gurcu | 9576e9374b80cf62824e4de89e24f6bf18617e1ce62d21a1a1a0c72ce45c9090

Analysis

max time kernel
572s
max time network
575s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
25-01-2025 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XS CRACK.exe
Size

22.1MB
MD5

8313790fde74e18b43d255f830af9b00
SHA1

0123f92f250415b13f0b1a3c8e60d9b3212de255
SHA256

9576e9374b80cf62824e4de89e24f6bf18617e1ce62d21a1a1a0c72ce45c9090
SHA512

b120f54939840fd2881e0a8b39872456f8712a3cb7e4471c47618ca9268464a2fd743adac3ac85e014b130654d8d7edd3e4aa04a9982eee518201b4d7c1828e5
SSDEEP

1536:QebSCbpDbmenavCGrYuFJQ9ZrR9E4ub0tAr+:t+utbmHrYuFKrR95tAC

Score

10^/10

gurcu xworm defense_evasion discovery evasion execution persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

very-stars.gl.at.ply.gg:23028

Attributes

Install_directory
%ProgramData%
install_file
system64.exe
telegram
https://api.telegram.org/bot7592133817:AAFoMe-c16pn4My7-EODEINEZeWZ2Milavo/sendMessage?chat_id=6723354517

Extracted

Family

gurcu

https://api.telegram.org/bot7592133817:AAFoMe-c16pn4My7-EODEINEZeWZ2Milavo/sendMessage?chat_id=6723354517

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/644-175-0x000000001B7C0000-0x000000001B7CE000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/644-1-0x0000000000550000-0x00000000005A6000-memory.dmp	family_xworm

Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
stealer gurcu

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	powershell.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 1 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	powershell.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 644 created 684	644	XS CRACK.exe	7

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4324	powershell.exe
3608	powershell.exe
2900	powershell.exe
1824	powershell.exe
3664	powershell.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	XS CRACK.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1508	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system64.lnk	XS CRACK.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system64.lnk	XS CRACK.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows\CurrentVersion\Run\system64 = "C:\\ProgramData\\system64.exe"	XS CRACK.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1492	sc.exe
3152	sc.exe
2504	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	taskmgr.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4324	powershell.exe
4324	powershell.exe
3608	powershell.exe
3608	powershell.exe
2900	powershell.exe
2900	powershell.exe
1824	powershell.exe
1824	powershell.exe
644	XS CRACK.exe
3148	msedge.exe
3148	msedge.exe
1656	msedge.exe
1656	msedge.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
4680	identity_helper.exe
4680	identity_helper.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
4916	msedge.exe
4916	msedge.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe
644	XS CRACK.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
644	XS CRACK.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	XS CRACK.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	644	XS CRACK.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	2944	whoami.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	4028	whoami.exe
Token: SeDebugPrivilege	4028	whoami.exe
Token: SeDebugPrivilege	4028	whoami.exe
Token: SeDebugPrivilege	4028	whoami.exe
Token: SeDebugPrivilege	4028	whoami.exe
Token: SeDebugPrivilege	4028	whoami.exe
Token: SeDebugPrivilege	4028	whoami.exe
Token: SeDebugPrivilege	4028	whoami.exe
Token: SeDebugPrivilege	4180	taskmgr.exe
Token: SeSystemProfilePrivilege	4180	taskmgr.exe
Token: SeCreateGlobalPrivilege	4180	taskmgr.exe
Token: 33	4180	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4180	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe
4180	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
644	XS CRACK.exe
4500	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 4324	644	XS CRACK.exe	79
PID 644 wrote to memory of 4324	644	XS CRACK.exe	79
PID 644 wrote to memory of 3608	644	XS CRACK.exe	81
PID 644 wrote to memory of 3608	644	XS CRACK.exe	81
PID 644 wrote to memory of 2900	644	XS CRACK.exe	83
PID 644 wrote to memory of 2900	644	XS CRACK.exe	83
PID 644 wrote to memory of 1824	644	XS CRACK.exe	85
PID 644 wrote to memory of 1824	644	XS CRACK.exe	85
PID 3148 wrote to memory of 1060	3148	msedge.exe	90
PID 3148 wrote to memory of 1060	3148	msedge.exe	90
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1112	3148	msedge.exe	92
PID 3148 wrote to memory of 1656	3148	msedge.exe	93
PID 3148 wrote to memory of 1656	3148	msedge.exe	93
PID 2180 wrote to memory of 4912	2180	msedge.exe	94
PID 2180 wrote to memory of 4912	2180	msedge.exe	94
PID 3148 wrote to memory of 2148	3148	msedge.exe	95
PID 3148 wrote to memory of 2148	3148	msedge.exe	95
PID 3148 wrote to memory of 2148	3148	msedge.exe	95
PID 3148 wrote to memory of 2148	3148	msedge.exe	95
PID 3148 wrote to memory of 2148	3148	msedge.exe	95
PID 3148 wrote to memory of 2148	3148	msedge.exe	95
PID 3148 wrote to memory of 2148	3148	msedge.exe	95
PID 3148 wrote to memory of 2148	3148	msedge.exe	95
PID 3148 wrote to memory of 2148	3148	msedge.exe	95
PID 3148 wrote to memory of 2148	3148	msedge.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3664
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" qc windefend
    3⤵
    - Launches sc.exe
    PID:3152
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
    3⤵
    PID:2568
- - C:\Windows\system32\whoami.exe
    "C:\Windows\system32\whoami.exe" /groups
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4028
- - C:\Windows\system32\net1.exe
    "C:\Windows\system32\net1.exe" stop windefend
    3⤵
    PID:320
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
    3⤵
    - Launches sc.exe
    PID:2504

C:\Users\Admin\AppData\Local\Temp\XS CRACK.exe
"C:\Users\Admin\AppData\Local\Temp\XS CRACK.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Disables RegEdit via registry modification
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XS CRACK.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XS CRACK.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\system64.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system64.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qc windefend
  2⤵
  - Launches sc.exe
  PID:1492
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
  2⤵
  PID:1728
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /groups
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\system32\net1.exe
  "C:\Windows\system32\net1.exe" start TrustedInstaller
  2⤵
  PID:2720
- C:\Windows\system32\net1.exe
  "C:\Windows\system32\net1.exe" start lsass
  2⤵
  PID:4964
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffeffa33cb8,0x7ffeffa33cc8,0x7ffeffa33cd8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5112 /prefetch:2
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2512 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1856,9866361966959544803,14702509241599382875,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeffa33cb8,0x7ffeffa33cc8,0x7ffeffa33cd8
  2⤵
  PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2916

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4500

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4572

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4180

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeffa33cb8,0x7ffeffa33cc8,0x7ffeffa33cd8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,17278740813689608189,14770069894235526648,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5576 /prefetch:2
  2⤵
  PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\system64.exe

Filesize
22.1MB

MD5
8313790fde74e18b43d255f830af9b00

SHA1
0123f92f250415b13f0b1a3c8e60d9b3212de255

SHA256
9576e9374b80cf62824e4de89e24f6bf18617e1ce62d21a1a1a0c72ce45c9090

SHA512
b120f54939840fd2881e0a8b39872456f8712a3cb7e4471c47618ca9268464a2fd743adac3ac85e014b130654d8d7edd3e4aa04a9982eee518201b4d7c1828e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1d8b91fd54935e107172c087d1787dc7

SHA1
d2e3f341d289bc7198f6ab5fc97aae1beba01362

SHA256
06c41fa38109519dd76333894c8408049b10d494477e314ceb2b01319c9ea400

SHA512
84209c45236fb78397ed954fbb2e0dd54e9a1c8f78f0c58dbfdf36f563523ec8393e0194fb3a8c3af2a659b812665a17f99d1acdd1acc508659493ff79fabef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
664efb0561dbaac53300158c7ba579e9

SHA1
c0ceba35101a6330af8f3abe1fab484306531651

SHA256
01da79c7f68bb49276de44685b313ea4dc2048c2578f674dc865e6e53def9abb

SHA512
693d6af6438aaf3e6b3198e5cc6613eaa23b6ff79b3da694ca69525ba99cfc9d55ad76de6739148a9bfa1d2edcba791c1508d04b5741176af85994045771e7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
08f1a21f735c9b84759f9a8251820527

SHA1
79801d4963608ea0860ddca284217ec4165b96f4

SHA256
dea9597468492b43591efd22e2bab770f0989c9f82f2ba1b44cf26d1ed2cce1e

SHA512
0674016564e9861a66645bbe33826891fc54f406e75ca45e248edb22171fd34db085168565c4a7206e7e28bdf1b7f6219f50ec26c80ece5185f9a9855e91492f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
ecc6ad5cdbda3979a23c516aeef08201

SHA1
e9edddad79fa51d4fdae5c4215da93ef5f499501

SHA256
3704d13dab76f2a420e0d28d5d75f52d1287820775a0c97f9999d12aa45ad0f8

SHA512
edc086797aa61eef28d5429364ad3c7b3a47fc57a129b2b90820352a87708b7c937ef8daafd1059bff8a410e2d3fccdabe0c1833167c36720404c3f39977052a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
128c0a0a065b192d58da56f13693b9a0

SHA1
b0d27a48429be31340fccd67928f80b9c122918c

SHA256
ad93f683d7954c8248a914324eb493e58f546977c51a3176d2d242075fd040f0

SHA512
c7c546ab45e6fc110d1b4bd86800dce74b8ed786931e8f031c3ccb02bac8c09ebe130e7ae33283a451be3a9712a5220f9ad9d976b4ea2561705e0a164449d1c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
f500fc40ba15727df4ad0d69b261752d

SHA1
11de401e13d241af7c33b2e1a80a7483deeabb5e

SHA256
d5cd3c52079480f6e6b823bb89d0e86bfa047be90df604fa458eb7cc0c79077d

SHA512
dcba806b6d2ca73c1b9205e2fbdb6236343cf562c86acc94c206e608324a7fd7cdc7a66775b261d654b58968b7a0d0820b9114617fd91155115f9f1986731927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
b8c03ab84a0484cd9c616355bb6f4719

SHA1
8b3b904b31e664654ccac1cbf54dfe2cda5ad22d

SHA256
37804b98c4f23e371926325b4a1556e9bb1891fb34a02ade973d20b63444af4c

SHA512
930f1b45d755aeae976779fd72394e24d3ad56ae7703be993180bf0d2ce4e4fc079c9b4cdb05b880c02136465ece7169e315c206c40257a2ed498390d3baecda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
fb04134c34efb65d723c2130167c7f0a

SHA1
7afae292243e09f7534a56bec9cb0d3c5fbdb252

SHA256
3079013464f11f8af6c08b13062d810e257d0f60d04f6d8a35f9a59117535225

SHA512
1d2037fffbd7c1ec073e3b4458b9739626282b98d66267b63d104b6025c969cd9c05f280007b17698b072fef89984076bbeac6f68268239561acb4c2070f6290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
cfe69a93de6ef7dd13babdee5ba96063

SHA1
6ac1a4782732322fafa2f60bf9258896eab460e6

SHA256
41ea34e4f4bc00eb6be237a9a2b2b02daa221d41f6cca7f1c2fa78f25f4c6610

SHA512
a42f1268b5467847e31f0603b1b719877bea979692ea35ea93469a658091b952cb99bceda32b83c4ff9f97838f8312b0055e272a1ebd6885081b7eb7a1267a8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
1KB

MD5
b6d8b8ece9029216e18973ae160be5b8

SHA1
028b4458817b692b018a057efda00ae2609707ab

SHA256
a3bf2ad6408458a1721cd69ee5af348a43f40f2acfbc476695a4cc4047a0caf4

SHA512
f29c95dad5f3f5bea1f1ee0643e4c68122fa5b949623224cc1e778b73a3c819f187fd3a20ae416ecd94b652f88c8ea9bff1c97e3b236071bf05c86a275bd4f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
276B

MD5
536b14e3815d363619fb43ad334ddf77

SHA1
606116f672b0364d62cb336f7294bed23b597922

SHA256
1e24354b49336af4ba95d554bb7204527792a148d6f3e57301c98d7ab759996d

SHA512
195a09bcdc5d8225b9dee57203826fad46ea501e10cef8ae413038ce4aa06ee5d06b2fe113b32c3fdf27f0992d65dea90487a63654cf70a75110e47e74f56920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
f0e49498904ec027fa4ab40ec0bc94cd

SHA1
48430962e4f62c4675239a9eb89ccac83c5a728c

SHA256
babf739d142c6aa1f4345b65c5b62c78ccd2c88d01e47817670e89118bdf122f

SHA512
1eceb53bd68cfd303a447d1d0d6149f5c7f6c06a3958d6086837f3cf7b15cf6b85f6a82e87e34fd6d50642530732063182886faf8803166100d23fe44aaa3dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
807B

MD5
17bfb71cc03c777afce3ddbf1964a830

SHA1
231fc8e9630deb7d177ecfce4bcf280fc3769626

SHA256
924be058b2e09c575cee0dc27ec4a6f5c3a20bd6ad0aabfc1a443cbed42da6e3

SHA512
b8f342c05911002c3c623f845b04745cd5e46df11aecaa2435a2fbfaf1d8b15904e99ff2affee9c07d3577c716eb92116e8a1c7ebb7ed421c2e16f578319b101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
838B

MD5
7f51edd26589cf61ff6a72d0b25bc3f8

SHA1
95329df51b56a677c22e719e6af758526793af6b

SHA256
cfaa226497ae486e4936bc216c96c5fe7a6c25dd4845ad0e87620d1159f0e865

SHA512
751ee45ab0122b4266e746d8744982420cc3dc91beb42de49df6e2e7cb6b6a66dc014b0c1d067d8e3f7332a8f6df9372ba521ddecc1a59612acdfc61364ea55e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
838B

MD5
515f727759827421e3c305d94350fd69

SHA1
67fd9f1f5b55d1feafa29081d301c74d39752908

SHA256
7b7d1da4c381a58a82bf8a0619e941ed86224e23c12d39bead7ae7ac7c4728ee

SHA512
f829512532d6fc7c12bb87d6af4119a4476068fbfd88b38c24321866f58caeaa642a416078dba116e848ee667227250c679495f0512618b0177a09b9d4f64aea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1a7de59dec994ec0b495be9fbe365b67

SHA1
c1b20d74e3f58346699769acbf45695fc75a8572

SHA256
431cba0f8c8670de1fe8b4d9e5e3cf0b4527a3b709d1d377312cb4776965eb80

SHA512
40470570b0118b9540f47fd00c95f9e1830888f8aead36068015b138c5b3f4a3ca319dcca77b0ce1d76cf5ce41cb37c592e77f1d38c8423802b72e5d2d471f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7cce6b996e021ade6ebba907bf1b615

SHA1
d9e9f2329376819940c0fb9c71bf1f81a065fc8b

SHA256
1261f3255db6242cf90a61e3ad8df7b782da29943313ece39f10e823d4448049

SHA512
5a15c0d99be0c50459b453ea52c404c488903304dd254a841f146f8976ee61e1b2023433ba4dc327a04e07ea6e733dd886561456e48ecfe9924c2027cd29595b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51e202beff518e68c5273f4fda1daaf1

SHA1
324d5b01aaa764fb6f48c8f4fa2d569b59ee929b

SHA256
5bdd53244fa0c769741ef316adb56a44a81c4f3d7f858d53608315ba1900fb5e

SHA512
66c4678d3bf708e2fc1c42db9f252a1c70dea0010e3355b201641fff4748b979b1b4cbadc41900c0f743c644b7c4bb72f196ce2c5dc53892fc163138ab9c2b02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f05c5de9b38f7475a5703d6a1662711

SHA1
4cd695e737046034402aa19cf4c59a89dffbe631

SHA256
14f32dc0c19eb54fca6237f6d8bc2b90b9fff19690fba160644be474d24ff60f

SHA512
9b88a6a05302448639f630e76f3a7164a85af9b544ba6b8659749ec256d9acc9463f9fd829ff76907f82098346f24d34e03f8617485ab1f63d0b0fc59253f221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12eac8974de303a4fb83f78eeefef66f

SHA1
979828fcde0498302a01959099989d4e921925f3

SHA256
5cde9ce44a581c71f7c378640f57d6f089153721dabeba09da6474db767a7d4c

SHA512
fe2205595f5d749e331b343f0c2bb388f08de7856530ff8bcb6f18daef25f57cea68090b7d90b3cf7f0fd0b62a36e860623f38957c6cd195033c09f7ba506ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e771aa4ea43ab3a0b8d66197df560c2

SHA1
32259cf381a6c39b5a9433405a8792068cf997ab

SHA256
f166dc6506b42f6c91686f276a3e88b5e022d2770e29e71578a83cb504171a1b

SHA512
7f770691e21e7f548989f71f8eaafc480ba5e1b7c4e0c70b340a1626182425ef6e710595540ffbb38c9f2004d1213adf8f0ac65f48aeecfc94a487be545f4696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
13332e42643b9041eb7e553e8a3c9f0a

SHA1
5e96d15b3f1b1ec55946596fd05120ab91504057

SHA256
f0b9b0532e2b099caccfac1b6849d587f6d932140e10bb130d3852df8cd13eec

SHA512
258757aa6f450c477030ec3a0ff76ebf4019e4e3d2949e4f50c73b62db95f3c844c2230ced6da6d105e3797ad6470119f92a0d14c6941ead38b90d87a96d6bcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff87b4f09506ff7f2a6ca9d740dbb9b2

SHA1
8faeb5467c6d1cf8898ff1935ff1aebe6e4742e8

SHA256
13fb4b016bd105bf27e84664e8762d5b9a2950ec72202b2084e9777a0de25958

SHA512
dbecb86abb5e970c71d6052aa94bdb9a76d48000b5498a9886c6c4a34fd16278b787bb2cd3e03ce4d17bc5aab5ef4e88682f9b6d8ab9e4c93082cf113b146f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
60116c6bc39e8638816d911edecfb296

SHA1
81e8ab5d2f22587b94221c2ffe8382c848f0c682

SHA256
2f443598e905fbd0c3a1be8233bf3bbacbc7011dacee0652f2e725a09d59d27f

SHA512
8c7199fa86d23f8575613119a1591abaf27697970867d5e1cd88a0c4bcb3761d8f5a8da534974bd6022d2dc06dc0f36ebaa19887b07fe9c1ad7aa6c8f10ff62e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000004.log

Filesize
281B

MD5
f196f49f8ce1b9fd4765c36f5bf7426b

SHA1
890fd1c344c5d39b8d4af769cef4caa9e53bd090

SHA256
19e876164edde85f5ed6cbf5ea9f4749e594b8550749f3d5b08212951b9be8d6

SHA512
c71ae21f1c8d9e8f38d8c8b44a17a8706f04d71c35f2ae595d2c73c3858aa196ac8c8c35742b51c5071fb708aeeac30622b58e616063929f0fd9390e371fa968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000005.ldb

Filesize
353KB

MD5
2e62e4eec898f35f74457dcee7dcc922

SHA1
42f8c10528fc7ce34d6ff5ba69ebd719be55fd00

SHA256
4513ef40a4dcaafa4fc9e49e0ffd2bb33865d58168ab35c393a9d4c40d2764a7

SHA512
8443f32b53ce02c1d99cbf4f10e5d6605afe65cd8c4dae01481c369d3152828b11f7436adfd77f9997951f4d52bde9d1b5636c9ca8bac4bf3b551c6a0c119864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
483B

MD5
e4f536ad2f2d874d72964020861c0b95

SHA1
ed55ea7251418c439e1d92d61ee6cbe9f5dafd89

SHA256
7c703660ce0fdc239ba41027ef7cc74f2664f24c37579a7fb2ac80dc0d6622b9

SHA512
1f61eae418013034d0b5b1fbd202402d0a9de80874b116dbcd451c7e0b5652b18233e9bf8dcd707ada80331149f6cfeb6e5588ed8eb29384a1e00cceb6b5ab6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
98B

MD5
620595b577c8c7d38a64ef4e42ec40d3

SHA1
b3bbea19e6c6eca54f3cd6a5d7064fbadc929548

SHA256
b7739ee7eab9b5c212cfe6df2957ece57cc3eb19b23451e3e3b64df4d387691a

SHA512
55ba40bb528e039443f2f0568cc97ee11556097888604d8e9dee0045af1c07f80e2bfab4dde77aefe2bbbd2648266a3240f51eace275ee95358a055ce12f9646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13382261580656441

Filesize
7KB

MD5
1c59a2a249ebbff71642cb34a66a8cd3

SHA1
b7d2573d88c737b718c8af4333050ea80b4a4c91

SHA256
4abb3b0d6066d7b7985748593966c1e7a2ca7cd35b6ad7d5e47fd7c05f286924

SHA512
4bee1025012ca2ba0564b7b42bdf3a8bf08faa7f57149d9c6751d2317acc7920994cf2f3947f0322f201609925bdb1a9ad384c09d0a6df0fe4366035e8a931c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
cf699e20a4a2e6990b17e6f76d2df517

SHA1
6f73b3e643c469af9c815dd179c7b1f89553b8e8

SHA256
70d17b2daf2186d6d615a6498f78a73f46e23cb00fe188ed5ff3e67eb1fdfc6d

SHA512
a4286aa137aa4583ca954d1f148c2bfd10839f573e0070f2b95c35b93875f06dfe15ededf65a1174736d7639e914bebc951a6d771848a702fed679b18c89e686

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
8fac172f0a7b5125c578fa93686ffca2

SHA1
11d2cd6d89e0ef2b6ce167085017359c91c331c9

SHA256
21c4833198664062bfc83d8b616267f2b2ec0893f9ff960065d3110bbf050c80

SHA512
8d80707decb0fd7662cb43d4bb7cb2ea241d87695aaf7e5e8f0e6e7b0332772a1a80bf1a8b48b1c118004b2e553a051f222acb4948b5dda11d2951b4791a0540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
6ea9ed3b6cba9f47f817589aad43a0b9

SHA1
17349311f0d634fecd298db95f4de816f8082f68

SHA256
98fd463bf9223dfcaf98096122630c608f0ce733d401984ae0090c7efc8bc9ae

SHA512
f66bc19e6f309025e835be79974071b237ef0ff985b40b8d5956d679db1d719e298aa962c24187f3a243169d6adadd605aafcc5b6ff219982beada9d8b5f0b28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
b4596fce8e5c6ddf9665e20ba8b012fc

SHA1
b0265be07352825e9625c305b568119c2a24a4c0

SHA256
c5f04e08623b869aba50f20220f13cfb2e7024be7b1a90d23ab1a608d6bfa2b8

SHA512
9d3d3e04aab666ed59b64f38a5040ce210ee9f2f2456c181b2a2ccea65c4b68dc7c9d367af8d6b162fa21a7890d56f306fb4c82aecdec86fa459f0dc4e71bcc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
ed9ed06802881caed421750494c6be50

SHA1
ccac36d902a95beb1c189bf521dd201defe68702

SHA256
5e643d9e26125a48ed5dbe6d475919b2bee087a2c7661a756445844aad761b57

SHA512
b1ec565e4b0f5be0e28deb3f2a935c7b4f3f184abea18b51afc1d6aa85de905ba21b89406e64b6e57b03410c47d8e58ad60500c6d85a7ef2cdac8a5c412de75d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
f2630d846d2f811e2c839186fe25e895

SHA1
6fc0e1d3660644d633649e37058002e16616a184

SHA256
b9a0acdea62fa73e077722b46ac4883de5882c632b7c398f7de4e561f8a4f2cb

SHA512
e5642ab34f20bfa46aca57be7745def5b3920a927fafe510fb8e3b1a98ddd58a20340fa44aebe3c49ec6142836a0420cdcfc5713e389cc90731558d016f02e6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
95B

MD5
021b8d293c14358bb37b18ba45792aa5

SHA1
22e73b3a1d152734191bf7de9472a54be346b706

SHA256
5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8

SHA512
ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
749b94d812fdd8d79e37dbad0957f001

SHA1
17392fc55c799b881bc701d2962a327af8146155

SHA256
6bab0bb3fd389b5e72ec0bfe9d52449c209c90757b11b51f4a2f4fe3fe8776f1

SHA512
c0aff6483936c5ed0f0f5b2c1b08ed391e1b9a33ae88d06b03fa6b47b16ae01c7d7505eb2163efbbc897bcc95be087420836267bfac2f685c7361c74951795a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
743f9c743a801347568515f622b9523e

SHA1
5ebe8988ab9a4504f40957488af150a44a2a0554

SHA256
b60029bd2afc294fc648286ddd1d18d6ddc08884e67b1aeab0d35c6421b0aa92

SHA512
a3e31862ac0098924cd155c84166be91a8a12a2ab168f2309bdb5fb053a6215a0203384b92bd8189839f0087ad4704525e562befe5e6b1c43ea6f955823e9689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
26b9eee44b3d133415aa2aefa2c5643e

SHA1
d0e56182296228029aab03446270dc690534ff92

SHA256
be95baf184159b29b3028d80bc93a5fc6a3ab188f4b91137619aa5995bbb704b

SHA512
0f02cde6b5e3ec6224374808b8f50c5e8e0288167c90f9396f989b866b47de207772e0800f52e09e0030188e634d14925d5648bf8a86aaa97ca95887ad9275e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1ea98dc5ffaf12e7815d9b3df3599344

SHA1
b9a4df3ec336f7c5df3dd37878b8f74888da1044

SHA256
225777069ccf2e6eccdad601936731fcd9ec0277b0995c26018809698fee9c11

SHA512
4be90b405bafa3cd7942298715c6f4b7d4009db0fb4910f7478c8b728af4b49ce430fb0e201913e76b3b73fa7acd8912a270539284b070dbf927c4b8c4549d28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6de8016b941ccee875fb7ce949a2a4d8

SHA1
baaff95e16e56458b29b5293512dcf5f8ad7b9d0

SHA256
113eed79a8253451b90d4fa7ee525c041abef92d59ee6e1ad55b9e369d4c6369

SHA512
df37a9a1aa7815a9d6e86c82fff034aabccd9d74f8b5561900fdccac84559fbe96fe95994aeb5b302fc1e11404df0af6ee792b4d661630ff8dc3bb1c824cf744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
9be89b7c765afb891d8f7a8e5964932e

SHA1
bcf2d5201ecfd670c681cbd8f4caecec6fb9f608

SHA256
f1d593979b3d8053f3d9aebd278c0a98731419ff24c5559637495686fff96f02

SHA512
e3a824985e3e015927dd18cd837e9ae34fd50de7ef3f7c98d92a27bff9fc62b9d7ac2f84bc83800cc3d61e041b6755f7ec1b0baec68d2a2808bb345d78851af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c5f58404ea3cf5999bcff618ab3d3870

SHA1
76ed31ac2dcf385d892fc66e1d33ed9b1009a6d7

SHA256
925d868e9827497c7a825f0678de97d2c82d08af7ea90599d781f8bcd1a9bacb

SHA512
1e9e4f38b11878e61fd8fddb4fc5971229c9f0e74dec0ddc4eb81e269cd7b7abcc923c827d053288b23b8df13548af00712632c9dcb4ddb4a517559f05fbc2d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e8eb51096d6f6781456fef7df731d97

SHA1
ec2aaf851a618fb43c3d040a13a71997c25bda43

SHA256
96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

SHA512
0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5b705b4839f481b2485f2195c589cad0

SHA1
a55866cd9e6fedf352d0e937101755ea61a50c86

SHA256
f6a3b94a63de605bbbcf1e95cb2d743166f44ea7e9d0d2bfa0e88c94c26e37c6

SHA512
f228eccd5646068a81e79baeaf7e8bfa470b30d503bf0ca8cc746c009510ab609b5c091cadf08fab1e3581900cdb7834c775c61a95a29c2d73ccd0dcbd851bab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f8c40f7624e23fa92ae2f41e34cfca77

SHA1
20e742cfe2759ac2adbc16db736a9e143ca7b677

SHA256
c51a52818a084addbfa913d2bb4bb2b0e60c287a4cf98e679f18b8a521c0aa7b

SHA512
f1da3ec61403d788d417d097a7ed2947203c6bff3cf1d35d697c31edecdf04710b3e44b2aa263b886e297b2ce923fea410ccc673261928f1d0cd81252740dbe7

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\62b7d1e2-af27-48a2-b9cd-7df8e3f01fc8.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sdi4u555.qid.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system64.lnk

Filesize
677B

MD5
a3f0dccf64bc78d3afc97f4ffc392a53

SHA1
4fe4d80967534c8e9be29f6f30ab88858f81c1f6

SHA256
9dad3386d1b90b29c787ffa854b4ea9dfb1ea0abae71fe36839cc9fde77e05e8

SHA512
7e49cd5ce7fb6f0a827d0ed31ca2c5614f6bc012f2e7929b9d6a0b274929a0f7735d2514a8d14e0ade66203c0d697b94d2c04f954eb6f5842eead2004c1ab572

Download Submit
memory/644-175-0x000000001B7C0000-0x000000001B7CE000-memory.dmp

Filesize
56KB

Download
memory/644-454-0x000000001B630000-0x000000001B63C000-memory.dmp

Filesize
48KB

Download
memory/644-209-0x000000001DFD0000-0x000000001E320000-memory.dmp

Filesize
3.3MB

Download
memory/644-244-0x000000001B6A0000-0x000000001B6AA000-memory.dmp

Filesize
40KB

Download
memory/644-413-0x000000001B5F0000-0x000000001B5F8000-memory.dmp

Filesize
32KB

Download
memory/644-1-0x0000000000550000-0x00000000005A6000-memory.dmp

Filesize
344KB

Download
memory/644-2-0x00007FFF04B70000-0x00007FFF05632000-memory.dmp

Filesize
10.8MB

Download
memory/644-117-0x0000000000F80000-0x0000000000F8C000-memory.dmp

Filesize
48KB

Download
memory/644-0-0x00007FFF04B73000-0x00007FFF04B75000-memory.dmp

Filesize
8KB

Download
memory/644-212-0x000000001B690000-0x000000001B69E000-memory.dmp

Filesize
56KB

Download
memory/644-56-0x00007FFF04B70000-0x00007FFF05632000-memory.dmp

Filesize
10.8MB

Download
memory/644-51-0x00007FFF04B73000-0x00007FFF04B75000-memory.dmp

Filesize
8KB

Download
memory/4180-425-0x00000231B2330000-0x00000231B2331000-memory.dmp

Filesize
4KB

Download
memory/4180-429-0x00000231B2330000-0x00000231B2331000-memory.dmp

Filesize
4KB

Download
memory/4180-427-0x00000231B2330000-0x00000231B2331000-memory.dmp

Filesize
4KB

Download
memory/4180-421-0x00000231B2330000-0x00000231B2331000-memory.dmp

Filesize
4KB

Download
memory/4180-426-0x00000231B2330000-0x00000231B2331000-memory.dmp

Filesize
4KB

Download
memory/4180-420-0x00000231B2330000-0x00000231B2331000-memory.dmp

Filesize
4KB

Download
memory/4180-428-0x00000231B2330000-0x00000231B2331000-memory.dmp

Filesize
4KB

Download
memory/4180-431-0x00000231B2330000-0x00000231B2331000-memory.dmp

Filesize
4KB

Download
memory/4180-419-0x00000231B2330000-0x00000231B2331000-memory.dmp

Filesize
4KB

Download
memory/4180-430-0x00000231B2330000-0x00000231B2331000-memory.dmp

Filesize
4KB

Download
memory/4324-19-0x00007FFF04B70000-0x00007FFF05632000-memory.dmp

Filesize
10.8MB

Download
memory/4324-12-0x00007FFF04B70000-0x00007FFF05632000-memory.dmp

Filesize
10.8MB

Download
memory/4324-13-0x00007FFF04B70000-0x00007FFF05632000-memory.dmp

Filesize
10.8MB

Download
memory/4324-14-0x00007FFF04B70000-0x00007FFF05632000-memory.dmp

Filesize
10.8MB

Download
memory/4324-8-0x00000283BCFA0000-0x00000283BCFC2000-memory.dmp

Filesize
136KB

Download
memory/4324-15-0x00007FFF04B70000-0x00007FFF05632000-memory.dmp

Filesize
10.8MB

Download
memory/4324-16-0x00007FFF04B70000-0x00007FFF05632000-memory.dmp

Filesize
10.8MB

Download