76KB

MD5
a2c40d3a1086a78d528d4682b3296c77

SHA1
62ea20cfa5dc5e3894a7c581d38cbd3c9256695b

SHA256
d4fc45f5fc8ba781a2692c94541bd10bb52091183b42e45dd3ad7b48a98bdc70

SHA512
0f57f3a3dc86900b4bd165b355e4d515436cc2a1a1f61c7e59e2485cf1678bad28f6a059e4f03f1429a4533f5625f3fe8e655e1e2606a00f5a3e22b171a22468

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 99939.crdownload
Filesize
3.6MB

MD5
4282ce784621bf22365f21260be70e5e

SHA1
3e743738e2ec8cc35d64ebbad99abcfde46eafe3

SHA256
06fa7e3221aa6f67eeefa8b807a6abb0b4c385d7eb61434ccec55ad2a5d3a1dd

SHA512
aa776cfdc39c152814a7e0e6def451454ca30fc4388dec48f3d12b1e50a0ee3925bfd2333700919b52af725cfe7ece93146ba24a9c0d2a6c0d602f7b243b77ec

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe
Filesize
21KB

MD5
e6fcf516d8ed8d0d4427f86e08d0d435

SHA1
c7691731583ab7890086635cb7f3e4c22ca5e409

SHA256
8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

SHA512
c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe.config
Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCAE9A.tmp
Filesize
676B

MD5
fdc0ddb7ad5dfcc5a6f4754587196c30

SHA1
fcb9e44cba3f042b672a2ffebe5fcc9d0a3d2697

SHA256
981cdf2a55cdb542b5cec957b22aaa5405026f3eea67430c71be81949e8975d1

SHA512
a1362306da0e47091ade5bb1c91f50ef61ef403325bd51dddf66cbf5911f603040c24e4f6e0e495c88762966261b91d98ee4ee629ffaa1b74ffc397f547e83ba

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uewher5f.0.cs
Filesize
208KB

MD5
9fda52d737e56facee46407b51d4ceb9

SHA1
11e4b1628af6d9d9a923a16304d245737e665c49

SHA256
fb81fede19f89a22edb84326f085812bdbb38cfb61d4356862e69e3e9134d9ac

SHA512
47f8332c4e85aed02e0e2c26f3e42ab364ca055a949dc807bee75c6198b22136bab01aa7a9625d05fe1fdb3361fa63da34868a412a1024abc2714640f19e4a5f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uewher5f.cmdline
Filesize
349B

MD5
55cb3fc5fb967e63fba73c434b552af8

SHA1
6f7def5c2b9d6fd1d7bbb94bd911624bf8a47b5c

SHA256
f166ccc75d6181a1a44da18f2818e80bf06d937ccd1e8956edc36e7e0d8416ed

SHA512
4d693509ce171f58fcef818ea6738ba0816b89b3d1bc5853a99911435d47858576ca72a939aaff71ecdd64ef67b6926f84043ac154fcf0c22e4898eee4e0135c

Download Submit
\??\pipe\LOCAL\crashpad_3968_OJVJWAZHRZWQWCLH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1404-4391-0x0000000000DF0000-0x0000000000E6A000-memory.dmp

Filesize
488KB

Download
memory/2212-2156-0x000000001C170000-0x000000001C180000-memory.dmp

Filesize
64KB

Download
memory/2212-2189-0x000000001C350000-0x000000001C512000-memory.dmp

Filesize
1.8MB

Download
memory/2212-1451-0x0000000000DE0000-0x0000000000EDC000-memory.dmp

Filesize
1008KB

Download
memory/2212-2140-0x000000001BBF0000-0x000000001BC08000-memory.dmp

Filesize
96KB

Download
memory/2212-1806-0x000000001BB90000-0x000000001BBDE000-memory.dmp

Filesize
312KB

Download
memory/2212-1800-0x000000001B9D0000-0x000000001B9E2000-memory.dmp

Filesize
72KB

Download
memory/2628-304-0x000000001C690000-0x000000001C72C000-memory.dmp

Filesize
624KB

Download
memory/2628-627-0x000000001CD90000-0x000000001CDB0000-memory.dmp

Filesize
128KB

Download
memory/2628-623-0x000000001C760000-0x000000001C776000-memory.dmp

Filesize
88KB

Download
memory/2628-303-0x000000001C120000-0x000000001C5EE000-memory.dmp

Filesize
4.8MB

Download
memory/2628-302-0x000000001BC40000-0x000000001BC4E000-memory.dmp

Filesize
56KB

Download
memory/2628-626-0x000000001B920000-0x000000001B928000-memory.dmp

Filesize
32KB

Download
memory/2628-625-0x000000001B9A0000-0x000000001B9B2000-memory.dmp

Filesize
72KB

Download
memory/2628-299-0x000000001BA40000-0x000000001BA9C000-memory.dmp

Filesize
368KB

Download
memory/3392-643-0x0000000002490000-0x00000000024CC000-memory.dmp

Filesize
240KB

Download
memory/3392-642-0x0000000000B60000-0x0000000000B72000-memory.dmp

Filesize
72KB

Download
memory/3392-641-0x0000000000370000-0x000000000037C000-memory.dmp

Filesize
48KB

Download
memory/3700-318-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-365-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-353-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-359-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-349-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-367-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-343-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-341-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-339-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-337-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-335-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-333-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-331-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-329-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-327-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-326-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-323-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-363-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-317-0x00000000737B0000-0x0000000073839000-memory.dmp

Filesize
548KB

Download
memory/3700-321-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-361-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-357-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-351-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-295-0x0000000000990000-0x0000000000B3C000-memory.dmp

Filesize
1.7MB

Download
memory/3700-319-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-369-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-371-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-373-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-296-0x0000000005980000-0x0000000005F24000-memory.dmp

Filesize
5.6MB

Download
memory/3700-377-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-375-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-12080-0x00000000065A0000-0x000000000663C000-memory.dmp

Filesize
624KB

Download
memory/3700-12097-0x00000000714A0000-0x00000000714D7000-memory.dmp

Filesize
220KB

Download
memory/3700-379-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-355-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-347-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-345-0x0000000005750000-0x000000000593E000-memory.dmp

Filesize
1.9MB

Download
memory/3700-314-0x00000000714A0000-0x00000000714D7000-memory.dmp

Filesize
220KB

Download
memory/3700-308-0x0000000005750000-0x0000000005942000-memory.dmp

Filesize
1.9MB

Download
memory/3700-307-0x00000000053D0000-0x00000000053DA000-memory.dmp

Filesize
40KB

Download
memory/3700-298-0x0000000005470000-0x0000000005502000-memory.dmp

Filesize
584KB

Download
memory/4160-247-0x0000000000160000-0x00000000003A4000-memory.dmp

Filesize
2.3MB

Download
memory/5260-2999-0x0000000000CD0000-0x0000000000CD8000-memory.dmp

Filesize
32KB

Download
memory/6000-285-0x000001E222C30000-0x000001E222C52000-memory.dmp

Filesize
136KB

Download
memory/6088-648-0x000000001A830000-0x000000001A93A000-memory.dmp

Filesize
1.0MB

Download