xmrig | hxxps://github[.]com/AJMartel/MeGa-RAT-Pack

Analysis

max time kernel
869s
max time network
872s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
18-11-2024 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/AJMartel/MeGa-RAT-Pack

Score

10^/10

xmrig defense_evasion discovery evasion miner persistence privilege_escalation upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 14 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/228-458-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-459-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-461-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-460-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-463-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-462-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-475-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-476-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-480-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-481-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-485-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-491-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-523-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral2/memory/228-529-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exenetsh.exe

pid	Process
4012	netsh.exe
3448	netsh.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
behavioral2/files/0x00280000000452f0-584.dat	acprotect

Executes dropped EXE 6 IoCs

Processes:

TiWorker.exeDeath-RAT.exeDeath-RAT.exe888 RAT Private.exe888 RAT Private.exeshia hacker -rat.exe

pid	Process
228	TiWorker.exe
1056	Death-RAT.exe
4504	Death-RAT.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4992	shia hacker -rat.exe

Loads dropped DLL 6 IoCs

Processes:

888 RAT Private.exe888 RAT Private.exe

pid	Process
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
3396	888 RAT Private.exe
3396	888 RAT Private.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

Processes:

cmd.exe

pid	Process
2824	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
78	raw.githubusercontent.com
79	raw.githubusercontent.com

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/files/0x002a0000000452eb-552.dat	autoit_exe
behavioral2/memory/4840-591-0x0000000000110000-0x0000000000825000-memory.dmp	autoit_exe
behavioral2/memory/4840-602-0x0000000000110000-0x0000000000825000-memory.dmp	autoit_exe
behavioral2/memory/4840-599-0x0000000000110000-0x0000000000825000-memory.dmp	autoit_exe
behavioral2/memory/4840-608-0x0000000000110000-0x0000000000825000-memory.dmp	autoit_exe
behavioral2/memory/4840-627-0x0000000000110000-0x0000000000825000-memory.dmp	autoit_exe
behavioral2/memory/4840-616-0x0000000000110000-0x0000000000825000-memory.dmp	autoit_exe
behavioral2/memory/4840-593-0x0000000000110000-0x0000000000825000-memory.dmp	autoit_exe
behavioral2/memory/4840-596-0x0000000000110000-0x0000000000825000-memory.dmp	autoit_exe
behavioral2/memory/4840-633-0x0000000000110000-0x0000000000825000-memory.dmp	autoit_exe

Drops file in System32 directory 6 IoCs

Processes:

Death-RATx.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config.json	Death-RATx.exe
File created	C:\Windows\SysWOW64\MicrosoftWindows.xml	Death-RATx.exe
File opened for modification	C:\Windows\SysWOW64\MicrosoftWindows.xml	Death-RATx.exe
File created	C:\Windows\SysWOW64\TiWorker.exe	Death-RATx.exe
File opened for modification	C:\Windows\SysWOW64\TiWorker.exe	Death-RATx.exe
File created	C:\Windows\SysWOW64\config.json	Death-RATx.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x00280000000452f0-584.dat	upx
behavioral2/memory/4840-585-0x0000000010000000-0x00000000100BB000-memory.dmp	upx
behavioral2/memory/3396-858-0x0000000010000000-0x00000000100BB000-memory.dmp	upx
behavioral2/memory/4840-859-0x0000000010000000-0x00000000100BB000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3bc54054-7c1e-4b5b-9490-a69750fbf875.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241118223409.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

888 RAT Private.exe888 RAT Private.exeDeath-RAT.exeDeath-RAT.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	888 RAT Private.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	888 RAT Private.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Death-RAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Death-RAT.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
2976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeDeath-RATx.exemsedge.exemsedge.exe888 RAT Privatex.exe888 RAT Private.exe888 RAT Private.exemsedge.exeshia hacker -ratx.exe

pid	Process
3884	msedge.exe
3884	msedge.exe
4536	msedge.exe
4536	msedge.exe
4984	identity_helper.exe
4984	identity_helper.exe
1996	msedge.exe
1996	msedge.exe
868	Death-RATx.exe
868	Death-RATx.exe
868	Death-RATx.exe
868	Death-RATx.exe
868	Death-RATx.exe
868	Death-RATx.exe
868	Death-RATx.exe
868	Death-RATx.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5612	msedge.exe
5612	msedge.exe
6128	888 RAT Privatex.exe
6128	888 RAT Privatex.exe
6128	888 RAT Privatex.exe
6128	888 RAT Privatex.exe
6128	888 RAT Privatex.exe
6128	888 RAT Privatex.exe
6128	888 RAT Privatex.exe
6128	888 RAT Privatex.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
3396	888 RAT Private.exe
6100	msedge.exe
6100	msedge.exe
6112	shia hacker -ratx.exe
6112	shia hacker -ratx.exe
6112	shia hacker -ratx.exe
6112	shia hacker -ratx.exe
6112	shia hacker -ratx.exe
6112	shia hacker -ratx.exe
6112	shia hacker -ratx.exe
6112	shia hacker -ratx.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Death-RAT.exe888 RAT Private.exe

pid	Process
4504	Death-RAT.exe
4840	888 RAT Private.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

TiWorker.exe

description	pid	Process
Token: SeLockMemoryPrivilege	228	TiWorker.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exeDeath-RAT.exeDeath-RAT.exe888 RAT Private.exe888 RAT Private.exe

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
1056	Death-RAT.exe
4504	Death-RAT.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exeDeath-RAT.exeDeath-RAT.exe888 RAT Private.exe888 RAT Private.exe

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
1056	Death-RAT.exe
4504	Death-RAT.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Death-RATx.exe888 RAT Privatex.exe888 RAT Private.exe888 RAT Private.exeshia hacker -ratx.exe

pid	Process
868	Death-RATx.exe
6128	888 RAT Privatex.exe
4840	888 RAT Private.exe
4840	888 RAT Private.exe
3396	888 RAT Private.exe
6112	shia hacker -ratx.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4536 wrote to memory of 2168	4536	msedge.exe	82
PID 4536 wrote to memory of 2168	4536	msedge.exe	82
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 4360	4536	msedge.exe	83
PID 4536 wrote to memory of 3884	4536	msedge.exe	84
PID 4536 wrote to memory of 3884	4536	msedge.exe	84
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85
PID 4536 wrote to memory of 1888	4536	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/AJMartel/MeGa-RAT-Pack
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9e5ad46f8,0x7ff9e5ad4708,0x7ff9e5ad4718
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff626f35460,0x7ff626f35470,0x7ff626f35480
    3⤵
    PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,3236628868108942607,11342890281232698301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4088

C:\Users\Admin\Downloads\Death-RATV0.10\Death-RATV0.10\Death-RATx.exe
"C:\Users\Admin\Downloads\Death-RATV0.10\Death-RATV0.10\Death-RATx.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate" & schtasks /End /TN "WindowsUpdate" & exit
  2⤵
  PID:2036
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate"
    3⤵
    PID:3692
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "WindowsUpdate"
    3⤵
    PID:736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Delete /TN "WindowsUpdate" /F & exit
  2⤵
  - Indicator Removal: Clear Persistence
  PID:2824
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "WindowsUpdate" /F
    3⤵
    PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=out action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
  2⤵
  PID:4876
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="System" dir=out action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=in action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
  2⤵
  PID:5084
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="System" dir=in action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Create /XML "%windir%\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F & exit
  2⤵
  PID:1856
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML "C:\Windows\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\TiWorker.exe" & schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit
  2⤵
  PID:3408
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "C:\Windows\SysWOW64\TiWorker.exe"
    3⤵
    PID:2104
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate"
    3⤵
    PID:216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil –addstore –f root MicrosoftWindows.crt & exit
  2⤵
  PID:3708
- - C:\Windows\system32\certutil.exe
    certutil –addstore –f root MicrosoftWindows.crt
    3⤵
    PID:2472
- C:\Users\Admin\Downloads\Death-RATV0.10\Death-RATV0.10\Death-RAT.exe
  C:\Users\Admin\Downloads\Death-RATV0.10\Death-RATV0.10\Death-RAT.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1056

C:\Windows\SysWOW64\TiWorker.exe
"C:\Windows\SysWOW64\TiWorker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Users\Admin\Downloads\Death-RATV0.10\Death-RATV0.10\Death-RAT.exe
"C:\Users\Admin\Downloads\Death-RATV0.10\Death-RATV0.10\Death-RAT.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4504

C:\Users\Admin\Downloads\888 RAT Private - Cracked\888 RAT Private - Cracked\888 RAT Privatex.exe
"C:\Users\Admin\Downloads\888 RAT Private - Cracked\888 RAT Private - Cracked\888 RAT Privatex.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6128
- C:\Users\Admin\Downloads\888 RAT Private - Cracked\888 RAT Private - Cracked\888 RAT Private.exe
  "C:\Users\Admin\Downloads\888 RAT Private - Cracked\888 RAT Private - Cracked\888 RAT Private.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4840

C:\Users\Admin\Downloads\888 RAT Private - Cracked\888 RAT Private - Cracked\888 RAT Private.exe
"C:\Users\Admin\Downloads\888 RAT Private - Cracked\888 RAT Private - Cracked\888 RAT Private.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3396

C:\Users\Admin\Downloads\Shia Hacker School -Rat v1.0\Shia Hacker School -Rat v1.0\shia hacker -ratx.exe
"C:\Users\Admin\Downloads\Shia Hacker School -Rat v1.0\Shia Hacker School -Rat v1.0\shia hacker -ratx.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6112
- C:\Users\Admin\Downloads\Shia Hacker School -Rat v1.0\Shia Hacker School -Rat v1.0\shia hacker -rat.exe
  "C:\Users\Admin\Downloads\Shia Hacker School -Rat v1.0\Shia Hacker School -Rat v1.0\shia hacker -rat.exe"
  2⤵
  - Executes dropped EXE
  PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Death-RAT.exe.log

Filesize
594B

MD5
8ca501bd97c9d18a3eb74ac373498060

SHA1
4f2b380208d1bdd0e01d8595b0200055fda048e1

SHA256
81e00cd8e81cd8fd224f96e9e0b468bf9b6bcd59bf0a1a94b144975dea8e4c24

SHA512
2e136e6b02e8656ebf729a77eb0dc1297e87eb4750c21c378714da8c0f80a1a101605b4353ac299695e8acc12ca7b0aa14ffca647274d3983c473402a8f50bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef84d117d16b3d679146d02ac6e0136b

SHA1
3f6cc16ca6706b43779e84d24da752207030ccb4

SHA256
5d1f5e30dc4c664d08505498eda2cf0cf5eb93a234f0d9b24170b77ccad57000

SHA512
9f1a197dccbc2dcf64d28bebe07247df1a7a90e273474f80b4abd448c6427415bace98e829d40bccf2311de2723c3d1ad690a1cfdcf2e891b527344a9a2599d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39191fa5187428284a12dd49cca7e9b9

SHA1
36942ceec06927950e7d19d65dcc6fe31f0834f5

SHA256
60bae7be70eb567baf3aaa0f196b5c577e353a6cabef9c0a87711424a6089671

SHA512
a0d4e5580990ab6efe5f80410ad378c40b53191a2f36a5217f236b8aac49a4d2abf87f751159e3f789eaa00ad7e33bcc2efebc658cd1a4bcccfd187a7205bdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
20e132309e05a9138892c157a0619795

SHA1
463d0602d8e18353f5f7c038c92cd29e19d765d9

SHA256
0b8357bf387708041dbb7a7bf0109caceb0b4f849ef6fef8c108f8ab5602446f

SHA512
6d146e36712d26660c53c4136fa65c6248ce518e1e445e4473acac16677bdf3d1a8ba85fa09a532bf48d31d629e6711557287bb8180a789813cf70744a57184e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c2c204d17f99dcc083fa4c46ee77f991

SHA1
169de5e5e00b754418f614ef6deb6457f5d7e401

SHA256
1dc9a8ddb0c366db3c070b24e2b13fd95e62b1414b86c7ea3a99a7807628d150

SHA512
7d252e99daff1a92f5fc0723181a089b06a66226107942c34e56699b161faee7540dc800061bd373a8ffab6b010b4eb208063c573c797202ce9ccd336c07a2fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ed66a3a33badab873835f170e5cecf66

SHA1
dc37bca24e8de18978d290acf967e19b991ee549

SHA256
ee80dbea6b42f9807ee863a52f916ae8599061510c8e5cd42bafe4349d9920b6

SHA512
66280522469bd90407fb92906f43b5489acf2cf05cd4264bf855e600a0ed30ab2e1d2b09cbf7ecd5fb9b79c289035ffff57b5dfb37ce6429fddb87f44ec069b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
06a12efe865f06983dd1fb26bf34953a

SHA1
85f36e55fe32c8dc5ad3cd06087a9680b1071ba7

SHA256
f7714ed7bc9d747077a96db562b7e6686600a4427e29a224931725e758bd2b9c

SHA512
75479178b57c189ef3342af9c34192c12f378ba33764e5070abc7f1cdc2c97037d8d0cdd3b69faf5eab3933f2c4ed0e5a99611dc8e4dea5d19893cbfef87acf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
937B

MD5
c357fbf4b9c401dec4ebf3e46bee08da

SHA1
ca5402c9fc454b6e520b3903a4bc9346ef05d7e3

SHA256
174c42d5aa3104945d0bb283b37108100b7f5b41fa069286cba593536b20b5d6

SHA512
d457d9d048c5c2c2146d48d57ff7b4db8e760b0facf688a93cc166b76bec082797dc253e835b1c9653dec54085159944a3312bf825cd40809763c04b01b7ee41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
10d8b7fb3fc6481cb725f54621a2668e

SHA1
cbdb7961cd32a9d58a537296caee1fa16997e1c2

SHA256
afdec0f478b396b86d4b3ed7abaa17c6e91ad713099eace9bd7ffd96120c020d

SHA512
25faae89a4b51f124055d0c6fd4edac300fa6673a30b7a9b1c83129c028141011cd36612383e6f56e815909bd0965bec07a7656b396b4347918314b9d3ee52c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58d3e5.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
946ded8f8a4145d424358850182a567c

SHA1
727845a837a1ff949087b5a33477d13c158e67ce

SHA256
67b4895c33e8ed47da8454e55c151a704f7188ae468e7b1ba6fb34748d90106e

SHA512
bc069e1f68a9526a7b15ebe4f9deb1742f23ae8dc13de2056acb3ef52f4301a5cf6af91fd498abf715d35f3aefd35873c9d3662692bab5629f1da631847c72ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e1ed086133f18c3f2969f3ff4b9f7cf

SHA1
14817cd2a92994d93351fe54ace3ed89aa05e922

SHA256
5fbd741c488b0533e26c7f0901acfb39fbed8ecec3659858ef6196c7e7afe3de

SHA512
ea41922b6e945f2665ed1e0ec036816820a46b29318daf6e0fee30a481577c441c28a199c8055acb6b7517604323309a45c6b0ce53fbc01a019244ff5b9c8aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d48c2963e3641532650f06936a13f45b

SHA1
650f433da12d06dfd949984a53d4f75dd263699f

SHA256
47d9aa563112233f0ae1bee1ee1282e85c4c65a9e6aa7fc91defba6436e55238

SHA512
2b27b169511b73fea63b9c55bfe3b29a234518e3eee347273ef9d6915f7ef25a36666ce4e8b4aef0f38f9087e25d5268575864791d769cf39a9db448812d806c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dbfe5a9104d067473b4871d420745168

SHA1
6a3be560546c9620ce8188bcd010fc129c6b54d1

SHA256
1e0a7aa357cddb5cfe62e230d06dc9db0e686d80701b03005ec898a1d3af8472

SHA512
389ded69b2d27850e7543a8fa40460670ae86f3f1db457a5e660870b4bb5a9fab7351ac0afac8525d7d9bf3375ec22fc72e34016cd32ec58a9d882e544789530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3818a1893d877a40e5a5eadb15dfc97

SHA1
fa4324906bbf3b443f2e36e8585b1f507a2b38ff

SHA256
99c125e5a6d30f4538feaca0acb5d56b39710c68b3b147e1409ff642afe9a1fe

SHA512
f98eb62775b8f4364d49a98fb1973be093271fb874422bec2e9ff60c68c6bfa99f9497a9bf8e53157fde19a2f37c66821868c5ec9bbe164738df14458aee672b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b568552544ce4866c3594dc7030b25e3

SHA1
58a02ec65d20bb6bf2da99029370f012f8098b0c

SHA256
76fd09320bdd9c97da5cb9013fbf0f1da2e7335a4bd2092d453e6273f4047f30

SHA512
743caefeb9b59359e54d13a48798588c89d8822c6ab5f180c483494210e3bc46fab595fd88c673aa0c3e4aab6d9c3f28ade085e1addfc6a87e678227fe3dbb74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60d82bd601d64fd00bb0373f5ecd65b8

SHA1
0e8bde426270dfa3ea285c2c5b7282ab37771d4c

SHA256
bdec91a5061c6a400ef33c2dca5b1d0c16c1fe9e464f8ec99a72442b752e6a97

SHA512
5ea1b33784438acd246c02c95716f72c78293bc8d8e8e6d71aeaab370ae9fc2063ba8ffa443bbfc26c96e45a95549b62894b846a459c986531b34a110d0be38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e98d1679e15688ad133f11eee8458ee

SHA1
a4b1a83f0a3f2867954d3146d95d314441950606

SHA256
8aa7eaf918f2969424996a8f3575478006d9d74b308a750f996fe4f5f045554e

SHA512
eb34d52a8df4992444000a93c8d0d11254069b5f43a68a6def21061be03a538f36c42b2e968a8637f12b93235de3140002b0212aa2cdebe0950fd115c04bc72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f4c660fe5226694816c66dc49d3d3ed5

SHA1
ae4da82a3546221af5144c30fe5ebacfea32844b

SHA256
ffbea259ddc77903c3b7ccfcb119d96e70f90d8f62addc202c17e343a5d8bb19

SHA512
2c0e8905a3a2e30cbbc3b2549b9ee89be143a622695bdd82dfe3c03d54a2b670ab3e90a26b79542f28d8bde5e5b61ac6d983df0152b8743bb575e54d9bb7aa80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
48764d13353a971a4207172ee02a4a74

SHA1
fb17da4c2eac6b2379c74303f3bfab1f23270bbd

SHA256
ccd0aa553a143e14d95709700e089c14a5f35c12df3480abf03ba6dfcd4a103b

SHA512
759ad523f56c63aa5c2d9e96f6cde5d93dddbf4d87095a9a7d08a17f8813e2f67399a745b152389b08ba595abeb85af4516316c63c22478c017c718bb7aa6c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f921d22d2160cbfa7d379ab97371c2f3

SHA1
942a70b879bf91f818b8ee609a440efeea18bae5

SHA256
f34f584874b3074d07e4c9caa041e22c1254aa19de63026f55d565745ed77107

SHA512
36e4af3c93a0d72b66cdc5355318071b59e825253b9e92b30e7ae3028ab81925ac832232f8b4cd0e1d729c3878e980377627b087eb3b9f9b68797f070c1ae2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
449a6b966c93fd5bf6fb717340abc3cc

SHA1
fb866b408b29aa2933a3aee22c84da3c84ec7ef2

SHA256
d7b6f50938defa8fad4b22162d9be06c69ee1c2bb807abb13fb707450c67e880

SHA512
7f7bb96907391909f32bcaaba748469122af17264e7dc31b8764a1543fb95f2a2baa0a15d398c578807cc73f57795639ca02b2b0e2ec0458fffa6ce0d654a1e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5887d8.TMP

Filesize
872B

MD5
309be79d4d974166272bea36d28facd6

SHA1
3aa2fd818b568c29d2ebb91554efe7d73efe1646

SHA256
bdb2ca8e250f99440c36bbed60dc2467fc7df88418f75041ba721b56a3e548bc

SHA512
879540f89d0deddd940bbfdca7172b2b9ec3414b177165a7894fa13207087b16cb35bbeb64ce8aff43b0c5b43b2497defce21784de3e6ee21b30b1dc208765dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
1d0de689231eabcc34e951f1bf38fd2f

SHA1
ea25b2e3b2dacd40392651cc2ced112bad572974

SHA256
33a56ba1af41f4157700122a29cd65a8487d6a9df1a305f1d2710c320e5d5eed

SHA512
095b39e3d33b319504390b8c20ff2dcdbd499d3db5ee66355e3897d86426c66510da527c5a73ebcd8af7c70f00bcccb62eb991c57055eb5e5b03d4e18d3e9114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8e2ebd17723e1f8e0ec857bf241b6138

SHA1
e17a4629966d95eeb479ebef8d6f7ef436be4f1f

SHA256
d8054e59afd126bbf5427a2b814f59a99a109ca8ee66480c0a2f60ce54c5556a

SHA512
ea52a622413e80a9394652ad4dc1daad9ce1bf6a25d7a3bfab957b1056279846252ef8574a17e628257bbd9e2eb065598ef5898ba15d802e92933719b0320d6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5f30ec3389ec7d4773027922704e2896

SHA1
2eb5a13d6bd9e48b7ef8bd08f705a2d8b0210f55

SHA256
ef9d43483c87207853bf6e46919b80defd1c29de99854f522ff1b9aee63d160e

SHA512
be6efec295c20750382772e134873c0d2d0032f8023ade6c82282525e629e1d2679419f4b6292c1ec2949039275a4a14aa9ae45d5da51adf4a004eaf4dcdf174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
41625a64f4f42b9a2ed147f1be0fbdfc

SHA1
66b26ea69f881de1ca2d490bba6bea6d68637e12

SHA256
d168aa1e6d863e841ba1113f8defc923575379a971499d6575035104ff7a3bc6

SHA512
3e7619865b432f0690fbc2504bc90068558d9d9415315edd57ed144ef03bb17dab860991238596697ea0ba61d6f1076b4651ccdc07cc8ab68f0e1d7d7dcd0b7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d76e3505c9499f83a1686ef818b51b28

SHA1
3d84cd0a55248a72be447ec7c8dd997c04bfae50

SHA256
540e6c2de9dee2c4481675ada27979d5e05ab5ac5afa95aa4e7c7927f6e57ba0

SHA512
06ef004e2579fb9660af4f0fb67d7261301a6a9d7664820b03e1a1f3a4e4722c67b11d2089546e9573ff9ac9d3e03cee2eb2969b07e079da29e7283c3b9a6f3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\edbhppv

Filesize
275KB

MD5
1d8ffe1c4d1624ff83e1df60c1ea5f19

SHA1
d292e2dc2ca66e53523e5e6cc3a242abf098b3db

SHA256
dd9159cbebfc8081ace78b07875ff21fd0a97209bf928c82c7de2b9267bdcd61

SHA512
aa2cdf4891f871f09e97a6ed1595fccd514d503376dd4f9de921a6410f241f9eccde35ee71a5485163ab878b018f951b361d80c7d22c0b8c1d2f7146b4205baa

Download Submit
C:\Users\Admin\AppData\Local\Temp\skin.888.msstyles

Filesize
1.1MB

MD5
060779ce2fdb52bfb9e7463704852d29

SHA1
486541ee6bf89570966143cbc473e9e1f5d5ef37

SHA256
1bd90d1c7ff94b4ec5369a9f94e446f96566a6286adede460584fd247b7bd540

SHA512
a010220679d301a077f1feb6676a63b42aa66c17449808ab3109ae26cb2237b5b124e3053120291fe650eeb83bccad2d9f88269dde4d802fd6c7d34b1cdb39c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\skin.dll

Filesize
239KB

MD5
29e1d5770184bf45139084bced50d306

SHA1
76c953cd86b013c3113f8495b656bd721be55e76

SHA256
794987c4069286f797631f936c73b925c663c42d552aeca821106dfc7c7ba307

SHA512
7cb3d0788978b6dc5a78f65349366dac3e91b1557efa4f385984bef4940b3ea859f75cfe42c71f6fe445555138f44305531de6a89c5beff4bf9d42001b4348e8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
71f8bffc4ef350002029f2666b1226ae

SHA1
440d1751b837d691cba609669681073bb67845aa

SHA256
1027d706cf2783f9ce74187f7bd48605acc36527f5deefe3f7761725132d8617

SHA512
49284c375e9ef4c965225b874fc7c90fd4da44541e4c868508f92f5e13e8dc810b7d20a16244b6c56c350537a4f6136ab57d1ac9f61c729e76ed0df4c7e9ade5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
46ffcfd2d9a24e17a57988791f21b8ac

SHA1
ba1a0b648b26ce9aa017e7b7ec7ba1dfc032a839

SHA256
e1276e04330b82e67174842aea5e3bb17fb110b0409952e01ad249dc807ef93d

SHA512
6e7a95f6198e3aeacd82b651f39f97f228691640961c0c3cb694881b1f661fccf8687a2dd3048475dca34984ebc7195d83d36861c3c302148ce37494fefaf345

Download Submit
C:\Users\Admin\Downloads\888 RAT Private - Cracked\888 RAT Private - Cracked\888 RAT Private.exe

Filesize
7.1MB

MD5
fd333b3b8a82bb7de7f191c4748db00b

SHA1
555be90439cf5fb71af7599f03a064704dde93d7

SHA256
715defb279b04341fdc48d927e629079662da381d51bce7217d55c375220e678

SHA512
9f5d5f8a38e9b39833fa0af5477fa3ea2a617a607b4e344cad4a4538d8d8424bf4c1aa3ce9f2f03f4ad23dd988de70e0d3eab9a4e7b2e46cf5de0371eac81d7d

Download Submit
C:\Users\Admin\Downloads\Death-RATV0.10.zip

Filesize
6.5MB

MD5
f147f2947f448334da6dd4aff82bc88a

SHA1
9bbc9045f9eff371b69f5ea8169657033b233af4

SHA256
1ff8724c1db86bf071347bf5e4807f5151bf3dbae9e69c415b1dd70197c44c0f

SHA512
d245c79b21458fcd5b3b973de647491529659a9a5b1c9f330c5e1248ff8cbbc6418ba8c4e45cec9bebbe2968147c2d304031db1fd6ee0fcc183b2bbdff888c2d

Download Submit
C:\Users\Admin\Downloads\Death-RATV0.10\Death-RATV0.10\Death-RAT.exe

Filesize
2.3MB

MD5
aee69a08db3a88e04898d46ce1aa73e8

SHA1
8989ca781435fa14350f63f65697a26cdf958676

SHA256
bef5ff662eb7e14405577279fdc7cd12aae7c1efb553d23a1e40b3e65321a072

SHA512
c4f9f6b9a5ef84b886cb9fc30844e6b044ba554517ba14869d088c7ebd33a7beea11eab09b2ef9386e630d1c999e6c2c8133fd93a6ea695767134d9e7f8787fd

Download Submit
C:\Users\Admin\Downloads\Shia Hacker School -Rat v1.0\Shia Hacker School -Rat v1.0\shia hacker -rat.exe

Filesize
10.3MB

MD5
336aef70c7eb97d1e850cb8e6ba82c46

SHA1
d3ebd9716609058d57f95e9306f76aefd758e31a

SHA256
2d749a132f6e73b2d26bc3ebe66fc3c1fe947baed2d2867a858d7b3b97a30d30

SHA512
1787375fb3800d4e610c7ac03e2ebb3f40ae25981a4cae3cd63269dd7c40827cc3af08cf108c2b5b130eaf9d1aae2249d2102a223a21a499230f241d8e815b5d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 301776.crdownload

Filesize
10.7MB

MD5
2cff62c9a3bc86b45f07434327987676

SHA1
8afda88116a2159790d9872fe080ae3c476566c6

SHA256
1d459c24aef761cd2f21e8e7442eeea450fe915cefb7fe748f7fad86f0147f07

SHA512
7565692c38e41081cecfcfe83ee717abe388fdf18c4d8e7ace525275929d35baa298e899ee984226e7d158ddda969ec7561304749ebf8af7b86c78f134314d96

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 588892.crdownload

Filesize
10.8MB

MD5
62f9106280d5698fd35e0e868292b4a6

SHA1
2e3d997df3225402aa43b0fae0a96a8fb2cb3ae6

SHA256
af766cac8b5c78f324b02a6fea2efb4d5fb0880ebe661e570a1b8a7ec0a3b527

SHA512
60a390d2ff3905730dd42c90f6e4585a49fd84557a8799c53afc65af1d2f37f81bab2dc9f5b1090716c1df58f418b4809a7030baebe74a0b40a6c86cfcad439a

Download Submit
C:\Windows\SysWOW64\MicrosoftWindows.xml

Filesize
4KB

MD5
b1cbfcc7b7a5716a30b77f5dc5bb6135

SHA1
5c397ffd7a845b2fdf9e82ff73698784a91a2fb9

SHA256
96f2ff4ddcadf6421071daa6cdda2ce866fb7b10d12cc1b20bd07cb131210430

SHA512
d08516e7610e5a08d1c5c2d1cc5a22b1cd2d6b7c890f895caee0cf65577a1315d575d91a8f7f78ffc7bd0dd77b23ece46fadf58ba44257a115330a54a3ebfcf7

Download Submit
C:\Windows\SysWOW64\TiWorker.exe

Filesize
3.2MB

MD5
ecede3c32ce83ff76ae584c938512c5a

SHA1
090b15025e131cc03098f6f0d8fa5366bc5fa1f0

SHA256
366f1e9f9c99aa81034bada3cc344f2fb5a74246e1d5851441244df1ecc9ae6d

SHA512
61ca6075c8a2086d42b58698484afc0005645507474831cacafc10126f47c8f0cda10c1c215557f9391865b55b16ae881a593d7547cbad560b54369684b23d1d

Download Submit
C:\Windows\SysWOW64\config.json

Filesize
1011B

MD5
3da156f2d3307118a8e2c569be30bc87

SHA1
335678ca235af3736677bd8039e25a6c1ee5efca

SHA256
f86ab68eaddd22fbe679ea5ab9cc54775e74081beffd758b30776ba103f396eb

SHA512
59748e02cc4b7f280471b411d6ca3c9986f4c12f84b039bae25269634fc825cde417fe46246f58538668c19cca91e698e31d9f32df69aad89e68423f86bb00c0

Download Submit
\??\pipe\LOCAL\crashpad_4536_SNHANPWIVMBLNIXV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/228-459-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-529-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-457-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-523-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-458-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-452-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-491-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-485-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-481-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-480-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-461-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-476-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-475-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-462-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-463-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/228-460-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3396-858-0x0000000010000000-0x00000000100BB000-memory.dmp

Filesize
748KB

Download
memory/4840-600-0x0000000075820000-0x000000007589D000-memory.dmp

Filesize
500KB

Download
memory/4840-607-0x00000000762E0000-0x00000000763C3000-memory.dmp

Filesize
908KB

Download
memory/4840-606-0x0000000077150000-0x0000000077727000-memory.dmp

Filesize
5.8MB

Download
memory/4840-608-0x0000000000110000-0x0000000000825000-memory.dmp

Filesize
7.1MB

Download
memory/4840-615-0x0000000076D40000-0x0000000076E13000-memory.dmp

Filesize
844KB

Download
memory/4840-619-0x0000000074EA0000-0x0000000074F14000-memory.dmp

Filesize
464KB

Download
memory/4840-628-0x0000000075440000-0x0000000075650000-memory.dmp

Filesize
2.1MB

Download
memory/4840-630-0x0000000074EA0000-0x0000000074F14000-memory.dmp

Filesize
464KB

Download
memory/4840-629-0x0000000075770000-0x000000007581F000-memory.dmp

Filesize
700KB

Download
memory/4840-627-0x0000000000110000-0x0000000000825000-memory.dmp

Filesize
7.1MB

Download
memory/4840-626-0x0000000076D40000-0x0000000076E13000-memory.dmp

Filesize
844KB

Download
memory/4840-625-0x0000000077850000-0x0000000077875000-memory.dmp

Filesize
148KB

Download
memory/4840-624-0x0000000077150000-0x0000000077727000-memory.dmp

Filesize
5.8MB

Download
memory/4840-623-0x0000000074EA0000-0x0000000074F14000-memory.dmp

Filesize
464KB

Download
memory/4840-622-0x0000000075770000-0x000000007581F000-memory.dmp

Filesize
700KB

Download
memory/4840-618-0x0000000075770000-0x000000007581F000-memory.dmp

Filesize
700KB

Download
memory/4840-616-0x0000000000110000-0x0000000000825000-memory.dmp

Filesize
7.1MB

Download
memory/4840-614-0x00000000762E0000-0x00000000763C3000-memory.dmp

Filesize
908KB

Download
memory/4840-613-0x0000000077150000-0x0000000077727000-memory.dmp

Filesize
5.8MB

Download
memory/4840-621-0x0000000075440000-0x0000000075650000-memory.dmp

Filesize
2.1MB

Download
memory/4840-620-0x0000000077150000-0x0000000077727000-memory.dmp

Filesize
5.8MB

Download
memory/4840-617-0x0000000075440000-0x0000000075650000-memory.dmp

Filesize
2.1MB

Download
memory/4840-612-0x0000000074EA0000-0x0000000074F14000-memory.dmp

Filesize
464KB

Download
memory/4840-611-0x0000000075770000-0x000000007581F000-memory.dmp

Filesize
700KB

Download
memory/4840-610-0x0000000075440000-0x0000000075650000-memory.dmp

Filesize
2.1MB

Download
memory/4840-609-0x00000000761F0000-0x00000000762D6000-memory.dmp

Filesize
920KB

Download
memory/4840-595-0x0000000075820000-0x000000007589D000-memory.dmp

Filesize
500KB

Download
memory/4840-594-0x0000000075820000-0x000000007589D000-memory.dmp

Filesize
500KB

Download
memory/4840-593-0x0000000000110000-0x0000000000825000-memory.dmp

Filesize
7.1MB

Download
memory/4840-596-0x0000000000110000-0x0000000000825000-memory.dmp

Filesize
7.1MB

Download
memory/4840-640-0x0000000076D40000-0x0000000076E13000-memory.dmp

Filesize
844KB

Download
memory/4840-638-0x0000000077150000-0x0000000077727000-memory.dmp

Filesize
5.8MB

Download
memory/4840-639-0x00000000762E0000-0x00000000763C3000-memory.dmp

Filesize
908KB

Download
memory/4840-636-0x0000000075770000-0x000000007581F000-memory.dmp

Filesize
700KB

Download
memory/4840-635-0x0000000075440000-0x0000000075650000-memory.dmp

Filesize
2.1MB

Download
memory/4840-633-0x0000000000110000-0x0000000000825000-memory.dmp

Filesize
7.1MB

Download
memory/4840-637-0x0000000074EA0000-0x0000000074F14000-memory.dmp

Filesize
464KB

Download
memory/4840-634-0x00000000761F0000-0x00000000762D6000-memory.dmp

Filesize
920KB

Download
memory/4840-631-0x0000000077150000-0x0000000077727000-memory.dmp

Filesize
5.8MB

Download
memory/4840-632-0x0000000076D40000-0x0000000076E13000-memory.dmp

Filesize
844KB

Download
memory/4840-604-0x0000000075440000-0x0000000075650000-memory.dmp

Filesize
2.1MB

Download
memory/4840-605-0x0000000075770000-0x000000007581F000-memory.dmp

Filesize
700KB

Download
memory/4840-859-0x0000000010000000-0x00000000100BB000-memory.dmp

Filesize
748KB

Download
memory/4840-598-0x0000000077850000-0x0000000077875000-memory.dmp

Filesize
148KB

Download
memory/4840-599-0x0000000000110000-0x0000000000825000-memory.dmp

Filesize
7.1MB

Download
memory/4840-601-0x0000000077850000-0x0000000077875000-memory.dmp

Filesize
148KB

Download
memory/4840-603-0x0000000077850000-0x0000000077875000-memory.dmp

Filesize
148KB

Download
memory/4840-602-0x0000000000110000-0x0000000000825000-memory.dmp

Filesize
7.1MB

Download
memory/4840-597-0x0000000075820000-0x000000007589D000-memory.dmp

Filesize
500KB

Download
memory/4840-591-0x0000000000110000-0x0000000000825000-memory.dmp

Filesize
7.1MB

Download
memory/4840-592-0x0000000075820000-0x000000007589D000-memory.dmp

Filesize
500KB

Download
memory/4840-585-0x0000000010000000-0x00000000100BB000-memory.dmp

Filesize
748KB

Download
memory/4992-920-0x000000001BCE0000-0x000000001BD86000-memory.dmp

Filesize
664KB

Download
memory/4992-921-0x000000001C260000-0x000000001C72E000-memory.dmp

Filesize
4.8MB

Download
memory/4992-922-0x000000001C810000-0x000000001C8AC000-memory.dmp

Filesize
624KB

Download
memory/4992-923-0x00000000014A0000-0x00000000014A8000-memory.dmp

Filesize
32KB

Download
memory/4992-924-0x000000001CA70000-0x000000001CABC000-memory.dmp

Filesize
304KB

Download