vidar | hxxps://polovoiinspektor[.]shop/PolymerReload[.]exe

Analysis

max time kernel
1141s
max time network
1143s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows
submitted
20-12-2024 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://polovoiinspektor.shop/PolymerReload.exe

Score

10^/10

vidar credential_access discovery spyware stealer

Malware Config

Signatures

Detect Vidar Stealer 8 IoCs

stealer

resource	yara_rule
behavioral1/memory/2272-314-0x0000000004C10000-0x0000000004E49000-memory.dmp	family_vidar_v7
behavioral1/memory/2272-313-0x0000000004C10000-0x0000000004E49000-memory.dmp	family_vidar_v7
behavioral1/memory/2272-340-0x0000000004C10000-0x0000000004E49000-memory.dmp	family_vidar_v7
behavioral1/memory/2272-339-0x0000000004C10000-0x0000000004E49000-memory.dmp	family_vidar_v7
behavioral1/memory/4772-551-0x0000000000520000-0x0000000000759000-memory.dmp	family_vidar_v7
behavioral1/memory/4772-552-0x0000000000520000-0x0000000000759000-memory.dmp	family_vidar_v7
behavioral1/memory/4084-586-0x0000000000520000-0x0000000000759000-memory.dmp	family_vidar_v7
behavioral1/memory/4084-585-0x0000000000520000-0x0000000000759000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation	PolymerReload.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation	Columbus.com
Key value queried	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation	PolymerReload.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation	Columbus.com
Key value queried	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation	PolymerReload.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation	Columbus.com

Executes dropped EXE 6 IoCs

pid	Process
4644	PolymerReload.exe
2272	Columbus.com
784	PolymerReload.exe
4772	Columbus.com
4608	PolymerReload.exe
4084	Columbus.com

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
4972	tasklist.exe
4504	tasklist.exe
1304	tasklist.exe
4088	tasklist.exe
1932	tasklist.exe
888	tasklist.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d0683d9d-ffaf-4686-a73e-3bc72bc61f46.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241220003749.pma	setup.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\KingstonEfficiency	PolymerReload.exe
File opened for modification	C:\Windows\NovelsTears	PolymerReload.exe
File opened for modification	C:\Windows\ParticipantsOnes	PolymerReload.exe
File opened for modification	C:\Windows\FavoritesCategories	PolymerReload.exe
File opened for modification	C:\Windows\KingstonEfficiency	PolymerReload.exe
File opened for modification	C:\Windows\NovelsTears	PolymerReload.exe
File opened for modification	C:\Windows\ParticipantsOnes	PolymerReload.exe
File opened for modification	C:\Windows\FavoritesCategories	PolymerReload.exe
File opened for modification	C:\Windows\FavoritesCategories	PolymerReload.exe
File opened for modification	C:\Windows\KingstonEfficiency	PolymerReload.exe
File opened for modification	C:\Windows\NovelsTears	PolymerReload.exe
File opened for modification	C:\Windows\ParticipantsOnes	PolymerReload.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Columbus.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolymerReload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Columbus.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolymerReload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Columbus.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolymerReload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Columbus.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Columbus.com
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Columbus.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Columbus.com
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Columbus.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Columbus.com

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
5100	timeout.exe
1108	timeout.exe
252	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Sin confirmar 222216.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
3608	msedge.exe
3608	msedge.exe
4192	identity_helper.exe
4192	identity_helper.exe
4596	msedge.exe
4596	msedge.exe
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	tasklist.exe
Token: SeDebugPrivilege	4504	tasklist.exe
Token: SeDebugPrivilege	2196	taskmgr.exe
Token: SeSystemProfilePrivilege	2196	taskmgr.exe
Token: SeCreateGlobalPrivilege	2196	taskmgr.exe
Token: 33	2196	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2196	taskmgr.exe
Token: SeDebugPrivilege	1304	tasklist.exe
Token: SeDebugPrivilege	4088	tasklist.exe
Token: SeDebugPrivilege	1932	tasklist.exe
Token: SeDebugPrivilege	888	tasklist.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
3608	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
2272	Columbus.com
2272	Columbus.com
2272	Columbus.com
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe
2196	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4024	3608	msedge.exe	84
PID 3608 wrote to memory of 4024	3608	msedge.exe	84
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 60	3608	msedge.exe	85
PID 3608 wrote to memory of 4856	3608	msedge.exe	86
PID 3608 wrote to memory of 4856	3608	msedge.exe	86
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87
PID 3608 wrote to memory of 2132	3608	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://polovoiinspektor.shop/PolymerReload.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x130,0x134,0x138,0xdc,0x104,0x7ffdfe4146f8,0x7ffdfe414708,0x7ffdfe414718
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff719f15460,0x7ff719f15470,0x7ff719f15480
    3⤵
    PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Users\Admin\Downloads\PolymerReload.exe
  "C:\Users\Admin\Downloads\PolymerReload.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Physiology Physiology.cmd & Physiology.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3412
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4972
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "opssvc wrsa"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3436
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4504
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2216
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 390216
      4⤵
      System Location Discovery: System Language Discovery
      PID:4736
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "Enter" Cox
      4⤵
      System Location Discovery: System Language Discovery
      PID:3076
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Telephony + ..\Ignore + ..\Residential + ..\Masters i
      4⤵
      System Location Discovery: System Language Discovery
      PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\390216\Columbus.com
      Columbus.com i
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2272
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\390216\Columbus.com" & rd /s /q "C:\ProgramData\JECTJECTRI58" & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1108
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6278089526909912414,16790060245128385136,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2780

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1456

C:\Users\Admin\Downloads\PolymerReload.exe
"C:\Users\Admin\Downloads\PolymerReload.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Physiology Physiology.cmd & Physiology.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4372
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 390216
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Enter" Cox
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5080
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Telephony + ..\Ignore + ..\Residential + ..\Masters i
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\390216\Columbus.com
    Columbus.com i
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4772
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\390216\Columbus.com" & rd /s /q "C:\ProgramData\7GDT2NOZMOZM" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:3716
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:252
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4132

C:\Users\Admin\Downloads\PolymerReload.exe
"C:\Users\Admin\Downloads\PolymerReload.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Physiology Physiology.cmd & Physiology.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4500
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4528
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:888
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 390216
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1360
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Enter" Cox
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Telephony + ..\Ignore + ..\Residential + ..\Masters i
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\390216\Columbus.com
    Columbus.com i
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4084
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\390216\Columbus.com" & rd /s /q "C:\ProgramData\IW4WT2NOZMOZ" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:1728
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5100
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
734B

MD5
e192462f281446b5d1500d474fbacc4b

SHA1
5ed0044ac937193b78f9878ad7bac5c9ff7534ff

SHA256
f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60

SHA512
cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E41BD592A70659FA53333CA0F99E806

Filesize
345B

MD5
6684e64059f1669318a4b7496f3ec226

SHA1
897137d720b9a26e0533c346141be483b9406033

SHA256
d133c4241866740553ca45e3755be61ae0854fcfce79d4f7a343cb1c61dae294

SHA512
adb8c68f9f95de26206c3e988832ca80c8a722ad0e029811cbcad6b5a7d9b046a41b0373b381493d89f727332b32c053e385a62c289f3d0a706864bb82f0a7fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
9cf668ad59fe715bf93d6e69a49296b7

SHA1
a61b6b136333500a0378d0dd56642f24b6042b57

SHA256
8fe723b9e0aaf900d036c3b363bf3b34f18905791b172eb42cabdbbcb348bd42

SHA512
91d65c539d0f133bdfe2fdcd71d7546e01aee55f1c814c752651cf9ca40ec88f5934e0fa0e31965194b58d3ba979a22be134e68de9ae31fcc6bc7b308abad7a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E41BD592A70659FA53333CA0F99E806

Filesize
540B

MD5
cd9ca33cb495050c0d632b0ea30ceb13

SHA1
4d6daee7f545c6d6b7822a70d7a867ccc7d8c976

SHA256
2848316b2edf838b2def7b038a924ba19cd17bbb9a746b9d0fb741260e968122

SHA512
f598035783e349e9c7de64d019b53901cffdedd5627336fa8ed22ca41ea75c4093206868abeae53956ed70a8d6712d09dad8f097106948135c7a291b34e8f209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
69cd4fbd25488dc00a347c8a390c8652

SHA1
22cf04f96e4af55a94c87105201f08cf7ff47aa5

SHA256
23ef6c8a50cc68d03460913947c655fb7c62854cca6108e5c85cc472edcdd5cf

SHA512
02ef1bcd904dcba1f0f035a61593dab52eff317762cebd59261b0d211b0b7f7447814ac5ec6c47481088761a338b6ea00a2865e759565980043b47bc4f60f5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
90d9cc370060ef5ae526755155220c89

SHA1
3d536fcef3ebde92ca496819539288686ba8528e

SHA256
db4df83a39030515b39da7becb9f640e86fe6daec54296ce4fccaf9423c29e27

SHA512
5179e5b0093b160b3f67fed92fb4edf97ff7439d970dce46c281cdcbf4589f157f7bcd1d8608cef03cc81258f3c0744f31b95db8c70f162bed255efad48e37b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5ef2ba.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
95d26917612e435671613c583c301e89

SHA1
ac0fe41ffac77bbff250c08878d4bb2d9383e826

SHA256
a41fc94cae197e837ba42492867b1770abde8fb7e7362b0a079729efca811a87

SHA512
4d0e90cbd6eb474fdf281a734d505087c83772894b31958ebedb4e952a3715c35d4fe2f6c56ae6ec2740789d89a7985bdb274f8e5ebd57e2a78cb8f30abbcee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e780be7aac075bb56bb93d3344a8a43b

SHA1
1b2d513ce61f9e88fbd82dea7ce4c5f6a7762cd0

SHA256
0b42832c063c8ebb3acd5b23ad76e3aa3c4e54704ab81498c3db107b46455bd2

SHA512
fa649a7442d08c0b4f00cf82d69e02673d1c4611dec231319e8d94ad5f7bc148dd42efb24d5e9734d98c0cd5e9ac3119212c6b3b3e671f02c34134a5c4452652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2021f862287565e699879e799c47f445

SHA1
ce565675b279596347dcbecaf5b51d643fbee901

SHA256
1f25568f5b0254138769b91faad18e204f69160b5dd4a268987eadd2c95d1a0e

SHA512
ea2c1c0d3a9bb90fdcc914dfbb7d5e1971d79ce4ab09b48a4b300bf2fbfb6ec2208f0dad259435600ad0445828261208b080ee9282ae757a5bf239094353b937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5dab195d6fa0322f9869e8f8149707c3

SHA1
22fab70ddcb1b558b80d10c82aaf1676d3b01712

SHA256
5a08d60958d0ebe75bc77691f6f040a4860333acad4cfac1756b8b60a288de97

SHA512
8634b4f7b1496e1fc32cf8c29d3399e56520f37c890744f77ef06a8dde9bdb7ae4553a6b47a5b5de241bf8100f4750af3e6f493b7264e212b56ec02dc999d30e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b6bf0950b2497d7319d2026ff586eec

SHA1
41d8bfd1333c412b3bd91abe78d2449290544d14

SHA256
bf4b7802e99f41b9b0ff1d267e722d8a4a410d086d9ca0d066333410fba0d675

SHA512
88a9c31491f607ee8f0d8c15f9f2e4f623838850c1959345510ff277cfe95bca4854b3c342e4dd7465bdf7980fb48e55c4baa3f9f581bf5a1238f764f6e389f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2cad20898338fbc7fb993756151e2fe1

SHA1
740566d988a46b18920bbb42ff71eb145a931aee

SHA256
4c2f60eb2a2e891ea30a7eed7813758fb7d3200f5938e7012a22233b26b9dfa6

SHA512
e1a82109629e89a57d803f1bf0433c07d01a1fcc9db30ca81eff4a415bb4f36dd772bc05272538fc0db97a20f7475f172164fbe3142d507088770a53ec1a0796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d8c86e7d523ce692226bc2731ee03459

SHA1
a63bb7eba70e607d9557d5f59caf383b5a66161e

SHA256
9c2edac30eb6825a955114fcb679842a742cbba2a06413d3976047c8f1250261

SHA512
e2342039ba773cb0121540b8eb2e2b421db155384c7e48d4e40267f95759120782a905cfcdfc96931f1908f24d0d7eb5179e15e121592c3efd3e812998019f3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fc18f32004a73333d0b58ca1fa36c167

SHA1
47aa17e1f316a4b467f38dad054cd345297314fb

SHA256
fd6044c55b29bd40c9be96804009825257acbda9cd05e13f7c5853ddebaae44c

SHA512
6fc2341edd637de82add191badb91b0f226ed49bcf5301b040018c22827821471b595e5e8849842491b6b61fc73200008fdcf381fdf5048890b886d0e8792642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
1ae92169d656e678bfecc9b9ae0fa54c

SHA1
d982b22b167ec965e5e14182e1be7f1f5ad85b5e

SHA256
6b63510575e599d9f1f7cdb9401ab2f01fdd48635c6adf9173b99b119bc24fc8

SHA512
f5a9613ae2ccb8b3bc977289826f1e5a486b29e0fdeab7e328234adfddbaa8806dc2094f795bbfe7ea8ee7d5944b9721a61501167c6e143101b4292d087a4051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5746cf9595620c98685d6b05ca185865

SHA1
8680d39d44e428fcd2e6ac2873be042927f0aa6b

SHA256
f858a243adeb6cf0ca8e3d422e289957046c6f180143bd00e3177c5381e910a6

SHA512
f2661e8ce52790ebbd3ca278f3a490e33cb40ce47a2f9c99a7010481455f45a3f66cc2d3a856d36b2f54eaba4d8b48be89ab1cdb0e1ce167e98109c15160d6c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
1e08a06773f4c44b210af7184ca8fe41

SHA1
822124d8452cefaa7fa52a2eed6ac878eae268e0

SHA256
f162ba2e3c11ed263381b5b73d3778538f5212044e3fbef5be6c18aaa27a35bf

SHA512
692d1d12861b09c60c19f513eb8a23f46068d91f0957b59e932b7b1a356a5d4179f624760329657de51de1bef1b02159d5be30689ba20122f5a99ef1292c1af1

Download Submit
C:\Users\Admin\AppData\Local\Temp\390216\Columbus.com

Filesize
1KB

MD5
d329eebfbf5599710794c52111082e25

SHA1
fe13957bb0f54ec3614ea575df134f0676025a08

SHA256
192800376a1e2400d06ebab978c857ba84e3cec92064e049c20690f906f7dc71

SHA512
252c0646b2cca257bbb616198b04a3f376a2c0c49e05bbf1e984aabb7597860a30895698d0baad281176e8e90ccf9f80f34d35b80c19aefdd670122b93829d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\390216\Columbus.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\390216\i

Filesize
285KB

MD5
d50bfc4cfc93e4a13504bac07c9faa06

SHA1
4df7f36e735e4e7c3cedeada4e9db03e92f97da2

SHA256
800c00065760459ff7a2c4ae376fc9e4f29d508002fad2f282f7f2fe65d0d182

SHA512
bf139129910e598f02264aabf6d7544f5083ac3fdaf7eec245b1399ca028058ddca7dc4e496127a035498d8390a7984ecf232d3ca86159c091937d0b5c4bec08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bridge

Filesize
93KB

MD5
ca085e5e19e253169916cb633afa2c93

SHA1
99294155640139022ec331f398521374cbebb15f

SHA256
74e2066c07e0dd365b14b8bfdc98cb01c9429828874bb6effe53aca22cb7ee58

SHA512
09e6523c3876642f23bd68c3ea54e0d6d42763a9e41efa168a731f8ea4a02852a49f69ac97bed4f4198231f2b4a60891af41d46de3a397003d53024ba7be9af1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Card

Filesize
138KB

MD5
f0a36b149eb13b57f8599709ef945f81

SHA1
ba4a8b590bb2571fc68781f6c8fd158046df4e8b

SHA256
c17aaaab08817fc25a41cafdff0e372485fd643b7fa3f453a03d9425fe642d48

SHA512
27a25cde2b7ff930e836368f6e5a28602f4ac4fd74addad621da2f15d8e960ecc5c4ebcaa582939e3799f3d70483b48ef303ed1ec8177ea1f4b4eceb53431fa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Classified

Filesize
111KB

MD5
262c429fd93fcfc2e4d4e3d61a2176d7

SHA1
2723e9983128d0eb156a3dd39ee982c55891e4dc

SHA256
affa77b019ce8187b97a5f69f48506ed199678e8096ebf40a88202ba8b30893a

SHA512
64825f5900e6094f9b446b352c72d6905ba9d42f29967474346d847927a5ba5a015344ab58ff9fe9db22243b41cffee72da05a0ede92b2a584ed241c8038bc7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cooperative

Filesize
51KB

MD5
f499d3545caf3a627a86bb1da506a0bf

SHA1
7b5544df8d88e1aaa7474b5b6ca55267b9c1f01a

SHA256
e88b87c95a125202447b8e89ae6bce9bf457213ea2df56b9ee44dc52cf7866cd

SHA512
64830fc0d8763b295d13de4f58f535e3a96c68094f490264f2a155ee8fb66ea250dfde3079e526a2462963dc10b9b2f31b57c02e40239345bf8ab1fba2f48841

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cox

Filesize
1KB

MD5
76e4e89bf684851551fc8bd71d6ca3c2

SHA1
a717fda4d40abaffbf26ed18af5960a032d2f671

SHA256
90eccc6ea68e1d94c2c805ac08414ec52b40e2fc6f58fea56ab98b5f9ddc8261

SHA512
6446180fae5bb83943cd02c3cd9e7134decd76ab136f3ef7951e78ad8c86fe16a2d8580047a5d794835f8321904ca8ea4fa723d043e44c30d8d66e1b033414d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Enemy

Filesize
87KB

MD5
be3a31e5a4a93cbeb05b408f98050358

SHA1
d888a6b68d6a1e4bc81f6d38aa6db672d3f6345b

SHA256
4aada48ba766c76478bfdfb1bede0b000516a66d12cd908b5e6e106fdf8d2f91

SHA512
4fa011fba828704609a05c6de73931282b711bf92002597fc8530e87fabd6282536f1585127fdb7f05ea5d3c0b9bc279abd7a291e5756cadf546baf7e8fe3d14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Growing

Filesize
114KB

MD5
2f00a26b7d4abd72863f04bf74c4f43b

SHA1
bb7f08545e77bfe825bcbd0a3804ef6354accefe

SHA256
2100a2d794872e26355b0ebb35e20489bfe762706ec47e5ced411560853aa394

SHA512
fb80654476addf732cf3362585115380a5a4723a45f61bd35c8a47b1d5a9a839b7d0dda6e869b0fbc4e6acf085321f6b816f846c77f8459ec939d8240b381c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hurricane

Filesize
135KB

MD5
17466a3250859da0fcd50b639a581e38

SHA1
c06417abc69ed49076279b679e1e008c750afa67

SHA256
6e70c9b0e1b324bc454b0ff84b951072e6798c2ab08305ffd6b2712b3f4d5732

SHA512
7954f93b3fa3b78eb93016c879069e1be4e282201c1f2005acac47e00e118c4fc58d59c272440699797c6e2a019a15f72a5256a26588fd279c738579e54a1fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ignore

Filesize
85KB

MD5
01a4f681243d2cadc74bd9879974e17d

SHA1
85c004e8ae35c80b909d2738bb31694fb431469c

SHA256
89b17825b2e6386cdc39b0936a41313a45c406ffa58c38842124357cc5d4e40e

SHA512
95ffd5d481907c6361f09a9b2ba8765d630644f758b60834b18a6a85d90914e4b58a8abc1a22456fa4b5f395b6a19e6eeebb4fda17f6385b6b7fc4b8d3ee5821

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mar

Filesize
100KB

MD5
669374cb80d133b19215fbcf4216fb33

SHA1
cca218bad3324a2f427909f8946f73a972535baf

SHA256
ffd1a789ad8b400a1e8ab25c378df800b40458037a05a532cb385b87ada69551

SHA512
6268aea10dfb69570c3c062ab554c56f20f25f31baca58c364e47c15e50fcbf02d1e2253daf25389614f18fd47f311993036d28e3669d2c0e15bacd941da6333

Download Submit
C:\Users\Admin\AppData\Local\Temp\Masters

Filesize
69KB

MD5
15153a8f88836a0894aeb0cda8eebbc7

SHA1
b3081cd10449186a6b530d33a6af07e0b605a0cc

SHA256
ba83e9b9334670c1e4e4a57799093764f4752794e04526522445225ada497862

SHA512
b7375272220dd4065ce70ec8869a0f2438cc1b5358eff2d376432e2576444ad9151c5030fec11eff85e35f7b1dd87376424455e1129301e354479e2f70cc5efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Notebook

Filesize
94KB

MD5
75b34ad87ca3d160c6f0f13a095a0208

SHA1
c7aa80a1121bbe727c1606d085a80cd32df74afc

SHA256
2277b91195da657200c3acc57549947386b5d259f5b5df53670018609555ae54

SHA512
cc7741310d487b2731ae8efe8da8ebfb72650f63b94df7416303ccd090535d98ce96670361108f72d6ae7b4e2f6f23ab74d4c7b8d4e2d633fd210cb5e88af3cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Physiology

Filesize
11KB

MD5
a1bedd2aba677e9860ae8c479493dd3d

SHA1
147f198fbcab5bd8f8a7e692419008e441009311

SHA256
27df28d589676374d7dcfd74c61a09271983a2ef35e3f99bda8010466b45fd32

SHA512
eff4342247bfb25cf8f26ab336582c85b6beb89b38aacd4195beaecdee059fc4abd00be196e5ac0e592de22c4e4ddd68c4dd18180247cd6e989fb302f0380025

Download Submit
C:\Users\Admin\AppData\Local\Temp\Residential

Filesize
76KB

MD5
2bf504f0f2152a7c1dbe41e84ba8f161

SHA1
48d5766f8e45de643ef813a6c16ee8987e57ed2b

SHA256
baa6ef1aed55fe08d07817920242ab42fd92d2491a8c5109dc3d7ff3553a3fc8

SHA512
1290c03543ec6c9289bfafd102316f9541422afea48697b36b522bb6ea3294ca88292c57c9b0cc2dcb47bbfa3ceb9c67c106ec38e11a10804e03c2a7faf15739

Download Submit
C:\Users\Admin\AppData\Local\Temp\Telephony

Filesize
55KB

MD5
7a492c1ee6f21e5cdfb7da8aa9386388

SHA1
c64be5a5a31f704b8328d67440e22ec5c3d1e8af

SHA256
030847c8d85d6faf5ccfe613d606eb6565d089dc2ac223a5193e97217b49d069

SHA512
5213dd4d03f029be7ae9871a53ba111bcad978f634941ec85dd24eefe564f14d3bc1500996009d135add02515fae37eb4b0d51c006ea5fee001997c962c03892

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
41a627080697428e3b06e44ecea393b2

SHA1
08faa7b7a6056ebf147d166fb0983d6d81fcfbb0

SHA256
2b62955e1056a6e06f4efe223020e2251e7f07297a1ca86d895f3e7728c35d7c

SHA512
3ce09c3e81ec0d6259821662fcbcde118baf3053e8236545257fe3a9eb96e265d796525de30d8105ddf766f459cd682c4366518e464e1b181ff2e54920c82212

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
f9854451fb75c9d2fea9cacbdc7260b6

SHA1
cdd918fe4a80592748d6a9276d19bc10614a9112

SHA256
25918ef2225d6cf608fa658b61734e80e33b238553b8816cb01cbe628984b7cd

SHA512
e6b08fb34efc5ee6edc56a7d5b0f7045883f7ff1b692314915f2054647c55b29f5b728e714186b0665a23a67e18b27dd80bee90be5afb1510dd244167e3c9f78

Download Submit
C:\Users\Admin\Downloads\Sin confirmar 222216.crdownload

Filesize
1.1MB

MD5
dc5dd4bb664c7a5b89adb87740f410aa

SHA1
3530be832f3878c9227a1ca3166c35eba433bd76

SHA256
d77648c1e78a6080111047b0fc08d40f6d4c7017171a57abb26fc442c5831e8e

SHA512
e9e8813d7611c5df146f4cbc415369b288d045393ef3683fc413152aa40b3ecea34ff7cdcdf75e1f18b7a11ec48f647f65c466d154a1cbc722bf996398d8a194

Download Submit
memory/2196-365-0x000001F408070000-0x000001F408071000-memory.dmp

Filesize
4KB

Download
memory/2196-361-0x000001F408070000-0x000001F408071000-memory.dmp

Filesize
4KB

Download
memory/2196-367-0x000001F408070000-0x000001F408071000-memory.dmp

Filesize
4KB

Download
memory/2196-366-0x000001F408070000-0x000001F408071000-memory.dmp

Filesize
4KB

Download
memory/2196-356-0x000001F408070000-0x000001F408071000-memory.dmp

Filesize
4KB

Download
memory/2196-364-0x000001F408070000-0x000001F408071000-memory.dmp

Filesize
4KB

Download
memory/2196-363-0x000001F408070000-0x000001F408071000-memory.dmp

Filesize
4KB

Download
memory/2196-362-0x000001F408070000-0x000001F408071000-memory.dmp

Filesize
4KB

Download
memory/2196-357-0x000001F408070000-0x000001F408071000-memory.dmp

Filesize
4KB

Download
memory/2196-355-0x000001F408070000-0x000001F408071000-memory.dmp

Filesize
4KB

Download
memory/2272-340-0x0000000004C10000-0x0000000004E49000-memory.dmp

Filesize
2.2MB

Download
memory/2272-339-0x0000000004C10000-0x0000000004E49000-memory.dmp

Filesize
2.2MB

Download
memory/2272-310-0x0000000004C10000-0x0000000004E49000-memory.dmp

Filesize
2.2MB

Download
memory/2272-312-0x0000000004C10000-0x0000000004E49000-memory.dmp

Filesize
2.2MB

Download
memory/2272-313-0x0000000004C10000-0x0000000004E49000-memory.dmp

Filesize
2.2MB

Download
memory/2272-314-0x0000000004C10000-0x0000000004E49000-memory.dmp

Filesize
2.2MB

Download
memory/2272-311-0x0000000004C10000-0x0000000004E49000-memory.dmp

Filesize
2.2MB

Download
memory/2272-309-0x0000000004C10000-0x0000000004E49000-memory.dmp

Filesize
2.2MB

Download
memory/4084-586-0x0000000000520000-0x0000000000759000-memory.dmp

Filesize
2.2MB

Download
memory/4084-585-0x0000000000520000-0x0000000000759000-memory.dmp

Filesize
2.2MB

Download
memory/4772-551-0x0000000000520000-0x0000000000759000-memory.dmp

Filesize
2.2MB

Download
memory/4772-552-0x0000000000520000-0x0000000000759000-memory.dmp

Filesize
2.2MB

Download