stealerium | hxxps://gofile[.]io/d/ulhGxH

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/ulhGxH

Score

10^/10

stealerium collection discovery persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

stealerium

https://discordapp.com/api/webhooks/1287935626867507220/BgogLYeO8w14cbtGvpxtN4uXBwwaccgHejFyV0i3qBC62fEY_0tlZU5EJ0YpWB-KbZaH

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1728	VANTA CRACK.exe
5816	VANTA CRACK.exe
5860	VANTA CRACK.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	VANTA CRACK.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	VANTA CRACK.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	VANTA CRACK.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	icanhazip.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VANTA CRACK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VANTA CRACK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VANTA CRACK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5300	cmd.exe
5532	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	VANTA CRACK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	VANTA CRACK.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 645481.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
4776	msedge.exe
4776	msedge.exe
4624	identity_helper.exe
4624	identity_helper.exe
3836	msedge.exe
3836	msedge.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
5620	taskmgr.exe
5620	taskmgr.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
5620	taskmgr.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
5620	taskmgr.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
5620	taskmgr.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
5620	taskmgr.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
5620	taskmgr.exe
5620	taskmgr.exe
1728	VANTA CRACK.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
1728	VANTA CRACK.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
1728	VANTA CRACK.exe
1728	VANTA CRACK.exe
5620	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5620	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	VANTA CRACK.exe
Token: SeSecurityPrivilege	5568	msiexec.exe
Token: SeDebugPrivilege	5620	taskmgr.exe
Token: SeSystemProfilePrivilege	5620	taskmgr.exe
Token: SeCreateGlobalPrivilege	5620	taskmgr.exe
Token: SeDebugPrivilege	5816	VANTA CRACK.exe
Token: SeDebugPrivilege	5860	VANTA CRACK.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1728	VANTA CRACK.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1772	4776	msedge.exe	82
PID 4776 wrote to memory of 1772	4776	msedge.exe	82
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 4484	4776	msedge.exe	83
PID 4776 wrote to memory of 1500	4776	msedge.exe	84
PID 4776 wrote to memory of 1500	4776	msedge.exe	84
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85
PID 4776 wrote to memory of 2484	4776	msedge.exe	85

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	VANTA CRACK.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	VANTA CRACK.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/ulhGxH
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6dce46f8,0x7ffd6dce4708,0x7ffd6dce4718
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Users\Admin\Downloads\VANTA CRACK.exe
  "C:\Users\Admin\Downloads\VANTA CRACK.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:1728
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5300
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5484
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5532
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:5540
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5864
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5908
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5920
- C:\Users\Admin\Downloads\VANTA CRACK.exe
  "C:\Users\Admin\Downloads\VANTA CRACK.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5816
- C:\Users\Admin\Downloads\VANTA CRACK.exe
  "C:\Users\Admin\Downloads\VANTA CRACK.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17357191478478878376,12473955325412646555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5740 /prefetch:2
  2⤵
  PID:5152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2388

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5568

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\5458886268aa826591e1fa998e0b45fa\Admin@DSEYXUOD_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\5458886268aa826591e1fa998e0b45fa\Admin@DSEYXUOD_en-US\Directories\OneDrive.txt

Filesize
25B

MD5
966247eb3ee749e21597d73c4176bd52

SHA1
1e9e63c2872cef8f015d4b888eb9f81b00a35c79

SHA256
8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

SHA512
bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

Download Submit
C:\Users\Admin\AppData\Local\5458886268aa826591e1fa998e0b45fa\Admin@DSEYXUOD_en-US\Directories\Startup.txt

Filesize
24B

MD5
68c93da4981d591704cea7b71cebfb97

SHA1
fd0f8d97463cd33892cc828b4ad04e03fc014fa6

SHA256
889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

SHA512
63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

Download Submit
C:\Users\Admin\AppData\Local\5458886268aa826591e1fa998e0b45fa\Admin@DSEYXUOD_en-US\Directories\Videos.txt

Filesize
23B

MD5
1fddbf1169b6c75898b86e7e24bc7c1f

SHA1
d2091060cb5191ff70eb99c0088c182e80c20f8c

SHA256
a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

SHA512
20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

Download Submit
C:\Users\Admin\AppData\Local\5458886268aa826591e1fa998e0b45fa\Admin@DSEYXUOD_en-US\System\Apps.txt

Filesize
6KB

MD5
f83edd934206e49ac3efebe2dbed2980

SHA1
ecb1b66ecae868615535e5974a6d7d90ce77193c

SHA256
85463380d96b05f897f7a3803449664fa4c813c6af9323808a244cdefff4c4fa

SHA512
95ce08f32b011c9f7c3b83b28c3fbdf669eeb01bfef57cef1a88ed55adec3e2708491ebc7d72d796ae269109f05c53b175e18f4cb901334a2ce8d4b8c672bf75

Download Submit
C:\Users\Admin\AppData\Local\5458886268aa826591e1fa998e0b45fa\Admin@DSEYXUOD_en-US\System\Debug.txt

Filesize
998B

MD5
6d8342502190a72cc1cb1be2f2b5511a

SHA1
1241507ac9d1a9f923074c7ebf3b739a0488db77

SHA256
445af83c0564f680eaa1c86e0aa89cf213ac9c77e0216afba69085b84d68cec1

SHA512
e4ae6a95b3be618eaa6c4598e4324e472d7203fb87f807aab4c47cb71fc5ab3f42371dc301d7c0d5727d09df646b3d4848a527ae6f1d181a64871bef84536f98

Download Submit
C:\Users\Admin\AppData\Local\5458886268aa826591e1fa998e0b45fa\Admin@DSEYXUOD_en-US\System\Process.txt

Filesize
4KB

MD5
34be7dc3fb14944399882f1e503f2ea2

SHA1
9fad66d72edeab464969dd96d2cabea2a964566e

SHA256
602c1979eb544770c96900eb690d1212183f9c3c5d9656a900428370c284b68a

SHA512
25d13929218fa2aaa6a1f6042404214a576229d40ab126dae8ebeeebdac6d7db7e3858f99b34f98a3d7c0b7564c0254e20115cf3ef65568de419148801c88c17

Download Submit
C:\Users\Admin\AppData\Local\5458886268aa826591e1fa998e0b45fa\Admin@DSEYXUOD_en-US\System\ProductKey.txt

Filesize
29B

MD5
71eb5479298c7afc6d126fa04d2a9bde

SHA1
a9b3d5505cf9f84bb6c2be2acece53cb40075113

SHA256
f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

SHA512
7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

Download Submit
C:\Users\Admin\AppData\Local\5458886268aa826591e1fa998e0b45fa\msgid.dat

Filesize
19B

MD5
ddfea21febdafbaf7f646036652e492f

SHA1
ce6e9f685d188ec959fb93d1f104890248024ff0

SHA256
2068a9b5fef30cd74d6f71c426104e755cf98e441d294bb0ec214b385583930e

SHA512
c94d8ab459ba57a884a469ca87ae8050b6cd7405304c5045d07b19c198373a4bfc75d09d2e274542d3a860d80bf4d4ec799a26f57ec40ecbabd3b273f2fbad5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VANTA CRACK.exe.log

Filesize
939B

MD5
193dbdc5c0f693395acd93af077ebf54

SHA1
3255f55112ef04fb92eb410e73688eedc94ed69b

SHA256
fbc5eca582bae246982f0133dbe7f0af224bb041b822891b2e2db7093a033f02

SHA512
205fa9c95ab6a096a371aa4be3c3ea9ec52ad3f6f2e2a29499dc7f0249f1a48a4e857a661f3b3e3fea9c91b0616d46ac76134d826757348a1c2f77990c43e360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
0d1943d8a2ea9cc858f2b58694416de9

SHA1
a9649ddbe5d74cd32651204456baa962ac4553c5

SHA256
26c6963ef07412b4edeb3fa190b1be80a157552fe695621dd0c0c3b8c1837c67

SHA512
4eb449511c3ec7ced446b1a965c6aacc7cff108e6db9ca470506f0be8ef139fd2b56d813096684ff28f556745d023b69e7736cdcf83508e96f05f1812691991a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
260bba3c8d251c9fd72805645794fc91

SHA1
151d62781218d6ab91e5d56c14e4e903472d1246

SHA256
ee68f889aa1526542e3f34685bffedb5482175a871da6d87d52640b704b207d8

SHA512
177c3dfade687a606974c4f6a4dfc2feb6ea35b97ebc0dd3154fda6ef1d6f013ff787d1fd3563daa766c083a9883f6b4a054a829dcff3c9e1ba394862006bfd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
5f05b26e0caccbee54089cb0044220cc

SHA1
e76ead734684a93a820d05c76824d5445f28f584

SHA256
256bcc760870f0a18774ed0999652be257776a2049eba989bda8f359b1507dcc

SHA512
29ecfa0586aaf62f2e6a90d2623fb01c7bb156993f2ed00085d8dcc97026b48aad69f27855cf3231d6f3d5c388a81367ec9e27ea47cefd50c530d08862292dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5712a8e93f9614a025452b1939721d40

SHA1
720bb7044f37f594059d307e59b54555b16c942a

SHA256
53b2fded1613b66abe0be13cc4fb9c5f90190d9e6e34f0ab96444604ad442fa0

SHA512
ca92d1db11d6f53391bb7188f5e84dd7b431930794734e595fd9b3e40b6391037eb3c7c16e23981e3b9c6d1292f66e539f14acda51af708771e2634324a19da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48ce6b6091f5ecd1727c4e5179d6779e

SHA1
e3558a579f26b70290ab4aa5d8867cf80e8d55fb

SHA256
39a7775c73e42c904ea73465bc9012767d3de12ac01f2aee32a8f049c1fa24c2

SHA512
294ac045f2fd8935cc5505c2362e4714ee4b34a86711a7d8416c04dae5bf0a70960b19d990eda69a6babce951b89684a099471d81a52c25c3857a47d6aa47206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87a762874bee1203e133e71fdd36149a

SHA1
fee93a34fad22c4086375068ccddab3613c92651

SHA256
2fe467486f0af718a9edc668672ada37a271256b98a741ee165faf2d1ed8e783

SHA512
4c58b468c6b2261295170d0c5176b9004b8c61cc9852d7db1cba74478c08e638a54c19d96149e6187ff025c737e85ab52f56ac47e7d990217d3645722ab2ee7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2ec42d140b606e86ffeca6a24e145814

SHA1
315f6735c2e03af71d18696c25632cb9fef4eca9

SHA256
90030d05070d4ad47758704ea73635604d37044a810e84a6877c3b0cdc62d9cc

SHA512
ae69411f5273e4a8a95d3ae80137c66605027da27f812950ea8904af3ce79766b014030eff1b6a3efc924b8c16834439f898c7a6ba8fbcdc3589c498b3076864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
732666cbb09ccdcd529101a08b20dcb0

SHA1
b1202cd66fa36836e61e47897783f6ace748dc67

SHA256
2eb98551202d0017773e41ef3276dbb9b3eb88ea9635ffc80792fd145540e7d2

SHA512
de3c3eba0d55bdc155cf99c70bac840d71d3ba545ca9d5ec1c6b5b1783b08e4e591efcbe6d1d1f6b26a3d078a5df43ca325cc527255a87608f0145056619f803

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 645481.crdownload

Filesize
1.6MB

MD5
568f7c906d45ff35c95961c922858959

SHA1
d3e5ec1c4f7699c72818b75849492fb8c24af319

SHA256
48b427450219751c5b38bb8b142c544ed639f0b69270b0f48e644e33da5339c0

SHA512
0635a29001975d6e633947fc74e4193748870cdbc1cf0b4fef98cebe0f179c4b1890eb7cb2b31174ab40d393e7d4158968c83a823fcc82b08c14881fe62ccc1d

Download Submit
memory/1728-134-0x0000000006F80000-0x0000000006F8A000-memory.dmp

Filesize
40KB

Download
memory/1728-437-0x0000000007390000-0x00000000073B2000-memory.dmp

Filesize
136KB

Download
memory/1728-135-0x0000000006F90000-0x0000000006F98000-memory.dmp

Filesize
32KB

Download
memory/1728-195-0x00000000075C0000-0x0000000007652000-memory.dmp

Filesize
584KB

Download
memory/1728-450-0x00000000076E0000-0x00000000076EA000-memory.dmp

Filesize
40KB

Download
memory/1728-200-0x0000000007E30000-0x00000000083D4000-memory.dmp

Filesize
5.6MB

Download
memory/1728-438-0x00000000087D0000-0x0000000008B24000-memory.dmp

Filesize
3.3MB

Download
memory/1728-106-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Filesize
408KB

Download
memory/1728-435-0x0000000007230000-0x00000000072E2000-memory.dmp

Filesize
712KB

Download
memory/1728-136-0x0000000006FB0000-0x0000000006FCE000-memory.dmp

Filesize
120KB

Download
memory/1728-133-0x0000000006150000-0x0000000006176000-memory.dmp

Filesize
152KB

Download
memory/1728-358-0x0000000007110000-0x000000000718A000-memory.dmp

Filesize
488KB

Download
memory/1728-132-0x00000000060B0000-0x0000000006150000-memory.dmp

Filesize
640KB

Download
memory/1728-105-0x0000000000EF0000-0x0000000001086000-memory.dmp

Filesize
1.6MB

Download
memory/5620-221-0x000001E93B240000-0x000001E93B241000-memory.dmp

Filesize
4KB

Download
memory/5620-212-0x000001E93B240000-0x000001E93B241000-memory.dmp

Filesize
4KB

Download
memory/5620-213-0x000001E93B240000-0x000001E93B241000-memory.dmp

Filesize
4KB

Download
memory/5620-219-0x000001E93B240000-0x000001E93B241000-memory.dmp

Filesize
4KB

Download
memory/5620-220-0x000001E93B240000-0x000001E93B241000-memory.dmp

Filesize
4KB

Download
memory/5620-214-0x000001E93B240000-0x000001E93B241000-memory.dmp

Filesize
4KB

Download
memory/5620-222-0x000001E93B240000-0x000001E93B241000-memory.dmp

Filesize
4KB

Download
memory/5620-223-0x000001E93B240000-0x000001E93B241000-memory.dmp

Filesize
4KB

Download
memory/5620-224-0x000001E93B240000-0x000001E93B241000-memory.dmp

Filesize
4KB

Download
memory/5620-225-0x000001E93B240000-0x000001E93B241000-memory.dmp

Filesize
4KB

Download