hxxps://valkyrieofficial[.]vercel[.]app/

max time kernel
538s
max time network
535s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://valkyrieofficial.vercel.app/

Score

8^/10

aspackv2 discovery

Malware Config

Signatures

Downloads MZ/PE file

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000800000001e558-1097.dat	aspack_v212_v242
behavioral1/files/0x000c00000001dabf-1492.dat	aspack_v212_v242
behavioral1/files/0x001900000001e445-1654.dat	aspack_v212_v242

Executes dropped EXE 27 IoCs

pid	Process
5088	YouAreAnIdiot.exe
1416	YouAreAnIdiot.exe
2868	YouAreAnIdiot.exe
4688	YouAreAnIdiot.exe
3968	YouAreAnIdiot.exe
324	YouAreAnIdiot.exe
4972	Avoid.exe
720	Avoid.exe
5108	YouAreAnIdiot.exe
4796	Avoid.exe
872	Avoid.exe
928	Avoid.exe
2640	Avoid.exe
2688	Avoid.exe
2756	ChilledWindows.exe
1944	ChilledWindows.exe
2920	CookieClickerHack.exe
1892	Flasher.exe
2908	Flasher.exe
4952	Flasher.exe
4416	Flasher.exe
3524	Flasher.exe
4976	Launcher.exe
3980	Launcher.exe
2532	DesktopBoom.exe
1864	Melting.exe
2476	Melting.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
112	raw.githubusercontent.com
113	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4972	5088	WerFault.exe	123
3700	2868	WerFault.exe	129
4544	4688	WerFault.exe	130
3636	3968	WerFault.exe	136
4972	324	WerFault.exe	139
2344	5108	WerFault.exe	148

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{11C70F9C-BC00-4AF3-BFF2-9881259EC075}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{2D5748A7-C887-4536-B1E7-F8192502F3D0}	ChilledWindows.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 531334.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 170399.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 302001.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 95638.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 140823.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 641206.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 490093.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 96600.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
1812	msedge.exe
1812	msedge.exe
4216	identity_helper.exe
4216	identity_helper.exe
1008	msedge.exe
1008	msedge.exe
4792	msedge.exe
4792	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
2920	msedge.exe
2920	msedge.exe
4040	msedge.exe
4040	msedge.exe
3604	msedge.exe
3604	msedge.exe
1308	msedge.exe
1308	msedge.exe
1936	msedge.exe
1936	msedge.exe
2060	msedge.exe
2060	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	DesktopBoom.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1944	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	1944	ChilledWindows.exe
Token: SeShutdownPrivilege	2756	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2756	ChilledWindows.exe
Token: 33	3324	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3324	AUDIODG.EXE
Token: SeShutdownPrivilege	1944	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	1944	ChilledWindows.exe
Token: SeShutdownPrivilege	1944	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	1944	ChilledWindows.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
4972	Avoid.exe
720	Avoid.exe
4796	Avoid.exe
872	Avoid.exe
928	Avoid.exe
2640	Avoid.exe
2688	Avoid.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1944	ChilledWindows.exe
2756	ChilledWindows.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3972	1812	msedge.exe	82
PID 1812 wrote to memory of 3972	1812	msedge.exe	82
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 3696	1812	msedge.exe	83
PID 1812 wrote to memory of 4232	1812	msedge.exe	84
PID 1812 wrote to memory of 4232	1812	msedge.exe	84
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85
PID 1812 wrote to memory of 3864	1812	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://valkyrieofficial.vercel.app/
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0a7546f8,0x7ffa0a754708,0x7ffa0a754718
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3920 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 1316
    3⤵
    - Program crash
    PID:4972
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1416
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 1172
    3⤵
    - Program crash
    PID:3700
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1252
    3⤵
    - Program crash
    PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6624 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920
- C:\Users\Admin\Downloads\Avoid.exe
  "C:\Users\Admin\Downloads\Avoid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4972
- C:\Users\Admin\Downloads\Avoid.exe
  "C:\Users\Admin\Downloads\Avoid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:720
- C:\Users\Admin\Downloads\Avoid.exe
  "C:\Users\Admin\Downloads\Avoid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4796
- C:\Users\Admin\Downloads\Avoid.exe
  "C:\Users\Admin\Downloads\Avoid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Users\Admin\Downloads\ChilledWindows.exe
  "C:\Users\Admin\Downloads\ChilledWindows.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2756
- C:\Users\Admin\Downloads\ChilledWindows.exe
  "C:\Users\Admin\Downloads\ChilledWindows.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1308
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1892
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:5072
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Users\Admin\Downloads\Launcher.exe
  "C:\Users\Admin\Downloads\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4976
- C:\Users\Admin\Downloads\Launcher.exe
  "C:\Users\Admin\Downloads\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,9991897498696908450,1379481435199798330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3368
- C:\Users\Admin\Downloads\Melting.exe
  "C:\Users\Admin\Downloads\Melting.exe"
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Users\Admin\Downloads\Melting.exe
  "C:\Users\Admin\Downloads\Melting.exe"
  2⤵
  - Executes dropped EXE
  PID:2476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5088 -ip 5088
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2868 -ip 2868
1⤵
PID:4392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4688 -ip 4688
1⤵
PID:4412

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 1172
  2⤵
  - Program crash
  PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3968 -ip 3968
1⤵
PID:224

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 1172
  2⤵
  - Program crash
  PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 324 -ip 324
1⤵
PID:2044

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 1180
  2⤵
  - Program crash
  PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5108 -ip 5108
1⤵
PID:2040

C:\Users\Admin\Downloads\Avoid.exe
"C:\Users\Admin\Downloads\Avoid.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:928

C:\Users\Admin\Downloads\Avoid.exe
"C:\Users\Admin\Downloads\Avoid.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2640

C:\Users\Admin\Downloads\Avoid.exe
"C:\Users\Admin\Downloads\Avoid.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2688

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc 0x464
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Users\Admin\Downloads\CookieClickerHack.exe
"C:\Users\Admin\Downloads\CookieClickerHack.exe"
1⤵
- Executes dropped EXE
PID:2920

C:\Users\Admin\Downloads\Flasher.exe
"C:\Users\Admin\Downloads\Flasher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4416

C:\Users\Admin\Downloads\Flasher.exe
"C:\Users\Admin\Downloads\Flasher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3524

C:\Users\Admin\Downloads\DesktopBoom.exe
"C:\Users\Admin\Downloads\DesktopBoom.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\YouAreAnIdiot.exe.log

Filesize
1KB

MD5
17573558c4e714f606f997e5157afaac

SHA1
13e16e9415ceef429aaf124139671ebeca09ed23

SHA256
c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

SHA512
f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76928384-2d3f-4998-8013-4716d4363bed.tmp

Filesize
1KB

MD5
c788106f4a14f192ddeaaa59734d5a27

SHA1
58bca89ce3eb433a008075a822fbfbf81b35a370

SHA256
af0d70bd252ee1f4945f683d1351ecd7998729d90a4589f09cabf4598d942636

SHA512
46adab7ebc5a230a4411a62bc78ba602c56a3a9780c1a1f3bd8c1551af86d00389a48141717374ce40ed37971fcd9f976bc566538e387238a23965f3170a214c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
70KB

MD5
4308671e9d218f479c8810d2c04ea6c6

SHA1
dd3686818bc62f93c6ab0190ed611031f97fdfcf

SHA256
5addbdd4fe74ff8afc4ca92f35eb60778af623e4f8b5911323ab58a9beed6a9a

SHA512
5936b6465140968acb7ad7f7486c50980081482766002c35d493f0bdd1cc648712eebf30225b6b7e29f6f3123458451d71e62d9328f7e0d9889028bff66e2ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
41KB

MD5
58756d99d2376dcfbede6057dd25a745

SHA1
76f81b96664cd8863210bb03cc75012eaae96320

SHA256
f5d0da7b010b28a7fe2c314724a966c44068a8c8fa7e9a495e1284aa501067fa

SHA512
476e35c3da0cf223e773c2d26403c12f8c8d034273cca9e3c4cba9359f8506159c2a5267793c8bd9982b636191ddda62e9119593f5599053894c7027a58acc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
1.3MB

MD5
a308d42822b1bcc72e63270f012430a1

SHA1
39120041244fea9d757d253232fd14835e70c555

SHA256
e7958fa25cceb843a031a4d8744515180b4aceeb2db00f42e9c0c78cf1991a11

SHA512
fb9825a6febb7b54d2bb6bd21c02cd1eec103cc44cc525eebabdebbb726c241d223b734e751669f18f5762f6418917cd892850e4d99222f5998027a144ffb366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
43KB

MD5
d9b427d32109a7367b92e57dae471874

SHA1
ce04c8aeb6d89d0961f65b28a6f4a03381fc9c39

SHA256
9b02f8fe6810cacb76fbbcefdb708f590e22b1014dcae2732b43896a7ac060f3

SHA512
dcabc4223745b69039ea6a634b2c5922f0a603e5eeb339f42160adc41c33b74911bb5a3daa169cd01c197aeaca09c5e4a34e759b64f552d15f7a45816105fb07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
27KB

MD5
509d1e75f9876ecde056faafef5ae620

SHA1
2581fa11587d73ef6f611557954518ebb7908bc5

SHA256
b3b355f7ae6902d546436864f69c20e50ef07a43477109c5bd2afd5f0f06e954

SHA512
ad16b96f2f91ffdc12e08c1b86612bd9019ba6ea4dd2e1a2c98f586eaf27efafbcd5ca6e238a0ba7fd89a065c3bccb88d756837089e624133b2b33e67521ce7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e4e82664e3adbd484861aace56909e1b

SHA1
a643a213b686f299c89bc883d295988ebf4b0f7f

SHA256
a482c03b6b7e73adadb4f29a903bc41bb7e1455b631f87a8fa189cc864bfa922

SHA512
7d9383cefc31130dc2f12726b87b0ecf0029ec3b8dcd0de3cb41f33f5c53aa988501fe1909fe3a3cd9d83db3ce298d14c6fe3c1b6125e232a47abae91dc17a9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
780ce93e48d0107d2467f1b17722f248

SHA1
48adbaa44d2a8452e09b90f4cf0f875ab745f124

SHA256
9fde161514218944daf8c5aad69fa9d8a553a77cbd5044d770f0047a027c74eb

SHA512
68fc71d02dd381b9dc9de0b2407a86901b61498a650caffc1f679b7a9aac7feb611ade26be5d797f1ee205a6e7e313e9892bbb5a00d3e50ac0975d380c116e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
715a9bc8a132d137befc3839e70e0ec3

SHA1
9b16a82ca45de14465595d113b78bad49cec64d0

SHA256
d5ab94aa02cca7440a258b8e81f773762ce6a5727e422c168cce091c3e9a41d5

SHA512
00ff4713db26265bc5028be8bd424d99eeb3052262eb348728435a528cb8ea5818a87df987b0433bde8ec3e05fc03c1903e6904c581acdc599441366690895e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c772bc84d033b381fdecec05e05e97de

SHA1
02d512132366bfbd5cfbe2ebc06c3463dc121095

SHA256
d5d0fd793dadedfbdf1d1b9f38fbf2bf37bf66d672011bf9dcae0aa12769f1a9

SHA512
ff12c8121e706953a96e3bfbc9ba868b2245e77f027e86bab6ad36b093fc5a5f7cd9b904683a967655e936e8a7c972a27e86a600663664dac6c051623a144e5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
da5ab57bc1a606ca1d7451d2ba7b9af6

SHA1
7f4427861803dfa4eb35868e55cfab8f2778c1e3

SHA256
ed4031220a798bd45cbf6ed4f7567b15f2431774c33272af40e97b5078ba2528

SHA512
e5ed8d34de576c99cc633fff621b9c1c2cb15e5a3f386ae73e4cdd20b257740dd5ca66cccdafaeae925204102117bd490acf7522d1b157529cdc93454bc92feb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0defb83a774aa5a0a2f95e4af23167ba

SHA1
3089c7f4088f6bb751d29243779420c55ac794a5

SHA256
7066a9802fac9045d83dc5b4c5342cc6fd32288411cd817d5ea2ce671dcc2900

SHA512
8d2100cfb74b7bd91c6eba784250235a6152d15cc47a56fac213af961c9b3bc1434dc436bf6da5db6b0fa2bbc2403f226359d713e7f094a9b7e3d564ab04b9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
433ae5ba0c6893b63c53a31fe9be6326

SHA1
e130f57998c4348ebd4c48429de6746cecc89827

SHA256
bdf3f5b0987b2fd93d2bd031a455a020db5a99431e554a387c2d4e3abe174f11

SHA512
e5a4027578b64ee924798b43be3bae986ec9e59a79cc7dba22b569442f3b571041f429fa4108725ad992cc7fd02aae358e657a4df732be737d8226200e4309c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
993319a33fc1e11f4fb2031b74f2478c

SHA1
54db970981fab697450cf48052cd08a16a142389

SHA256
c56962c416ce5f3956afb6cca22d7aae6b3e9fdc2176ee45997c75b77c6b8e44

SHA512
e314bff14a5b5d42e8f8d71d3fcab0e50aaab9cfbdffe3678502893a07061af469efd6be0c3bdd7bf97918a527e3752247d68861b3facd1ea00348b969727c90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ad08d28da3dd88f43039b70d374e00ff

SHA1
1725af376c4e4fd7fcab03f9885a4b4575d7b70b

SHA256
a0f7952dea87da5636fd48e7c8128f1f006f93433207df537091cf9a3ee33a87

SHA512
f4ffc8a79c1f955368386b6cd207b69833100eb08cb2bb2b4cdb00d6c6f266586b5a61cfa2524a6cf8264ca36bf474a71a335bfe8bf5037bd09b2749ee590544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5d7ecd53304844029c7159dda1d03f4c

SHA1
3dc271c989fdec0c17ac17c56b0d7419a82358e8

SHA256
f3dcbc6c93edd3a5bae6ad51b7896c9b8a889338b447451fdeae5ff7dad17439

SHA512
b262055450ed700250bcd7d1438f04fa92f04ce7b1dbabf61c92e2b016559127c2fd16fe9157e7d139e8dcb73849332cfcb8f38eb73a0803b82006eda1e0a511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
38a470f9e73c90be0a3ad332e99fce7f

SHA1
814dc9a4e61448bd9dad69981ca762a2eb42f8ac

SHA256
4e17b964200b0cd9c38d58af219ff7195fc22320cfa9c3a03decea15a1a97356

SHA512
dacafb40d2b45ff69f660b5636f41f48ba8c747cb606b04ec65d5c0c5c9e6f0c14826d5416b99752dd4a9fb93bb8039e759f1cfbad8e6e9123aa4fdaf63c28fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d7323a83cf0110edfa4e313c21898f11

SHA1
2fc663e89ba11166b28dbe606bf30139d8b282ad

SHA256
47989f1993e769d33716a312f8ca03f474aa61b39f561b297bec4481ab66f23f

SHA512
6ce95d20a88289f2513ea11550c3e5d93e5a33435dd51ae4ed6b5c39ce33be43616f88e42aa85f1b42a7424624f3ed9b267d62394d979675f03b87e6649d3f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0d768f9ff0c1728e4515c837ab0f806d

SHA1
2eaae9b8461c63e6d859b2cee41fd10980f90fe2

SHA256
07121290326efda69cc285c85887256a294870e65ab4cf43e190af4346bdee8c

SHA512
6902246fb005b4d3d704eb284582d7af79c78394ab3c44106038cf2f306e06611bc2c7600d7142043479b11947d46ff1c71173376fb49cd84bdc3350a56080e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5148dfe888846dfa03d73bdb8ce6a97f

SHA1
aee6053f98d4bd8123bd582aeba846d639e41984

SHA256
1b92d10326604c2e81b11a589441af1f5f8062d90e673e93949eadc1f05d2cc7

SHA512
5aa4185622aa3c0bf5f86b0019e258bfb6220a80a4b4de4d96646608a4b02bba65da308b86dd5d49c32cc071f068da79521e5cbdff166e36264a01a79eee7910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
e8a4664196885fb28d44b3f99a80544d

SHA1
25eafcbc95fcd860837c42c65615ad1e7ccacddb

SHA256
06ae4fedca49d87a0c86e5bd5d776b88ab5487f19b8473b97f4f045be293f76c

SHA512
37bf89bb1173355dd9588cd1fc72463831ce17531bbb09ac4b9a5428803f34fde9f8666347ec8fa1733e354b993c5885c2524e3e8a680d984c9c83548a0f7ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
922e1370a00a1e0cddc9658f220413a4

SHA1
876e43b412b07cc6bca9926da45e592e869e884a

SHA256
79552916cf3c86054a33a98623d3715cf754b7859a95e1ec4e8d9f1bef975174

SHA512
5735dc94292ce2f3bcff92ef69c2a40cfd73a2fe467ab8bca3143b34e0757248b5ad06a6d2e69db7570d67ea6ae4eb4c313d483aa4b8c7fe822cf04d8b8b9df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e7d880d42d548ba673c86c1cb6e838a7

SHA1
1bad6bc11ffdb174a7e3a68d557056aa66dad640

SHA256
a61490df6ca5818249d7487317fde83c1b6eb47f4189a4de5fc4646c79a58656

SHA512
bab01ae5c6bc203f72f3d40d48791e577d13e95134f8402c0080154ed7a8c4b52193b31f21b7012b55924be49b0b0eb7b22d6639d3cb912939bce8225d8dbc24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
166317959520e06e864d0e991a22e344

SHA1
ac69035886df7b537e0d70344e24f16b576a4849

SHA256
26ef3a305c128e02de2f8cd4c4d11cb3b43ff9644218456dc8840c5eec86cb0e

SHA512
92d68cf761f583b8be3e675b318a4b0ea15964263796932e8b975dafba90c4908fe2fe384b1daa9ace0e97df5a8e9538486704312d1ffb1ea81a7870da037bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b18096dd3fd7d3b6eaca14424bd93b63

SHA1
52b5e6af9f5a64ccc7d4eeb6a1ef8328a04fd862

SHA256
359419320736c9d32951c2b1f9806c44d26bd3dd8e68c777acc54b28002cf3b5

SHA512
18f9ec99d5bf61ce50583b57822a8676018bc59aab5c95a60708f56f2028d37639027a6e473248d801bcec51e9e2fefc5179d81e15fef4a0319b8017ce03e35e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0e9c8209b378f86b247702eccd9d6323

SHA1
9ad20eda792400aef189fd8532d32d75934d7219

SHA256
b85a3a268f26db2e493ea7bd353fd92d409a5cd8631edb494c994a563169e6cf

SHA512
f21d657fcd8bae0e7377c30b3130d0727da618a10045a723c614072c09908ca5c4cf7ae4ac3674fd852a3fc9fbccc6604c25b109f62216342e0e81bb19a2f8a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c16ea64bb5887be497e410725fafe9cc

SHA1
a22819af2060ebee59a7ad3b0b07809f8eb01344

SHA256
959c6ffa5ae50f856999010498df14091f904b66e97a37802cbc1efeb75068d3

SHA512
1de3db69ea1727398e7cc6cc18d9b449105f411e3200be4e963578629157baf8b0adb8cf760fa290dae455189bde18074e1da9e69ab046dcba521fc25403bd7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d339cf4f98585e50531da5a204ab27a4

SHA1
638b292fe403fb0bb0a9527ff2a8a6af8378be61

SHA256
a0741799f622bda48ae698ac2073e3347e9dae788764390ddd8fbe1be699254d

SHA512
c60343f67cad8ce3d98512980b49d4acf695b01ad1c2159459689197d530b54294bfb99ead5e379d6d08a7c4831b145a0e518c29b186fe7e74af6107b3b2bfb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
18285b83252943c03ee0db24c84e7aaf

SHA1
49b5e1a1a0167ebffd9840c5f0ce2c327c13ef16

SHA256
5ffe8505d24a50a0206b0b62c2318f9b7cc6d90fe9e06f3ba8f47a19e2c70160

SHA512
1b7097db81ad041cac268c500ee9e908cb629a6b976dea86265ed0062fc2f17a0c8f8c14dd185124a7bf66e5e1e82d5a763d2f049e160faab082425878cf47b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
857b50b79d63c2b10b1320be31114f13

SHA1
5da667ee4d35006f63e2630121b84ee25a811c72

SHA256
734e9e983996e0a1f768be842fd1d6690c221431de530e877126393b93fb08a6

SHA512
54e2c99c531c58b1ca4b5f3c69795b0cc068bc7327ad2359f3b54fcabd9af2bf54af4ebce882c5f1de4b3a050de179ba6ceebae0e265237d751c3cac66f65595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c93b.TMP

Filesize
705B

MD5
b4c32fa8f831b1ccc5eabd6921647acd

SHA1
84db0cbb7f5b463b523a2e0df2be2e11e55622be

SHA256
27cac13160117693316db66ad68379e4eb5130934d828c852be5da0b72fbb75c

SHA512
ec31c2412f968c49ec280311b4bb73dfcdfab52a26fda6e071bbe0eca714f563c2f8b15cb185ba82e887ede65ecce08250978474239e34c7d3c72d916fdceb49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
55f01c0b6f410ca6c22b071259279eaa

SHA1
1902f1b70adab068d3916c526d5b525206e4b67e

SHA256
e212b1c742ecd0342f12a458b543a23fecdfcbf901d6a36a4766367b6a77aba8

SHA512
7ea90ce13fe0d1b0a932f5a2467a30f0cbc77bc65b5c1444375e9447fbe8ed2884dee2421a6fd8fd6ba0a440035701a3523fbe81908be633737cdc16656d48f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
21564b60fe2a8d62500c8792b1a8177e

SHA1
78c8ad01334c34c4de2694f6f8a89118737a55dc

SHA256
4a9ecccbc6837ed0f3e0b2354467d60cd85b069327ba9aaf5c215fba30d5153f

SHA512
999e88560f53fd24f5618f04797fdf6044725dc9c376b4b5b02d6c2331244106df06707e4ef3a39f342af45c04ebe92474b4ec30f328bcf068584f3771f138c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
02c28028702449c171777e68dc732949

SHA1
c2e035cd6ae23587cd3b1a4318584cb5a9abf5e3

SHA256
ea00a729a033248f6ec6c8de9ddd60a3600383d9a0da0015f51a2f99cd28eafc

SHA512
bce287a319b696acbaed0ff8087825edcadde7a21b9d4acb32d7bd973213c6813f345680773640bda0c3bbfe07ae03f4ab43f2834724f2459fb93f102e59ee0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f32c343cc8aac48e384cdffc8337242c

SHA1
79b4710a0a82b060ef335e79ad9110af4a45ed0a

SHA256
c8d336bd69ae7db84537cf4b886e29eaf706a57931b1d5e21076fceca00cb4f6

SHA512
4faa71843965dcce8d41b680918bd6aad94da8a6b7fc40c790f2418d905287cfccf69afe2e9c6e7f2057ecb20f4cd31f2ffc45190abaa9ac333f4502f911c093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e2075dd1b4874a5a5cc90617db0888f5

SHA1
f56b4e80f1dc20a74ecc051e94aa338bb158d96a

SHA256
71ae82449f4990fa3162d61116d6eec9eb9489655bd6b6d2d42d59013397ee42

SHA512
8f814ae5827f936f42e3af4e69d5647b8e097d5a63be72632dbb84fa8fee1185905bf44cc9910dd6d9c9c31f01f285e5166adbc963705056f51d49c2e34f78af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d56316f38f6360e485d7571852ed79db

SHA1
d39100e29b6eeef34df6ebe7c77f30d763f15fd8

SHA256
e3afa04a6e2ee0aec4ba6d7275fc8443e3e06c90e97995125ea3abe20a2cdb96

SHA512
3ff6b80179ccdf714b55d0493fde4682890ff0730efff244d4e1310b249645bcb38661ad797032716be700921233824a3c2b0eb8fe5a54683afed1141c2d4c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
592ab9b970e0e34d7e1249dd50960e0e

SHA1
5bde8f059440aed70b5304751715f784d5f96a8b

SHA256
1bc16d35b06e5b4ea84ae6c42b9f73899897f622b854538a3a9fca563390aad6

SHA512
bd97af3ead4f294b4ed445010aaa5a1128f37c478d03a17b2aa64b664bef2004f926728a141381e6c6a5eae7f59ae7f2c25a5257e91ea5e5039143f0a8ceefbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a53a87ecc300a8de1af455019974611

SHA1
87fac36a0bb62d30d7f9d424e3992cadf9c20cb6

SHA256
b8cef0de7c5e708c512b8ab0491a368c8aa849950aa3c324ab673ecd23a8ac6c

SHA512
702857c4426467a230f93d1c10039c9b9d063d80f671ff8ded4e387aa5cb394b323e888567d4515c98df8424fc1c27165f486b84759474c92cdbd6d94c769dfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7da64f6b7114b198ebc8eeb507cf57d

SHA1
0d84e7631c32957d92a7e90f8ab9ee80ca63f104

SHA256
0d7a5357b21660620ce70ecb647109337d0730d702d6877b76aa4aac34a7e21d

SHA512
3a76443d7d4130a4bfdc41ce1e44554c2c1e0a1aaeab9f62dcbe53ea063ca1c8c7ba1433b6036e705b1da3ce6c38bf44fb2fdcadf5287ab030ceaf3d02f17d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
384KB

MD5
063793e4ba784832026ec8bc3528f7f1

SHA1
687d03823d7ab8954826f753a645426cff3c5db4

SHA256
cb153cb703aea1ba1afe2614cffb086fa781646a285c5ac37354ee933a29cedd

SHA512
225910c24052dfdf7fca574b12ecef4eb68e990167010f80d7136f03ac6e7faa33233685cbf37b38ee626bb22ff3afeee39e597080e429be3ec241fb30af40c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\Downloads\Melting.exe

Filesize
12KB

MD5
833619a4c9e8c808f092bf477af62618

SHA1
b4a0efa26f790e991cb17542c8e6aeb5030d1ebf

SHA256
92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76

SHA512
4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 140823.crdownload

Filesize
248KB

MD5
20d2c71d6d9daf4499ffc4a5d164f1c3

SHA1
38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8

SHA256
3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d

SHA512
8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 170399.crdownload

Filesize
1.1MB

MD5
f0a661d33aac3a3ce0c38c89bec52f89

SHA1
709d6465793675208f22f779f9e070ed31d81e61

SHA256
c20e78ce9028299d566684d35b1230d055e5ea0e9b94d0aff58f650e0468778a

SHA512
57cdb3c38f2e90d03e6dc1f9d8d1131d40d3919f390bb1783343c82465461319e70483dc3cd3efdbd9a62dfc88d74fc706f05d760ffd8506b16fd7686e414443

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 490093.crdownload

Filesize
68KB

MD5
bc1e7d033a999c4fd006109c24599f4d

SHA1
b927f0fc4a4232a023312198b33272e1a6d79cec

SHA256
13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401

SHA512
f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 531334.crdownload

Filesize
197KB

MD5
7506eb94c661522aff09a5c96d6f182b

SHA1
329bbdb1f877942d55b53b1d48db56a458eb2310

SHA256
d5b962dfe37671b5134f0b741a662610b568c2b5374010ee92b5b7857d87872c

SHA512
d815a9391ef3d508b89fc221506b95f4c92d586ec38f26aec0f239750f34cf398eed3d818fa439f6aa6ed3b30f555a1903d93eeeec133b80849a4aa6685ec070

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 641206.crdownload

Filesize
4.4MB

MD5
6a4853cd0584dc90067e15afb43c4962

SHA1
ae59bbb123e98dc8379d08887f83d7e52b1b47fc

SHA256
ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

SHA512
feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 95638.crdownload

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 96600.crdownload

Filesize
246KB

MD5
9254ca1da9ff8ad492ca5fa06ca181c6

SHA1
70fa62e6232eae52467d29cf1c1dacb8a7aeab90

SHA256
30676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6

SHA512
a84fbbdea4e743f3e41878b9cf6db219778f1479aa478100718af9fc8d7620fc7a3295507e11df39c7863cb896f946514e50368db480796b6603c8de5580685a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 96600.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
memory/720-1148-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/872-1166-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/928-1179-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1416-1050-0x0000000005390000-0x0000000005422000-memory.dmp

Filesize
584KB

Download
memory/1416-1046-0x0000000000790000-0x0000000000802000-memory.dmp

Filesize
456KB

Download
memory/1416-1047-0x00000000051C0000-0x000000000525C000-memory.dmp

Filesize
624KB

Download
memory/1944-1244-0x0000000021750000-0x0000000021788000-memory.dmp

Filesize
224KB

Download
memory/1944-1243-0x000000001ED00000-0x000000001ED08000-memory.dmp

Filesize
32KB

Download
memory/1944-1245-0x0000000021710000-0x000000002171E000-memory.dmp

Filesize
56KB

Download
memory/2640-1185-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2688-1191-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2756-1227-0x0000000000DD0000-0x0000000001234000-memory.dmp

Filesize
4.4MB

Download
memory/2920-1414-0x000000001C4A0000-0x000000001C4EC000-memory.dmp

Filesize
304KB

Download
memory/2920-1413-0x000000001B6E0000-0x000000001B6E8000-memory.dmp

Filesize
32KB

Download
memory/2920-1412-0x000000001C1F0000-0x000000001C28C000-memory.dmp

Filesize
624KB

Download
memory/2920-1411-0x000000001BC00000-0x000000001C0CE000-memory.dmp

Filesize
4.8MB

Download
memory/2920-1410-0x000000001B5F0000-0x000000001B696000-memory.dmp

Filesize
664KB

Download
memory/4796-1164-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/4972-1147-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/5088-1048-0x0000000005520000-0x0000000005AC4000-memory.dmp

Filesize
5.6MB

Download
memory/5088-1049-0x0000000005010000-0x00000000050A2000-memory.dmp

Filesize
584KB

Download
memory/5088-1051-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download
memory/5088-1052-0x0000000005290000-0x00000000052E6000-memory.dmp

Filesize
344KB

Download