xworm | hxxps://fullcrypters[.]net/luxury-shield-crypter-7-1-cracked/

Analysis

max time kernel
269s
max time network
271s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2024, 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://fullcrypters.net/luxury-shield-crypter-7-1-cracked/

Score

10^/10

xworm agilenet discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

society-painted.at.ply.gg:17251

Attributes

Install_directory
%Public%
install_file
USB.exe
telegram
https://api.telegram.org/bot5817418329:AAGYtFww9eAGl3ZTuqrCmSNxu_TJJiAWkzA/sendMessage?chat_id=1860651440

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000c000000023dfe-1387.dat	family_xworm
behavioral1/memory/6020-1393-0x0000000000210000-0x000000000024E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3452	powershell.exe
4688	powershell.exe
1960	powershell.exe
1992	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Luxury Sheild v7.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WinRAR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Luxury Sheild v7.1.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.lnk	WinRAR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.lnk	WinRAR.exe

Executes dropped EXE 10 IoCs

pid	Process
6084	winrar-x64-701.exe
5732	winrar-x64-701 (1).exe
5140	winrar-x64-701 (1).exe
6080	Luxury Sheild v7.1.exe
5532	Luxury Shield 7.1.exe
6020	WinRAR.exe
1916	WinRAR.exe
4940	Luxury Sheild v7.1.exe
2492	Luxury Shield 7.1.exe
2104	WinRAR.exe

Loads dropped DLL 1 IoCs

pid	Process
2492	Luxury Shield 7.1.exe

Obfuscated with Agile.Net obfuscator 33 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/2492-1453-0x000000000B9F0000-0x000000000BC3C000-memory.dmp	agile_net
behavioral1/memory/2492-1462-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1482-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1476-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1474-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1472-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1470-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1468-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1466-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1464-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1461-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1480-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1504-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1518-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1522-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1520-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1516-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1514-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1512-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1510-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1508-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1507-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1502-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1500-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1498-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1496-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1494-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1492-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1488-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1484-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1478-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1491-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net
behavioral1/memory/2492-1486-0x000000000B9F0000-0x000000000BC38000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinRAR = "C:\\Users\\Public\\WinRAR.exe"	WinRAR.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5532	Luxury Shield 7.1.exe
2492	Luxury Shield 7.1.exe
2492	Luxury Shield 7.1.exe
2492	Luxury Shield 7.1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Luxury Shield 7.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Luxury Shield 7.1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 213613.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 225856.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5004	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
5252	identity_helper.exe
5252	identity_helper.exe
4940	msedge.exe
4940	msedge.exe
2260	msedge.exe
2260	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
5384	msedge.exe
5384	msedge.exe
3452	powershell.exe
3452	powershell.exe
3452	powershell.exe
4688	powershell.exe
4688	powershell.exe
4688	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: 33	1900	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1900	AUDIODG.EXE
Token: SeRestorePrivilege	2028	7zG.exe
Token: 35	2028	7zG.exe
Token: SeSecurityPrivilege	2028	7zG.exe
Token: SeSecurityPrivilege	2028	7zG.exe
Token: SeDebugPrivilege	3452	powershell.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	6020	WinRAR.exe
Token: SeDebugPrivilege	1916	WinRAR.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	2104	WinRAR.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
6084	winrar-x64-701.exe
6084	winrar-x64-701.exe
6084	winrar-x64-701.exe
5732	winrar-x64-701 (1).exe
5732	winrar-x64-701 (1).exe
5732	winrar-x64-701 (1).exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
5140	winrar-x64-701 (1).exe
5140	winrar-x64-701 (1).exe
5140	winrar-x64-701 (1).exe
5532	Luxury Shield 7.1.exe
2492	Luxury Shield 7.1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3412	3448	msedge.exe	85
PID 3448 wrote to memory of 3412	3448	msedge.exe	85
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 4720	3448	msedge.exe	86
PID 3448 wrote to memory of 1036	3448	msedge.exe	87
PID 3448 wrote to memory of 1036	3448	msedge.exe	87
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88
PID 3448 wrote to memory of 3188	3448	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://fullcrypters.net/luxury-shield-crypter-7-1-cracked/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe66e046f8,0x7ffe66e04708,0x7ffe66e04718
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1176 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7860 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8084 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8520 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8468 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8372 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8560 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8604 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8480 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8636 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7732 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7952 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8416 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8636 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8364 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8420 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7500 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5384
- C:\Users\Admin\Downloads\winrar-x64-701 (1).exe
  "C:\Users\Admin\Downloads\winrar-x64-701 (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:2136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2764

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x474 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3260

C:\Users\Admin\Downloads\winrar-x64-701 (1).exe
"C:\Users\Admin\Downloads\winrar-x64-701 (1).exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5140

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Luxury_Shield_7.1\" -ad -an -ai#7zMap12970:96:7zEvent32532
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe
"C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:6080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3452
- C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
  "C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:6020
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WinRAR" /tr "C:\Users\Public\WinRAR.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4216

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Pass to use.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5004

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe
"C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
  "C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
19KB

MD5
cc91acbdb8796cb031d0f8396b732e58

SHA1
93532092d02442069fd178f72f892e868cba20ca

SHA256
1166a5fc3b78ca97563dde576fe8ce70d829bb25e6549516c779c49a6c929d87

SHA512
f0ad89cbf331540e1246738dd8d56cf0b1eb6b1c43572d89b217f2caa1c8f2fa50569c290c2ef7e3e5a9c0d813bcb8243eb5012c0642ec64602770196d22b849

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
133KB

MD5
cb88b6b74e3a36d37c3fcb6a6b2ecf01

SHA1
e4c0dca86a19ced6587d9922c682de1b6e81e338

SHA256
c446508fa8bf9d9bf0c8d050d278dc35fe4c48994fb6111526f9c2ab8f7d40e6

SHA512
21d5ff45e9165a6c206ed89df55d32e0df621b6b7d939cc4a11c9b82fa94b69a5bd42292bbb57bb58047c7022a0c011354a88b8276a5949c8e4cea3820198f1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
78KB

MD5
6dceccec342d25e89c396ba0c9eec1bf

SHA1
f15ed7630eaf035a9ef0f6405ff39f04b062c68c

SHA256
1d6c31c21aab7bf215853cf6e5fcfd1c58da3316e927004f4816c3aa0f3c22ef

SHA512
ce85e85c69b710b833940207eeb883232d2b2aa92b0ca43ff33178f4ee191af78abe081f8bf61ce6c7f8b1dca4b2d5610bb0410ddabb426bac8fc9631ad3a4a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
83KB

MD5
df016c4465c42265b40806ec28b4badf

SHA1
088dc704e5edd580c3fc4c01ffabf2521f83f9b7

SHA256
13189bdec9d59abeac1c9ac27376f2384571ef85bbe022746a16004a87d17bd1

SHA512
be7a58b7b03029bd67678c11ebdd3112ea0a201fdfc130f809bce23fa92982e6ec3cf05eb35fdb6f6a10d853e3f3123184eb5b56dd91be36f3f0c0d87b6e4a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
29KB

MD5
79ffcf947dd8385536d2cfcdd8fcce04

SHA1
a9a43ccbbb01d15a39fac57fa05290835d81468a

SHA256
ffc11b830ad653e7a9d4257c7cd7a8056db5e7d7e89439b8fd67d1207b1729bf

SHA512
3dc82ecb2abc8c567434666a9162cc188de669927c3dada6392d8bd97d5e746f1ed350e1a02ec016ee2b1dc8a9cc5c71c553f2ef1293d6793800c276560859a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
108KB

MD5
ef9915d62e51d7e28dd154e6cf5a71d0

SHA1
57ce6106eda6f750da8f093ca1075d3823252524

SHA256
c4bb186261e8796042a76ed20902c788f547cf4e3ae7f24aba56f43baf6ce752

SHA512
52445e459dd13bbca3523b4fd811400e9fa7d9a4921c08f696d2701f97173957c9c12eeac6fa93c41450a5e2ce938202413851813a6c5c3b8ca6cd4d3d948d0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
52KB

MD5
7e003b440d22ba70ed8016eab73eaaa1

SHA1
d6b2909a5d3491f74982db9ee8c52290ec30ecde

SHA256
2f29e315f59c096e8126597544637bb2e12936e696493ae52c85654f12e8f185

SHA512
f6023bddcf92e0238800fd0853ac6a716566326506ec59c92f5bd854acd697e9884840ab1488c7a08a2c6472ad119b07da6d0f01bb61f69017bd920e2b8b9047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
68KB

MD5
dee46781c0389eada0ac9faa177539b6

SHA1
d7641e3d25ac7ac66c2ea72ac7df77b242c909d3

SHA256
35f13cf2aef17a352007ab69222724397e0ec093871ff4bd162645f466425642

SHA512
049b3d8dcfb64510745c2d5f9e8046747337b1c19d4b2714835cc200dc4ba61acaa994fec7c3cd122ba99d688be6e08f97eb642745561d75b410a5589c304d7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
20KB

MD5
bec2af13143a7771b0b89cec2ab92b27

SHA1
9cd25b2c17a630fd0d6dae4aa80ea510ef4b89b2

SHA256
52aa9c3bdb64b5d1c1fe6dbf456fc50da434916b6c7489f3c64a0ea9253408ab

SHA512
42d00250350982b0d3f26b84f33cc1365c8ab57f830f2f859cf3cdc8ba2879c09249264b1177c4b85de6a2461efe06620668c8d5bb036fde0b0030fa246075b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005c

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005d

Filesize
67KB

MD5
fb2f02c107cee2b4f2286d528d23b94e

SHA1
d76d6b684b7cfbe340e61734a7c197cc672b1af3

SHA256
925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a

SHA512
be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

Filesize
33KB

MD5
e4fb9b839186660b1f729b8df8c994b4

SHA1
931792cd70ced4ad586f6329c30c294ebea1548e

SHA256
6838611c8ab6539005e11c84ca308158f89a51db57a62caf21faab48bf576177

SHA512
625436bb52cbd7df7ed03be05fea52c5d54b6cc15037d70c268d9598e648a22246db902b9c6f097ba8b18bd924f6ab17120736285d54dce13773237f1669853a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005f

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
6cba37049931a104767e889c64202e43

SHA1
4c88033b110bf84641366523d8e3d9c3b05654d3

SHA256
12c30a6dba2685dd89caa675a152dcc45bed32d1cd2146dc9196cb3aac444127

SHA512
a16d8b73d65f3ab265a8ec1e20f572da281429bc98371c63db6938f1b026c9e33102fa98d64bedb68f4a21c1f9213f7f451a57c1a5e77ed2341f41601634d501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
e3980a4ecedd669aea328339b48f5b89

SHA1
e1f69876e2dcb2a1989ef887d613477cf0cfbc47

SHA256
592ef13d264dec0cba3d2283560432a634800186d549693386c0f60c5ce5055a

SHA512
8e23719a3cdd59ec84f1da18de8a6adac3a8ce9037cde64a199a5d81db862f8201a4ea33838351a3e7493de60a77c635cb2a719e6db5cb8d86c78a9247574cbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
6afaacb07faecfc277623753850e1111

SHA1
81c6db35e5d3dc15e4b8427272b12226b5f99f7d

SHA256
a65ac71d57273e9c07bf422826146548898c71c7b0738bbd3bff5c9787ac7b03

SHA512
8beae928145c577b56685d4e60a2020c47ef97f3d9f9444c7f1174dd67161e22a1b04b47f2d91b43810142ba50f81532871661fdd525d60a93582970410fa4ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
9821b971cfdc538d82cf731a75dc7d2c

SHA1
e452d6d3a3ed75d672c196ee4e42bd698922b78b

SHA256
88f9ae275ae8d027e7a93f8e68c526bef2f2921f377b2aadc2bef944b43988f8

SHA512
ba1c447c7b390659b1b4aba7d0d8930ad44c20396d7810a84329c08685995b9dba5a472fd5acb2ab70fa5942b1d7d36dc34a21ecb413874de35122dcf162a56f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
693d126523501b979c85e0066a4e0724

SHA1
96e16f3ee814b8ce12c799efd08afa5dc7b3a4ed

SHA256
368595cdce263ea606e318ecd4379469df2813850d886688518a10981aad1cb6

SHA512
291bc26b21881b19f62c93e09cfbfd144e7594820bbef4699045e83b3ff445765c2470dd0dd87ad1f10ea0a5d3df6c8fcd378a0f719e72db8baa88d4727980ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e357d85c014e01a989be0ee233c87b24

SHA1
081a654b1c58382efb6c4aa193e0f5ec20e5e9de

SHA256
75fef8171605db017c132a62abde107dd4b01e9f6f09d3d63b6854a7f6762102

SHA512
7889032d6603414640ad2e1060639ac13f562886de226d6bf4c8109657f4bcde5a6b4d55aeff34cf6ad2163affef515e0591061414c7c8c7ba320fdaf4277d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
908537416866e71a58bf05694ac1adbd

SHA1
20259aa4386ab37ce034608db439463fd28cbd89

SHA256
ed4abd54ac5afb463f1eb79f709653021c97bf46117f67bd2485b799025e0848

SHA512
d7a156ba118c2b28bbef5dfad60de0d443386fbc3a4ce341425cd30e6363c1046fc994ed554a0c3283f1e503cbc304a353ba6556d41a474e3465c2380b7c7022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8fb6679bb536d2833e4ccd24416079c8

SHA1
a1548a20699a3d98cbd8f0c9ea19c8c1106002d1

SHA256
74233b564992c71f338ff98687c9b184d416934f917fea4820c4ab55238a6629

SHA512
51db46c456e753f629fb41023976aaccb554170b0d989e1e4951d8e9b3954213629f6a23ebd09d2b55a7712e0cbfcb4f0244c8edd8139b98681842f28813b05d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
b55b617abf5ea857375ddd6caa6bfaa4

SHA1
0bca6c4ab1463adbde044ff0487e1dfa7e05da1f

SHA256
5bba0c4a7d5051b3f890e15144062b96b33ca749999560fec015c345a9e42fad

SHA512
60882e1f8e32292abef79288e2e5f3e4005d139cbed73cbd8a2fb252ce247df01264e5a26973810aa58ba49cca41ec8fbf308791ffcc7ffc7a2f2903704b6205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b8e5e677b9625a5f1b4e0e7c3378c1e5

SHA1
af31bccd5a3c7ffdbedb32591be9250b734bbeaa

SHA256
bf4e240d6c32f1795e900a6722d9a306eb24af33ca504e894c69b6135e1660f0

SHA512
4c8ec27d35de9b7a5fb436e7e0a5510345c641afc346395f43f037c77dc8f3b516a7211f73d6cab89be798c10f25504b5258b807c0a41d20034215b227775f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f38ab557e609af1aff4d67effbf90751

SHA1
0270f95c35236aa431b1af40916660abd82707aa

SHA256
4fe81adb20f0c0ef32add5b6203d57b7194b6e427cb1769f6277a06235eb553e

SHA512
5be4a4242750794cb844386a6b2d21f2dd50018d47b23b555f487bdd6c046000828743f24074c7e9094ba55c520941e9a778efd3a7a96e3ba264542af65c682e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1b6a405b0f7fc6d63552fddc803d8b2c

SHA1
b19d395e62ee38c361ca4ddc55704291c3ebc0df

SHA256
b83045e0be414a99253afae85776e8a825a2abe28af8187ac9d6da80f3417a96

SHA512
e7d95bd01661a63df9d2eb037a978250c5b97a54ab92dea1c65f26506c4a1ad61dbb5d9a616e22cae7158f578b65fab579d23b6609ba9bd19be0a7f16458091c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
b0995e04d2a51700f84ef99193d1d4f1

SHA1
de59d4a9d6fc7cae40a69debb27615672f0661ae

SHA256
d1f2529768c6109d0e600d9a75731daee32fe2d528f9766e2b0d7ec29a942aaf

SHA512
fb7c8686acca0150114f233f7e6e184b97c99746fbcd17ef3473a6b6cfd26ffc5d9bb3dc2ac2a2f617b41dfa60ab7034c459760d466c53de4cfb1a34b4c14761

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
e3d32efac5e818fbbccfb9a6d0478258

SHA1
d9843341a34740e1129ab03df066516914f61cdd

SHA256
96d8b6d013a3ce4105a2a0e7466425ef8779fecb95db9e7da3ba85e281a07cca

SHA512
bbc46c21bf962f8ada248af2032b3d775eeb45e38ec7b793790024a3dee3d29d00a4589e1c7802f1a43f410f5dff14f87b35dd1b5c72caa8d2c521044217b6cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d8d456c0d93ebaf15cb111c6f957b303

SHA1
e99cabba415f5c82e1cbd8a0b5bc9f512d238711

SHA256
e6e719a4ed189ca17edda20b91908732b5afe4311bf1f44ac11eace1f033053f

SHA512
290686fa5741b0d1352d660fb5f033040dde5699577c1a4ce1b9c0f4821ce74de9bd8284239a172a8ff8919c340712eab05dd6a8ccdc1161dcfd66c95e8140c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ba5c70df9dc74ea6cc1f6fbc75d45e74

SHA1
93ce04aef20c76290a1f4d08674803d2ab68f7dc

SHA256
ad5bbe9e609a8ff510fd7a6ea4eb6e34d5d16d4d7f5d5b760cb6c42b36f8a62f

SHA512
f522f3a3263ccd103509cbc3322f28031593073fe7de9415bc6424717c381dbe6b5857fb8ad783b781bae21eed6cb13b3bb9063df03664912f2e179d6110b7ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
44959862763e68178a81f81227a51dda

SHA1
b9036e8e88d28e8c2f51071d274cf085ec18e754

SHA256
634112735e623e5071dec330c12f8841888b4073f4821197bbfcb86b81866a90

SHA512
a27a933b7475166267943b516b0d5669ebfb89fe2db7fa70a36028063cf70c14bacf51bc5b0556c2cd52abeace6bc799e0c196a9d6c1cc0c71394592af35f38f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
67ac5ac58f55553baec07d38b35c67ea

SHA1
e4464f8b6e9966c008ece08af6f38cb12953e0ed

SHA256
f4fb9a9847e5667f8f607d1e74ccd26314dc658f8d7f2ee0b9936aaf72e64936

SHA512
f9c1390997bfafdf09d500cf759cdbb366ab0fd9950beaa6f577a0ff1ba40da178fe2fb11770e0c7488211e7338ece512e32dc0f932500f76b5ad334e9531294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2a8cfc8eb5f767eb0cf3d7900b02f1e7

SHA1
d5fab94360569d3047003df3e3b64793257167f4

SHA256
8ab179fb719e62ed39bf041aeae59d72041b47990f11a84705d09b6597612ef5

SHA512
b0ec484ecdbb66aa185322a8800419af2afc27fd57d8aafb6cc7085922e1bb495bc6f8c7bcdefa595292c65022e2599857294ba07f5648b745bc8a8bb745dfce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
f6da9e0b6ef8c0db03a3d2d8ab918aee

SHA1
000cd1c772dc612a96149acf3621e27720bf7d26

SHA256
905a9a64a377bd651413e31dac03f0c79d3533502d907bac4b4ab01525559e19

SHA512
b2ef6d0875f1346482d8419f6fc311811f7135b5b381ba56ebb45ddb7a2bbe3f4931e9ee2d8ca3197f5aad6ef8a76def575889a193766a7c0c6b1378f24c0abe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1b74387b5770cd930dfd3842a9d6144c

SHA1
4f0d9029146def459e5b103ef22aea7cc607b0f6

SHA256
91033ed33fd4764314dca358e29979c566af623d0149e09a4160c7a6c43329b9

SHA512
2f74938cd1fd73181fb8e19bf8b02f27655d8b9e4372521d4aa561a6dcf5b94a5be1d1a7ea273f7b2f3ad8bd7b3ad8d2d0f6874912eb65ca84b4aceea67b31ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
89d9087c9458af3d9dbf104302d6515a

SHA1
1196a86a7dcf511743bac619151655897dfef206

SHA256
b2f1078cf0e58cf7e8ae0ff3f511117c7473a877dbcd491f5d5a938099fa9068

SHA512
74dcb6427b13f5817406f371eb4a0e159e1dbd04ceb25493d4857502fbf61143dfadb082572b3d1c8749f06afc8cb866cd48d280377e122fe83bee901abff09b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581827.TMP

Filesize
702B

MD5
5f12a1008b415375752f505a4b85f40b

SHA1
0d1453a8a364d23b916e1840555a1feb72296360

SHA256
cc47a5eaf23df607808da914156e1775f356711a99aa7b43a1d1db103dc25f32

SHA512
2fb708a45f9324e3b72e9874166fe508dd61db1d6b972cd189d56ce1293ad4d36c6ad22041ef291dc64a33846fbfe0b0d23ac570913d1f4bffac90063e6ea656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc29dbb4-c9dc-4245-87df-8b9f7c7fb0e3.tmp

Filesize
14KB

MD5
d9315cefaefdd8347784627661083acd

SHA1
bac8d2031b4b401242608e7269973a315b5b6533

SHA256
0f200982d78a4f020f456d5a98a7d7b3bfb77d3be6e34f2670b710953201dff8

SHA512
47eab3943746455cce0da18731a85fc2ba2e07e1a35b34d538c7534e042b8619df4e66cfae9cb42d390b12c35397e4a1b71b74496d7941e631b72d050e94a883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ad45a8722321701579db92f3536a3313

SHA1
1f3c7f0b676e39443a53a7e73ad33ea7e020b769

SHA256
83ca5791d299937db692de96e45a4b14f3b8d912510e6cb24537243f1a74df37

SHA512
c495bdd5c173e208dce02af160f0cf964a449e71ef78b205026c97ede2cc257d16bfbcc3b44f4b8b499a52b4d5c007e93fe7143739cbb524994b8a2b6d9051b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e2c18acba21de1b3de0d3c655b72b688

SHA1
b1962c5acdbfffb9f3c84fa075ddc9427cc65801

SHA256
f6910ca7b37b06f9c8c7f1db6c980accd4331c646429fc12ea7905052254216a

SHA512
2bf7e5156ecf03bcfca87e75c6f2f7c8caf2f3e23035ec576cdcb933c06500b67f37212073f0bfaee004caf80b63404225eff00ac5eeb74992e5eeff8dca3505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8479bac0d42c7338b787c810350020eb

SHA1
bd207c342b5d9e29d0936f66fc76cfbd8984d8d5

SHA256
9fa4f82392628506ed3d9c556848c6325c7f710144893fdb1d7462e64966d7ae

SHA512
ad66a7c5b57174d66cacd833b90a81973e7411ec92bb0a317c5eade69bf3e7d0fc38e7e3c9ef83a9a7d54b438139da536bb1794f40294ceaed9b896a8b951a8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c69568c00cc905a5f678d2d405384813

SHA1
ceec665bb5f7f4761c285162581f3f5e84721458

SHA256
5ac19c75cf83728808159eb175f27de10944c8c09a22bfeb3b09bc3bf9257472

SHA512
57bd707b36ef34a16ac9877feaf8b8e725408cff45069a3a8b5e304591c45ef71d4d623a3f7aea1b6fc0273a303aa2bce44bd2e6c94f33d74fcedf84414d97a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
54228ee5fda3ace67edad0c57199bc6a

SHA1
28df47f413a8548f1c47507b7e1c52d01efa2de7

SHA256
4584ff3955d199144637678912469adb1ca58b35aca0d577542215ba23b3cea6

SHA512
f3b54a1fefbdfc2ef79b11a94ccf9bc549953f81963ff1252cd9d69bdc911762801dd7469177fa7b695646a8ee2ff7883bc8d3869fe22d1e566c8d7b9e5dbba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6759c762c8292bd0f8c520c66fa3067c

SHA1
0733fc0ebd5018c71635ea86b25bf157a6b3020e

SHA256
4b4ae05317184691caa77afdf10387f02f5296455b2c803dcfee31130727b21c

SHA512
4d1c651b93726141a48241baa70cef7b3a6a61dd647fea52b277a90f1ffbd8c9e5d4add2035cfc42d653aa5ed00def8473f6ed347fae65cc44375beb501e8137

Download Submit
C:\Users\Admin\AppData\Local\Temp\53b4dde3-ceef-4149-b63d-4b67cc36c3e9\GunaDotNetRT.dll

Filesize
136KB

MD5
9af5eb006bb0bab7f226272d82c896c7

SHA1
c2a5bb42a5f08f4dc821be374b700652262308f0

SHA256
77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

SHA512
7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe

Filesize
7.5MB

MD5
9502776952e6900ae1f98934004b4293

SHA1
3905f80a539d37c648a5da1cc6dace16d3516c2c

SHA256
d8ca879cf734c21b84e3983a9245c4da2b38cfe23b1691e4ca265286c3782b1f

SHA512
cbef89e577c883283ce3e9bb48e2ba9eda010e40e6cb1a383d99e32b728a9553cdb83e0831c0bff961fd271cee4eab921f53c97d9412e87bec4d0498400b5fbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinRAR.exe

Filesize
226KB

MD5
60219035e32ad00d4c691a1bdc6455fb

SHA1
5f3740fcf89a95437ce184cfe22f23ed8b5b9254

SHA256
e005f5c2e4fdd277ced1ae42272b864e47de334e0d2a1043f24c21253da18ae5

SHA512
b98eb125f7812ac5d2243bd0d6ee07e918af5d0a46d86a6b242a7d8f91dbaaa48fabb562c316abbbf93db0c5ffc3a16184233000b379bafcdb3104c470055fc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iwgjvymj.5ld.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Luxury_Shield_7.1.rar

Filesize
7.6MB

MD5
e807f84e4b7d13b129f885a8de6e7706

SHA1
cc11599037ba929b3c39a054d6c49ba59444aacd

SHA256
97815a8a4139795fc19b4cdb27e27b6eeee9a4c344846f2e44f46405778515d9

SHA512
a791ef8fed590b2e5af5d7b3b47ad0bfdb5334e41c0275bc8bd37ef7beab150befe69de1db41a3afcce49bf1e2abdfdc53f969d555406ed982949db76e254045

Download Submit
C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe

Filesize
7.6MB

MD5
f145671c3c65072a5a49f1d1d68a4a3a

SHA1
2453dddb4e6ebd48604fff3094f6a59dacdc3ad7

SHA256
d5dcde7ced43245641793538f847c55e3271f5ff8eb45fa5616a00634b7e64a1

SHA512
6f9bb2a1c9e4f90c22f7e0675c6d0ab06e0b7875c432d229739000c568a9a0fa5024cd36ec6b947b520704ad706b945371029c24766cac3fb2d509f478dc6902

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 213613.crdownload

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.7MB

MD5
3a2f16a044d8f6d2f9443dff6bd1c7d4

SHA1
48c6c0450af803b72a0caa7d5e3863c3f0240ef1

SHA256
31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

SHA512
61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

Download Submit
memory/2492-1472-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1464-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1486-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1491-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1435-0x0000000000DC0000-0x0000000002120000-memory.dmp

Filesize
19.4MB

Download
memory/2492-1446-0x0000000000DC0000-0x0000000002120000-memory.dmp

Filesize
19.4MB

Download
memory/2492-1447-0x000000000B4E0000-0x000000000B57C000-memory.dmp

Filesize
624KB

Download
memory/2492-1448-0x000000000BD60000-0x000000000C304000-memory.dmp

Filesize
5.6MB

Download
memory/2492-1449-0x000000000B690000-0x000000000B722000-memory.dmp

Filesize
584KB

Download
memory/2492-1450-0x000000000B590000-0x000000000B59A000-memory.dmp

Filesize
40KB

Download
memory/2492-1451-0x000000000B730000-0x000000000B786000-memory.dmp

Filesize
344KB

Download
memory/2492-1452-0x000000000C310000-0x000000000CBF6000-memory.dmp

Filesize
8.9MB

Download
memory/2492-1453-0x000000000B9F0000-0x000000000BC3C000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1478-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1459-0x0000000070AA0000-0x0000000070AD7000-memory.dmp

Filesize
220KB

Download
memory/2492-1462-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1482-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1476-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1474-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1484-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1470-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1468-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1466-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1488-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1461-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1460-0x0000000072670000-0x00000000726F9000-memory.dmp

Filesize
548KB

Download
memory/2492-1480-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1504-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1518-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1522-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1520-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1516-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1514-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1512-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1510-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1508-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1507-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1502-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1500-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1498-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1496-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1494-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/2492-1492-0x000000000B9F0000-0x000000000BC38000-memory.dmp

Filesize
2.3MB

Download
memory/3452-1349-0x000002D077960000-0x000002D077982000-memory.dmp

Filesize
136KB

Download
memory/5532-1372-0x0000000000420000-0x0000000001780000-memory.dmp

Filesize
19.4MB

Download
memory/5532-1414-0x0000000000420000-0x0000000001780000-memory.dmp

Filesize
19.4MB

Download
memory/6020-1393-0x0000000000210000-0x000000000024E000-memory.dmp

Filesize
248KB

Download
memory/6080-1348-0x00000000007D0000-0x0000000000F76000-memory.dmp

Filesize
7.6MB

Download