growtopia | 965e26ab119bb1fe78e0f2e9f3a4b85de6b308100faa6c12dd6aa60ee52f42ef

Analysis

max time kernel
106s
max time network
108s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
11-05-2024 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GX_Builder.exe
Size

12.9MB
MD5

de6416915830c63685b6771684689d36
SHA1

f3516b1816295056c870e3c15a52aafbf4e9aab3
SHA256

965e26ab119bb1fe78e0f2e9f3a4b85de6b308100faa6c12dd6aa60ee52f42ef
SHA512

7efb6ba401dad084f2e7aa0af834171724168f2bd28da2d28fd3c1083b6286b262f352fe6dac703eacb5624f8b810918293d563353dafd85ac96532da61f25a7
SSDEEP

393216:oNOnxeqv5yEgPDflLNVga2D3o5Doo7Mm:0OnxD56DtLzGD3ohoo7Mm

Score

10^/10

growtopia xenorat zgrat evasion execution persistence pyinstaller rat stealer trojan

Malware Config

Extracted

Family

xenorat

jctestwindows.airdns.org

Mutex

Xeno_rat_nd8913d

Attributes

delay
5000
install_path
temp
port
45010
startup_name
WindowsErrorHandler

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 29 IoCs

resource	yara_rule
behavioral1/memory/3636-58-0x00000000051A0000-0x000000000520C000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-81-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-119-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-117-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-115-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-113-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-111-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-109-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-107-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-105-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-103-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-101-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-99-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-97-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-95-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-93-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-91-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-89-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-87-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-85-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-83-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-79-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-77-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-75-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-73-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-71-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-69-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-67-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1
behavioral1/memory/3636-64-0x00000000051A0000-0x0000000005205000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
560	powershell.exe
4648	powershell.exe
3120	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 8 IoCs

pid	Process
3636	Ilkdt.exe
4860	WinHostMgr.exe
3624	WinErrorMgr.exe
3792	Sahyui1337.exe
4352	KeyGeneratorTOP.exe
2352	WinErrorMgr.exe
5204	KeyGeneratorTOP.exe
920	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

pid	Process
5204	KeyGeneratorTOP.exe
5204	KeyGeneratorTOP.exe
5204	KeyGeneratorTOP.exe
5204	KeyGeneratorTOP.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
104	pastebin.com
117	pastebin.com
18	discord.com
19	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
77	api.ipify.org
113	api.ipify.org
173	api.ipify.org

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 920 set thread context of 2652	920	bauwrdgwodhv.exe	168
PID 920 set thread context of 6008	920	bauwrdgwodhv.exe	173

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3420	sc.exe
5456	sc.exe
5776	sc.exe
6108	sc.exe
5464	sc.exe
2716	sc.exe
2144	sc.exe
2128	sc.exe
5612	sc.exe
2300	sc.exe
4480	sc.exe
3060	sc.exe
3720	sc.exe
4856	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000300000002aa2e-66.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1216	schtasks.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
3792	Sahyui1337.exe
3792	Sahyui1337.exe
560	powershell.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
560	powershell.exe
4064	msedge.exe
4064	msedge.exe
2396	taskmgr.exe
5752	msedge.exe
5752	msedge.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
1660	msedge.exe
1660	msedge.exe
2396	taskmgr.exe
2396	taskmgr.exe
2352	WinErrorMgr.exe
2352	WinErrorMgr.exe
2352	WinErrorMgr.exe
2352	WinErrorMgr.exe
5988	identity_helper.exe
5988	identity_helper.exe
2396	taskmgr.exe
2396	taskmgr.exe
2352	WinErrorMgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2396	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	taskmgr.exe
Token: SeSystemProfilePrivilege	2396	taskmgr.exe
Token: SeCreateGlobalPrivilege	2396	taskmgr.exe
Token: SeDebugPrivilege	3792	Sahyui1337.exe
Token: SeDebugPrivilege	3636	Ilkdt.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeDebugPrivilege	2352	WinErrorMgr.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeShutdownPrivilege	5980	powercfg.exe
Token: SeCreatePagefilePrivilege	5980	powercfg.exe
Token: SeShutdownPrivilege	5552	powercfg.exe
Token: SeCreatePagefilePrivilege	5552	powercfg.exe
Token: SeShutdownPrivilege	2884	powercfg.exe
Token: SeCreatePagefilePrivilege	2884	powercfg.exe
Token: SeShutdownPrivilege	5404	powercfg.exe
Token: SeCreatePagefilePrivilege	5404	powercfg.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeShutdownPrivilege	4544	powercfg.exe
Token: SeCreatePagefilePrivilege	4544	powercfg.exe
Token: SeShutdownPrivilege	1864	powercfg.exe
Token: SeCreatePagefilePrivilege	1864	powercfg.exe
Token: SeShutdownPrivilege	1096	powercfg.exe
Token: SeCreatePagefilePrivilege	1096	powercfg.exe
Token: SeShutdownPrivilege	2912	powercfg.exe
Token: SeCreatePagefilePrivilege	2912	powercfg.exe
Token: SeLockMemoryPrivilege	6008	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe
2396	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 560	1296	GX_Builder.exe	86
PID 1296 wrote to memory of 560	1296	GX_Builder.exe	86
PID 1296 wrote to memory of 560	1296	GX_Builder.exe	86
PID 1296 wrote to memory of 3636	1296	GX_Builder.exe	88
PID 1296 wrote to memory of 3636	1296	GX_Builder.exe	88
PID 1296 wrote to memory of 3636	1296	GX_Builder.exe	88
PID 1296 wrote to memory of 4860	1296	GX_Builder.exe	89
PID 1296 wrote to memory of 4860	1296	GX_Builder.exe	89
PID 1296 wrote to memory of 3624	1296	GX_Builder.exe	90
PID 1296 wrote to memory of 3624	1296	GX_Builder.exe	90
PID 1296 wrote to memory of 3624	1296	GX_Builder.exe	90
PID 1296 wrote to memory of 3792	1296	GX_Builder.exe	91
PID 1296 wrote to memory of 3792	1296	GX_Builder.exe	91
PID 1296 wrote to memory of 4352	1296	GX_Builder.exe	92
PID 1296 wrote to memory of 4352	1296	GX_Builder.exe	92
PID 3624 wrote to memory of 2352	3624	WinErrorMgr.exe	94
PID 3624 wrote to memory of 2352	3624	WinErrorMgr.exe	94
PID 3624 wrote to memory of 2352	3624	WinErrorMgr.exe	94
PID 4352 wrote to memory of 5204	4352	KeyGeneratorTOP.exe	95
PID 4352 wrote to memory of 5204	4352	KeyGeneratorTOP.exe	95
PID 5204 wrote to memory of 5752	5204	KeyGeneratorTOP.exe	97
PID 5204 wrote to memory of 5752	5204	KeyGeneratorTOP.exe	97
PID 5752 wrote to memory of 5820	5752	msedge.exe	98
PID 5752 wrote to memory of 5820	5752	msedge.exe	98
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99
PID 5752 wrote to memory of 4568	5752	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\GX_Builder.exe
"C:\Users\Admin\AppData\Local\Temp\GX_Builder.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAeQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAeAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAcQBsACMAPgA="
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:560
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4860
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1332
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4700
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2128
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3060
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5612
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2300
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:3420
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5552
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5980
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5404
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:5456
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5464
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:5776
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:3720
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmp150A.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:1216
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3792
- C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
  "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
    "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb38eb3cb8,0x7ffb38eb3cc8,0x7ffb38eb3cd8
        5⤵
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
        5⤵
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
        5⤵
        
        PID:2172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
        5⤵
        
        PID:5008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        
        PID:5980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
        5⤵
        
        PID:5216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
        5⤵
        
        PID:5888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
        5⤵
        
        PID:784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
        5⤵
        
        PID:3624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
        5⤵
        
        PID:5704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
        5⤵
        
        PID:1684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
        5⤵
        
        PID:1904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
        5⤵
        
        PID:4704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
        5⤵
        
        PID:2712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
        5⤵
        
        PID:5172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
        5⤵
        
        PID:6392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
        5⤵
        
        PID:6488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        
        PID:6580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
        5⤵
        
        PID:6980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
        5⤵
        
        PID:2524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
        5⤵
        
        PID:5568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
        5⤵
        
        PID:5836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
        5⤵
        
        PID:704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17761642938157259378,8099495148469604990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1672 /prefetch:1
        5⤵
        
        PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:3844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb38eb3cb8,0x7ffb38eb3cc8,0x7ffb38eb3cd8
        5⤵
        
        PID:3632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,5215226920381409638,11515706918806903121,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
        5⤵
        
        PID:6780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,5215226920381409638,11515706918806903121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 /prefetch:3
        5⤵
        
        PID:6788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,5215226920381409638,11515706918806903121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
        5⤵
        
        PID:6868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,5215226920381409638,11515706918806903121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:7108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,5215226920381409638,11515706918806903121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
        5⤵
        
        PID:7124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,5215226920381409638,11515706918806903121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
        5⤵
        
        PID:6404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,5215226920381409638,11515706918806903121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
        5⤵
        
        PID:6432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,5215226920381409638,11515706918806903121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
        5⤵
        
        PID:6636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb38eb3cb8,0x7ffb38eb3cc8,0x7ffb38eb3cd8
        5⤵
        
        PID:1720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13218549820584905392,7450113550579549702,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
        5⤵
        
        PID:1784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,13218549820584905392,7450113550579549702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
        5⤵
        
        PID:3524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,13218549820584905392,7450113550579549702,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
        5⤵
        
        PID:4944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13218549820584905392,7450113550579549702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
        5⤵
        
        PID:2212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13218549820584905392,7450113550579549702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
        5⤵
        
        PID:5956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13218549820584905392,7450113550579549702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
        5⤵
        
        PID:1604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,13218549820584905392,7450113550579549702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3368 /prefetch:8
        5⤵
        
        PID:6156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13218549820584905392,7450113550579549702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
        5⤵
        
        PID:6188

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1068

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:920
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5892
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5052
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4480
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4856
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2716
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:6108
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2144
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2652
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:6008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23da8c216a7633c78c347cc80603cd99

SHA1
a378873c9d3484e0c57c1cb6c6895f34fee0ea61

SHA256
03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3

SHA512
d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e4bf11ed97b6b312e938ca216cf30e

SHA1
ff6b0b475e552dc08a2c81c9eb9230821d3c8290

SHA256
296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad

SHA512
ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f7a15aa6e39468e75c5f252d6b9b431c

SHA1
8e584b83e9843af471b1ac72d18c5871186f2034

SHA256
59c8153a5f3fd78b8bd48039bb0f8606392e3efbea127cd7d23000cf29b260e8

SHA512
0261a66b33e1e7105d59d1f709b16c2ab7af632ed8c035b619b0c0b64c3afebc974d99c10588f3d5706eaa01a63d7b05a466c1825d58b8f9bfd62d8602f574f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0467a3e50e2754f0ced0ff2917ab5184

SHA1
8343e1cdda21e9048d27e1cff651a31f04e60649

SHA256
cc612ef0ed7eb7cd800b1ebc3fe84395785205cd9390a16f5008d380e4e8ce86

SHA512
573f82bb320569dfd49635f9dc407f2bcc2a293fb4ffe02b3d2aa448983fcb94bf02f48d4bd7a1e0bf47085166663caeb87e866d1478f3b741a165c45a92cf32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0763e674bc77e9bba17389f408e8069f

SHA1
06dd424be9a2e81e06b94f84cc2ee65258c19afa

SHA256
c81f9cb5fd5bdb8946366248f880a9c5c3a4b172f416d78a613097c5bb57cc21

SHA512
118a1403b6054b927d8f5b813ea942b588e23fdfb08debcbc742a811575c0ddd847636803be350fcbe4db2d484ccf754429a7d7ddc176128b54892349033dab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\678ecc96-ec5d-4f51-9485-db1f26b249dc.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
27KB

MD5
638a4990025383a0f83ebf29bdb84a68

SHA1
153e8818dc42f598e47fde8cf398f1447649a4d0

SHA256
878e34b89800bb271d3588e526eb3598eb3822e263f3bdaf53645847d39d0ad6

SHA512
59a505fa1a3bea1511e8fed16dced733299928b4081665d3e3fa4fc71d6f0ed0b09934805f442bf190c9093937e1494ac938167f9beaca0223243703f73efe87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
21KB

MD5
44129a82842153ef9b965abfb506612a

SHA1
c0964eb2ee1a76d48e4e09e31915415d74e18bbc

SHA256
8a3908fb32a414703eff3e435566b1e5598eb3a5d50c500e70eb1a5c20d003d7

SHA512
77d149f19343d765834f2bcaa02bc160c75bd42db1fc431aba87f78257a83c4c8a7e5953c247cb7cbbaf4ae44ace269eb0a5194dfd7489d66f69489ce5dd78d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
79KB

MD5
4123762ef38e85f3a1212ae71383982c

SHA1
c4fc4eb126f2e7f34da2ba2b28cf7ef8eca5e6a6

SHA256
8f788c9956422da6178ba49119ffd243d5c6d729399233632a7f724266a926e6

SHA512
5af2980aa79c5abd55f0b2d73a6084a798b81aa642771ca5d069e23fb2bbaf2c79e96b315138d00496c8f850a5325c4c62c2e30731fcc70d8f30ed058eb96ca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
626KB

MD5
490a9e7fcf2ef8545f7488719a5f2dcc

SHA1
89f8a54e8da3a78e1ce13aea6b1d0ca1e9e506c1

SHA256
bfd60a60f305cce7dc9828c1e61bcdfcd691eceabad36e5a1d6fb41768883037

SHA512
86099dbb0e8fd7c721f7afe2e3f15789cd8ead2253db3786b9dbe83ae81c4e7d43c0852491ef0de4f0fdad218300d89bdca46bfaa5a4533cf7c7b765b8af52ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
51KB

MD5
9d6bda2c7fb7012b24c61c2f490ba186

SHA1
093cefe87ac0b5588561dc3ae819ad7db2ac7b7e

SHA256
b86cbdcf45a0fd2889b1b3d5560e1db14f038a34c6660d625b53906170d2d3d7

SHA512
282147f43a3c0020ee04ea48f6edb7f9a7f0d0f8940fbfc4bc3d29d37196812a486f47940b1b655b82af4ac999c1b3e0fe282600d461598cbd80846816c1aeab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
37KB

MD5
94c64bbed99f81ece6385924f620d936

SHA1
da7b56f3251b1118eb42859187337bc5049edd7b

SHA256
a51b8c075bd06acd8f58ba498f67c2a6b29c1628bb42664949854edad19246bf

SHA512
9f45a89030761b43eac9825c51070f78e0a1b6dde0d82c7a01d050cd3581e1cc5064244cf92c6cd95991e52fd7b2908b52a5760efcdb3d25659a23fc546a29d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
64KB

MD5
1ae51838282c327420dc4a8405b4c06c

SHA1
08b38158f14c4ca61bb0f6c9444e4d149408fd56

SHA256
e849f38a7816ba120b646076d67b9f8fe00dc9fedfbba17d793b2b52c0b1b8a0

SHA512
a5bfa4fbd59bedb025cf69f53f72137d4fa2e55a3c41f2fc497317fcfab6fc2266690e1eb3ab343fae842ea36b49f431dd966fe31e1cbd1e02c904520d2e74ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
40KB

MD5
2a46072de87041da1c43b650fde847ca

SHA1
d4db2be15cb50de1df44a49da9bf70623a75dbc3

SHA256
dacc2122b07fdaa856f8fe1b09848df9624b56238d2bbcfa5c5e1bedfaa59c0b

SHA512
a28cbc6470facb67d47f173f4a1e2d05ffa8d8e832c4f8f467667be0fa3a038cdad01abd460c6f479fb283fde0dcc360174c3271b26ba99c2e31b34afb71a1ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
70KB

MD5
77c287dc474cecb1f9b509c0e22c1354

SHA1
536fe1c48a13cc6feee48fb7f3f27f62b7d3acdc

SHA256
1c039054cb9102c0a89ea6b42d472e63f381fce68e4829afb77a66486b27951e

SHA512
cad7603aefd072521159a8bef3b38382dcfbbd46277958b720694cb4edefd0d972704f0b9b2756b905d953e0af66a41134a42c03a123904a00593f8897c1cd18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
139KB

MD5
f6b5860b810ccb09f9614e7cc3eabf28

SHA1
da1aeddeddcf8b504764812a943e7615ae16c464

SHA256
9bbf730a6aab9ed28612ddafc679cdd8145d1c7d66a615575b4468f641c20741

SHA512
72d4ab58106cea516be9278c1fb1ac2c3d113826fa3cd158ef290523d326b7908db6ed8c31d4ed546915a779549d89c8911a4ce3fd052b7c866db645ecf6e9e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
96KB

MD5
aa185ab726fa4b54b81cbcd0c62d6774

SHA1
f1c4a3cad769bb138cf6a35542d9062b9c194f61

SHA256
b3661dc21cd52a507b0facd91875d8b3e5e1cfd7e6a15246ec0305adc8e94d29

SHA512
06e96234680520747ec974070e448f44c4bfd9185b5fac2035755e26b2bb0b3ecab0af07ee8eb1e6fd69c5477af9f0ebcea6a32dad1c152ea77931b26f76dd42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
50KB

MD5
cd2f3074326840d55a3c3ea1e99e83fe

SHA1
3a2e1d1a93506526ae3ed2b44d584af7771ff8d0

SHA256
9ec9f50ac6a5dfdf7ace0a047ab4e86a7f8ff297030f93f9b8b4e27c57fdaa51

SHA512
0685f7e50451e87f8d7d47f3373d653f7d6163ffa8ccd143a85b179d2c5c51cf494e8b5f7e561436c35bfb8ffb9304f0c49962a8bf7065830f0cc95281f4ae6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000050

Filesize
67KB

MD5
04274516b8bd01eefe872ac1f6d09eb9

SHA1
d954db7102f37bc195c7570eba4bea41b74f41d1

SHA256
a4a3b9561dbdf4ed6a60755b755ed4897c121e486849b325bef2409bb9c3080e

SHA512
51f6e7879d94a237ea26fbd8b9a61f2957670c82fe6c3736a11d18a83e017f679c2c4aa738f675d0ecbd87642395df465fcde4c34a2e4ba5a792f96f160587f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
29KB

MD5
5c0211294a185f493719b833ac2de716

SHA1
5011b2a529a0a30bbd5a349a7f9f1c7ff57218d0

SHA256
e30d8335e5123b12f319308fa61a2f60c09ca1a1f4728758847ead099ed846b3

SHA512
54c0f68dc39395690f172d3eac4685f2a965e8db2322d1be911d66cb8cd9910f38247222299a7bbf5a88bc83ef6fbd1334f19e01726f34c42860fa29cbcd9c3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
0f1503adbf12350a11779a7897a853c1

SHA1
b875aa58046b35fd6f140c4537987a67d32e3bd7

SHA256
f52405e1aa5d45aa5ae287c9852da8c0a6b82636657238c2ded09891a5750d11

SHA512
61892754dbf0eb2a72174951bb3f782aa6202096e2af8bb681b1195f2ecdd58e37d0eb071cf26c587f74b0dbdcabfcf6e61b7cb8922fb816f3d1dbbd2f6aad0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
95dedf4342e5f43bf177abccb8a5b951

SHA1
34ac19bc13287cb36c0100000727925eea3416d6

SHA256
e13a01da69361c184f0cd0ec12aa69c3a6aa72f243ceb9b3faf4e2325e19d8cc

SHA512
808ee212a02d29ea50e3d42ab2fc318a737fbb3515856204f3b913b7a09c0740d29ea167e0e2c3f0246cda9fde8ed55361c366afb7534f0d4732483f9d2de72c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
d2fab85d16b0d186dc571154e325ff0d

SHA1
04305dfc0b8d5025d27689e3833522c6678bda12

SHA256
ce1da11a5cf0e9560d705ddc19d4131a303b0c7a1ef63086e7f70be88fea1bc0

SHA512
8c1c23a9e83dfb86210690427e0d2ace0c0e8fe532222745370d2b57cf8a44edc74765195948e397b5a6fe58900ca9990469dd5f0513d1e3c22b2d87435957b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
bfeb2fa9c095cb02ac55445529813661

SHA1
eff88d658ff91f6a60bc75a3a820d8996570872f

SHA256
ce3a22097014223897cf2034f5a7982ff70ca7335c3aa9966f5669eebdfb8ac9

SHA512
b7514ea72970654af7c4f463af8a4a8c5ff31b3f1b95d4721503ee014530439d98546401b9d0cf217753525963df553cca70efdd669fe46b2a4389dbe736562b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
ca1afae3103b8c965a04eba011b989d1

SHA1
5ecd446eda8eb5af49dd324e37272b0b19e11878

SHA256
417bf3d4ad363fe99797c24366a47eddbc1bfb6879279ebbd380b7ae2af68bb3

SHA512
78ae00371aa3abe0b8204cb4eabd6507ebd5d6f2d9bbd2cf4e2b7cc4a63e9589cc31c424e533be5cf4b2fe3928896f5d8aed36e1fc19d6a12007d5449f44a07a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
a68856d909d36fc42f6287854f3a1074

SHA1
32104e532a57511fa1ed739e2857ac33d6954c3b

SHA256
8e103f8a86e6e4dc7830bc4d172e31a22c2401ae131f52827d8cbef4bddbdde2

SHA512
8b0436fd0662d2661f52f8ca5c1c56ded757ba2b230a302aea8f2dc3c53241265264a0d50131d49ce2f0817bcaf816750bba7715c0f99b8f4dbe10374fcc2ebd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d7ad57ec159dc63e0ae475295327c5f2

SHA1
b5886411568c28708e76ed10e8c1c4638cb23aa3

SHA256
65db2254d58ff6bcf214cfa30559ce10c1816a87b9be34872a3b8f7c0afc7824

SHA512
66e543da83870051d2d1ff7189b209f3607dc4c79487ee213d77f418bbaebc6ae7b045bff76bc5b452a5463fd0d1f0fdcea9c351b12d5701e4689b7cc25fea4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
10f1e2b9246285947f9823c37a34cfbc

SHA1
169efa1f71355fed687ed1cca9669c13aedf579a

SHA256
a0c85b2f741b27ab190932d754c48d04f4bd4ce4282e6ff1b3de48e67649822c

SHA512
48965915851bc01c1d819155d4ce6f6d900adb0471764537413c98f357175fe4f66d05fdc9771b3f9394b69270577affdd12d88478cf4661f80d648f7e2ead42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
c7cda039c19c90b2a4f371496c461304

SHA1
f3b5dfa9a2916e0423a1bf909abf832f4766284b

SHA256
7b62cbe9e814e9237409a01934f6ce2bff10f31b9e399955195afa7e084ae19c

SHA512
abde66b15a8b6d0d0beff8dd5673c08fdd9cb978c96211baa74edf3b5ed938bbee159fec5176779168d13055fe3a793257ed1fe7398390ddb56ba751cb2c37c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e77872b977964e6a816d95fa392d4fa3

SHA1
25aeec4b6d84dac0d21c1ff88c7ccf02236ca8a3

SHA256
ab653ed91509833b33ba22b21c4b17736718899d8f96e5c379da5a049634c0a9

SHA512
2f037b6fbfef57a2cf37b452c91c87274daec5503572048ef0ba3e5e45e7cf7e2d948cb02c0d052cd74e89d442450d2f1f57bcf6147d25175de1752078017ac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a3ad158a715c67d241a76220b4a3f48a

SHA1
782d1f10aadcff15e5055def6c8b66c8583b7ec4

SHA256
bba8aad64f09455c82b7995bcab026b70068be981080f84a2d3b8bed4c9fdb4e

SHA512
0cbf6196139af61c863daedcf7b24f59a3bd97d06b4e450e4065b471f861ddfb05bb58233eaf2b8d10eb2ff2dc6c1b7de5d0520a01e6c5d11e75778c2e7aafb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
97405792dd2f5d157a9f5b2ceb8e0a5e

SHA1
11ee9d4ae3b3471506eeac4ee1b805be62be1fd2

SHA256
cbc1f425476f6bc8cbbfc4d317603ce7842dac3a05796e76c7ffb695d3fcc701

SHA512
80ba6eaddfb2af4570aa66ec31f3c0101cf9b1f3f5dae6c224799d7a26f374d6a753a7c619a77fe7c1ada4e48d997343b6e89c149bfbc768400e2caa2e9da414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1475eabd740cb1d3254c419b76cc47d8

SHA1
93abb9a1a4fe8809d26ca5048005149aa6358fc6

SHA256
28707b1a038ecaac5dc75c7c8006564573cbf14af1d95c70ff9e22f2d2865a1e

SHA512
a31507c0f55275ef3854d25c428410d4341c67507cf3f9fce880ff1d8a06df9909a00b3df56b4b32be2748fea3d58596073f6248c6ed601da9c4c68d5cf2d9ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ee0425fc52cdf813abeaa3dba7ba9d96

SHA1
b4c745db19d3239c2a947d78b389920c18b1e2fb

SHA256
f7ebbc4c98cc87d024cc010706d0d0bc25c2aa9295ee90e8c69356369ca2ef00

SHA512
7e5756e0831fd2a7791431b4e7034c9cf01db27f4fa3d8111bbfbcab33b09eb42a2e5fb13d2cfa14060f4018f798b547463aeb4828d5f2c2607458131babea0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f613b2a0209e6caa969f2200318fea8b

SHA1
14d9a9869689070bbdd82278efbeeed084a4509f

SHA256
f68d23df9f888af8cfc52497d8aed3e3c5f9b851a26d9fdf4d7dd1aa3f1f48da

SHA512
a6a013f079f0ab5eaf414a7954aafced9ee7b1ab7481580c9d53e3061c741d22e77135d60e2d1046f917d5262776537e3a184810fcdf03b5b9d449d67ac17e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dfa60a98da1278f167316a5f9ce6db64

SHA1
b7a2e24db81ff7dea093a8a9f274032a5e7ea315

SHA256
f8688d89d6b9efcf2ace4fc750163e85c4c3d7f514667d59de58f5edcfedd065

SHA512
c5f6cf07ce7186fd6163e9aabf031de1b6361167fc6f910b1321c15a55715fb1b3c91597cc018698ad31c597e7fbd567ee2a4fcfcef6ab5f2597d30cf2d50e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
de689b5630b32022b7ab60d6264e0722

SHA1
d6255e7f4bee6e3ccb5a2335baacc522c2b8ce6f

SHA256
9bc0b43d665999d9bd4f250f24fba616b1990f743e9561656e6d109716890848

SHA512
123043597de9aa1f26dc24376ba6e12edcdf317e09b0fecd9914513c0cc1f45cc684e91104d512ce37bf0eb301e531e024bf0fd814ebecee954ed5c58a86cf62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
337e1a1bfd2ae893e6e312611178f92e

SHA1
bece654ee6ff1e0972825c5b7e4237f9cee99fb1

SHA256
a04bca558e8638cf10658271d8075b820d4a574fc0e486b6efcbd8979a47665f

SHA512
632586084c5a8dd7a4f809694a6b777aa13d7cd9a8f9495e0273be2cd43083ad8191fd8dfbacfffc4889b63143913fc04497042a291132095ea4c5251fe58123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e42eafd0efda2884ba36ebe0e6b44576

SHA1
944ddb7f00a7200feaf925bdf3685ada3fc03b76

SHA256
c09c86938edbfee49c94d4090ef0c92bc7cbed470c8d5874d55ccca234cc2117

SHA512
252c7f6d121ce753dd45c01f9bc393ac86679cb025f49d0c2232f020d09e99cd7227220e75fbfb4ebc4e39c8bc06f32de5e3f5c37a0c00f1be32f8fe62462265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\39fee900-230d-4b56-8565-c9de7b76a7b5\index-dir\the-real-index

Filesize
5KB

MD5
68a3731011e171c9bc12ee520cd36840

SHA1
944f7cb57f43de57fedcfe7c66a63149891ee02f

SHA256
8a5b3eaba631b6121a3f7cbab5f1c21f7e21b891982fdee0bd12874fd1bfcc92

SHA512
0d1793ff85072d6a06928456111aab119ff57cfd2db3b477af529e55ea848a18ce00e49ee6050d84dd855ea6bc2dc2c5f1a1ef8036c5fde353eb81820713f128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\39fee900-230d-4b56-8565-c9de7b76a7b5\index-dir\the-real-index~RFe58dd5b.TMP

Filesize
48B

MD5
7a196cd43927a34ef849a3cc88320542

SHA1
59bf36874410b979f0b28c56d0820b6276d6a3a9

SHA256
b484801403cd1c4908921a6ca384ae669e5e5c47cdd8d3131f362414a4cf20d8

SHA512
cd1c0c623a5edca0a2f7044cc2ec2d28f211338440ba8d7ca8cd62e6cfebcfbed303e37091cb71848883c25062acc1d1cf1de004254bfc2d3f1ed7f8ffd0b883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\bb64340a-df4b-46b6-adb4-2cb9bff25206\index-dir\the-real-index

Filesize
72B

MD5
ffc33023d569a6ca14a7c1492a1ee3b4

SHA1
8f1ab810c6cf11f56f7dc30c79927462072797db

SHA256
8c6fc6899e583723a94f3b1c9dfaf6cf520e45e942227ac45163145c2c302d7b

SHA512
30cc7662f80f44b2fd58d2028b72ef03e0d4f31e8b993f5fefdd5a61f625dbe228d9c0b0364b82633b6817dafa9d82503d70e8b068cf4ed6359bcaf9190296f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\bb64340a-df4b-46b6-adb4-2cb9bff25206\index-dir\the-real-index~RFe58dd5b.TMP

Filesize
48B

MD5
b07cc09ac0b8994faf6086bfd78aa346

SHA1
21fa1a2e47ff863ff3d60d3a6e5f2286f4754a29

SHA256
7d117b8b3d99b0e186e0327c5656b45db07ff0eff5b4bca68a1e2a0a643f261f

SHA512
8b5f954ae2b2ff67dbec95578a5c86a1871c59650907d53d854887837e06da9ed21e761dc28fca01d95738c614c28d77f786225c0e337f4b07eb0eff507fa4e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
93B

MD5
c780ea7a4e096e4dd6a490ef1c11026d

SHA1
3f7825df026eb8a59475914770cf74911df58d53

SHA256
285436110fedcffe0d4c91d29cfbf8467d2443ccd407f2701b774d856ba6db58

SHA512
678d9cdf0ec282b4c234c53aaee65827babf1be1e1873c020054f95a7b58bb7289652a6baffa9f2a9d3efea77e0f9392376cfa31ea433ca70560cfd5ae6b65f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
155B

MD5
1556a60d02889b079ace4101e0b1b8ab

SHA1
c83f142fd856170c6c722c1b26e7c12073efe0d7

SHA256
a8a14c1b043d0821038aa7fdf869c43fad34903c8d32c154fda52511e6a67d40

SHA512
f08ec2a214009aeed8231097c3e9f33bef0fcb00c03ccc1cda810e890da82474b1a95b9e18a5af690c2c596f8b66dad979757e5f3959aa7a94a2e8c728c46e00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
160B

MD5
9caa941e96d5a1f9af48acc8077fc609

SHA1
059eb27351ba651d704c5bba28be0a0eeaf5d90a

SHA256
4d759f6deda83c7b3879692f26267cdaaed9d4317f3bcf180fa309a55744b93f

SHA512
0f688dc1e9bca0829e0374add7313e7d16d5dac187bbc4ad3158770010d22a97ce1bf4fed7da0a662f69e62a9a0af03633ed84fa3edf5e2ca29c175c60604bae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
eb40e09d6fcffb448519f68ca42bb3a5

SHA1
e24f705c71ddecbbce7642a7e5423d3a19162d86

SHA256
f5aaa79f20c5bf273416b966e12454516ae821b538969489c71df56413f76522

SHA512
569ed04e829776567326cfeec595d2e45ae319b3830a27ff3927429380c774889cd8fd2a11f91c6cc93c720d3f9c52fca963477dd72dbd41ac131a59b330c284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588e51.TMP

Filesize
48B

MD5
030e93499cd1312038a633442c7cce3c

SHA1
438ac03008574e3fad5a251c98360062f76ce0fe

SHA256
5e7fa49f123cd24d0ac03667d19145f4984712b2a826e899062848a421daef7b

SHA512
bd9dce13cc22d7f5bc2e07e6565559fbd510f307360caed5c27745ac1cb7bb63216b647409fb66ec83b5f43b9e46065d3ad49ec0b9ec0fe42ee95ccb6e546053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c8afb4ae1d697df1616c7cc31616bb8c

SHA1
e06d900f64bcd3d94a321e117d9f48d6a50981bb

SHA256
0bc7e24600e7301ce27a233c5607661b8499c09b988aa4485dd81c9a70e74a5b

SHA512
33ef4b28d162c4d4c1e764e786e1c4e129ae33d50a4cd2bf0cdc4f6ab9e5a6defc74006eb0cfbf0ce0cba3c3d0bdf856459033e9ff279c486c0ade1dbc8fae44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4c3b86362216d66acb9f9defd5358086

SHA1
454c18fb6a96ca2b2188aac1540337300af23120

SHA256
663f75838259912e07a57845a56b4452ab98e453bb6c66b5ae1ecb83f8e1ac36

SHA512
944679ae17ac407842f2419847788afd44ce9158114c727b5d7de255c0cc634afd99890943955819271b85cc6fd06a8ddf0ca61e41e5c01f12c322ac8209bcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4be3843aa694dbbb390b8635cff182cd

SHA1
987b02dfa8d999a80196f57d9ffe673a0eeb9193

SHA256
f62dd7e34e55df13d3ff36a513d798e01577e0cceb76f7d16dc5ff1e4ddcae9f

SHA512
9dcda90b220a30f4c11abbb174a4c581613ffa810c5dc6ed9f6055086979beae5ecab157aaa32f014bbd604ebdd9e312146c6221ad801753e75b5f88b85114f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586368.TMP

Filesize
371B

MD5
f4ab4518806a3c7a8a481b9b90ba9ee9

SHA1
f4f3efb9540e9836ec9149a872da0639b967f18c

SHA256
048e0948212bf97f732f939f206e44e10b061cae400c39d4af55348d18f70eb4

SHA512
c58bad36ecf1f8223ecd33bddaf84c25c13a71feef7657bb675889bee241206cc514b5badbd0a5925314c5fa49c5ccb610b8abf802b66b20e616eb4f66d7dc51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
d3ae312916d0a506f9f2a1be192eec94

SHA1
3fefeaf66bea27a7317a2ffe946efa35417fcdbe

SHA256
546a0f8ad12ba742175c0c64944059ad8d8a118dc752ac09dc99777e661c4f0d

SHA512
1202e498b8d1d74e7fa721b997d892f456bda46c130947a17cd05074e31f0b592f63e308ef56aa438e4610a2a80d3c2930728be8d789676410d615a6bd8a4646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2c50165b449f41fb6bf85b06982d1547

SHA1
e73b1a85b471d6bb26686c2eeedb6415a0aa45d4

SHA256
a112626f8ea2165eb13bf04ff29a1ba3b4364cb441157595bb397d3d1bc89d9b

SHA512
7a5f674de11d02cb23d758290801638f62a4df2d9905e5fee1e09af083206271b57daa87a9eaa121776b15be3f1e5f3776ea0936dbc1ecd61ee0289d0e23760b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c906b5942684262a884a263dd4b97133

SHA1
e39ccb5c82c9b45b793e3e3af6f1f7c1f44a0ba8

SHA256
7a821b20950f6234f90f72397660ee866bfb702cb4d668f09ef3177378c28dde

SHA512
e2a5421351078f67d2ec5e85bdef8f283c404f102fc7b61d4e7dc8c0ef6eb46d5eb125ea557e5ab576752b3ae63393c5e01fac11c0b57f520da0bee5925a86de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f9069ee853e8d35c481e60841890880

SHA1
b85eacef042a5de84d62be52b17b90b838ae12a8

SHA256
1ce39255a9c69304aefcf8ac62582cdeea5801a90b9e6c6e49b7c2cb9407b9bc

SHA512
e4aee1315ee7437b30676b7fb615a073dd0b6e286bbf3a28eb55fc1e1c6292948abccd66de005f6e926938a4ec6d9357a9d922c2d11f01c097d87e8bfbe14d21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14ffd87b1822940b411456452ad52579

SHA1
a16a5dfc04bf4fda9627ce470f7fef8bfca93060

SHA256
6b9ecc11832bc05808ca0d9a49b1d287ba19a0eb19f8acd2c6dda7121d5e703f

SHA512
8fbe4a780724bc385703c6efdf8adf11abd5a6859fa230fe9cdb9d2227693d83599cbc5214b2522afd9b136823e49a82a398386d1d3830a2c12d75d7db045f61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
4d5a9bdb2cfdb1b7378045a6b095a22c

SHA1
03db2346755b13cd5cc837ab5594d26de32bd630

SHA256
ae02a3d635a50998a65fd16a6a52f44e02b5f4f5d6199b2e94301cad3c266bae

SHA512
4876d2f8880ed68c6938d85ad0e35daf2fbc85a4fe2d2fe83795ac771e7b60edfa2403633e76ab410fd09c0001e2903ad8658cce15a6104e0219127080ad3c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
25de518f48f4e8d1c9a9d7f10d6bc93e

SHA1
0fd9e9ed74f25a81cf27535876be2681d6fb1c92

SHA256
7974c431ee566dd61ed26a1515dd10049d65883141fe8c074b126845c76c5a27

SHA512
5a9a7705356208f51de668056087a889d46de02e8342c3a2271ab6a515a633c2e57bbd980881ed7cc086ea5319ceb00517107671abf5ee8cb7bb828ae1fe114b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
6.9MB

MD5
bd0e4823fbfed11abb6994db7d0e6c09

SHA1
8694f5a67686070fc81445edebef8ead6c38aca8

SHA256
a83dc0d4764f8e41e061dd4e331f341b09cc994fc339fed2445692df7b98affe

SHA512
37f7e77407571c8f4ac298a4580610b0787e7cf8c8993e6816895a1caa71e0c4d97b72f525b9f054071fbf14bf9e87c48c67b39dcc01448213a995d036ff84e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
5.0MB

MD5
e222309197c5e633aa8e294ba4bdcd29

SHA1
52b3f89a3d2262bf603628093f6d1e71d9cc3820

SHA256
047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b

SHA512
9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43522\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43522\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43522\_decimal.pyd

Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43522\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43522\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43522\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43522\base_library.zip

Filesize
1.3MB

MD5
44db87e9a433afe94098d3073d1c86d7

SHA1
24cc76d6553563f4d739c9e91a541482f4f83e05

SHA256
2b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71

SHA512
55bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43522\libcrypto-3.dll

Filesize
4.9MB

MD5
51e8a5281c2092e45d8c97fbdbf39560

SHA1
c499c810ed83aaadce3b267807e593ec6b121211

SHA256
2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a

SHA512
98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43522\python312.dll

Filesize
6.7MB

MD5
48ebfefa21b480a9b0dbfc3364e1d066

SHA1
b44a3a9b8c585b30897ddc2e4249dfcfd07b700a

SHA256
0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2

SHA512
4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43522\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43522\unicodedata.pyd

Filesize
1.1MB

MD5
fc47b9e23ddf2c128e3569a622868dbe

SHA1
2814643b70847b496cbda990f6442d8ff4f0cb09

SHA256
2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309

SHA512
7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ryhhvbqd.ade.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp150A.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
memory/560-1764-0x0000000007860000-0x00000000078F6000-memory.dmp

Filesize
600KB

Download
memory/560-1769-0x0000000007910000-0x0000000007918000-memory.dmp

Filesize
32KB

Download
memory/560-1768-0x0000000007920000-0x000000000793A000-memory.dmp

Filesize
104KB

Download
memory/560-1767-0x0000000007830000-0x0000000007845000-memory.dmp

Filesize
84KB

Download
memory/560-1766-0x0000000007820000-0x000000000782E000-memory.dmp

Filesize
56KB

Download
memory/560-1765-0x00000000077E0000-0x00000000077F1000-memory.dmp

Filesize
68KB

Download
memory/560-1762-0x0000000007660000-0x000000000766A000-memory.dmp

Filesize
40KB

Download
memory/560-1761-0x00000000075D0000-0x00000000075EA000-memory.dmp

Filesize
104KB

Download
memory/560-1760-0x0000000007C10000-0x000000000828A000-memory.dmp

Filesize
6.5MB

Download
memory/560-1757-0x0000000007490000-0x0000000007534000-memory.dmp

Filesize
656KB

Download
memory/560-36-0x0000000004DD0000-0x0000000004E06000-memory.dmp

Filesize
216KB

Download
memory/560-1712-0x00000000062F0000-0x000000000633C000-memory.dmp

Filesize
304KB

Download
memory/560-60-0x00000000055B0000-0x0000000005BDA000-memory.dmp

Filesize
6.2MB

Download
memory/560-1696-0x0000000005D90000-0x00000000060E7000-memory.dmp

Filesize
3.3MB

Download
memory/560-1693-0x0000000005D20000-0x0000000005D86000-memory.dmp

Filesize
408KB

Download
memory/560-1703-0x0000000006250000-0x000000000626E000-memory.dmp

Filesize
120KB

Download
memory/560-1756-0x0000000006870000-0x000000000688E000-memory.dmp

Filesize
120KB

Download
memory/560-1747-0x0000000074F70000-0x0000000074FBC000-memory.dmp

Filesize
304KB

Download
memory/560-1746-0x0000000007450000-0x0000000007484000-memory.dmp

Filesize
208KB

Download
memory/560-1691-0x0000000005C10000-0x0000000005C32000-memory.dmp

Filesize
136KB

Download
memory/560-1692-0x0000000005CB0000-0x0000000005D16000-memory.dmp

Filesize
408KB

Download
memory/2396-6-0x0000021FAA520000-0x0000021FAA521000-memory.dmp

Filesize
4KB

Download
memory/2396-9-0x0000021FAA520000-0x0000021FAA521000-memory.dmp

Filesize
4KB

Download
memory/2396-1-0x0000021FAA520000-0x0000021FAA521000-memory.dmp

Filesize
4KB

Download
memory/2396-11-0x0000021FAA520000-0x0000021FAA521000-memory.dmp

Filesize
4KB

Download
memory/2396-7-0x0000021FAA520000-0x0000021FAA521000-memory.dmp

Filesize
4KB

Download
memory/2396-8-0x0000021FAA520000-0x0000021FAA521000-memory.dmp

Filesize
4KB

Download
memory/2396-10-0x0000021FAA520000-0x0000021FAA521000-memory.dmp

Filesize
4KB

Download
memory/2396-12-0x0000021FAA520000-0x0000021FAA521000-memory.dmp

Filesize
4KB

Download
memory/2396-2-0x0000021FAA520000-0x0000021FAA521000-memory.dmp

Filesize
4KB

Download
memory/2396-0-0x0000021FAA520000-0x0000021FAA521000-memory.dmp

Filesize
4KB

Download
memory/3120-1925-0x00000238EC5D0000-0x00000238EC683000-memory.dmp

Filesize
716KB

Download
memory/3120-1948-0x00000238EC7F0000-0x00000238EC7FA000-memory.dmp

Filesize
40KB

Download
memory/3120-1947-0x00000238EC7E0000-0x00000238EC7E6000-memory.dmp

Filesize
24KB

Download
memory/3120-1938-0x00000238EC7A0000-0x00000238EC7AA000-memory.dmp

Filesize
40KB

Download
memory/3120-1944-0x00000238EC7B0000-0x00000238EC7B8000-memory.dmp

Filesize
32KB

Download
memory/3120-1941-0x00000238EC800000-0x00000238EC81A000-memory.dmp

Filesize
104KB

Download
memory/3120-1921-0x00000238EC5B0000-0x00000238EC5CC000-memory.dmp

Filesize
112KB

Download
memory/3120-1926-0x00000238EC790000-0x00000238EC79A000-memory.dmp

Filesize
40KB

Download
memory/3120-1929-0x00000238EC7C0000-0x00000238EC7DC000-memory.dmp

Filesize
112KB

Download
memory/3624-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3636-83-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-81-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-95-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-97-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-99-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-101-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-103-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-105-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-107-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-109-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-111-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-113-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-115-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-117-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-119-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-93-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-64-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-58-0x00000000051A0000-0x000000000520C000-memory.dmp

Filesize
432KB

Download
memory/3636-91-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-89-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-87-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-29-0x00000000008C0000-0x00000000008F6000-memory.dmp

Filesize
216KB

Download
memory/3636-85-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-79-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-77-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-75-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-73-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-71-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-69-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3636-67-0x00000000051A0000-0x0000000005205000-memory.dmp

Filesize
404KB

Download
memory/3792-57-0x000001E18EC30000-0x000001E18EC84000-memory.dmp

Filesize
336KB

Download
memory/4648-1849-0x0000029C6FF90000-0x0000029C6FFB2000-memory.dmp

Filesize
136KB

Download