hxxps://drive[.]google[.]com/file/d/1CdGTecJ_DbiDL7ix6ZuERI_-ePyZmaVo/view

Analysis

max time kernel
779s
max time network
780s
platform
windows10-2004_x64
resource
win10v2004-20250211-en
resource tags

arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2025 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1CdGTecJ_DbiDL7ix6ZuERI_-ePyZmaVo/view

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
114	2536	Process not Found
233	2692	msedge.exe
260	4576	Process not Found

Executes dropped EXE 4 IoCs

pid	Process
5500	winrar-x64-701.exe
3340	winrar-x64-701.exe
5264	winrar-x64-701.exe
1880	winrar-x64-701.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
10	drive.google.com
11	drive.google.com
12	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdateBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdateBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1988	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 0c0001008421de39050000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 1e007180000000000000000000002f492640692fb846b9bf5654fc07e4230000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 355485.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2400	vlc.exe
2208	vlc.exe
5524	explorer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
4104	msedge.exe
4104	msedge.exe
376	identity_helper.exe
376	identity_helper.exe
2044	msedge.exe
2044	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
5340	msedge.exe
5340	msedge.exe
5416	msedge.exe
5416	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4032	OpenWith.exe
2400	vlc.exe
2208	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1764	svchost.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
2400	vlc.exe
2400	vlc.exe
2400	vlc.exe
2400	vlc.exe
2400	vlc.exe
2400	vlc.exe
2400	vlc.exe
2400	vlc.exe
2400	vlc.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
4032	OpenWith.exe
4032	OpenWith.exe
4032	OpenWith.exe
4032	OpenWith.exe
4032	OpenWith.exe
4032	OpenWith.exe
4032	OpenWith.exe
4032	OpenWith.exe
4032	OpenWith.exe
2400	vlc.exe
2208	vlc.exe
5500	winrar-x64-701.exe
5500	winrar-x64-701.exe
5500	winrar-x64-701.exe
3340	winrar-x64-701.exe
3340	winrar-x64-701.exe
3340	winrar-x64-701.exe
5264	winrar-x64-701.exe
5264	winrar-x64-701.exe
5264	winrar-x64-701.exe
1880	winrar-x64-701.exe
1880	winrar-x64-701.exe
1880	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 3976	4104	msedge.exe	91
PID 4104 wrote to memory of 3976	4104	msedge.exe	91
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 1868	4104	msedge.exe	92
PID 4104 wrote to memory of 2692	4104	msedge.exe	93
PID 4104 wrote to memory of 2692	4104	msedge.exe	93
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94
PID 4104 wrote to memory of 2224	4104	msedge.exe	94

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1CdGTecJ_DbiDL7ix6ZuERI_-ePyZmaVo/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffceead46f8,0x7ffceead4708,0x7ffceead4718
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2228 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5192 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2316 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1192 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1284 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7324 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,857290094134284457,18222224242847550963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5416
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:544

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjQyMTg0QjItQzc2NS00RTJELUIyNEEtMjlERkU1OTYwMEQyfSIgdXNlcmlkPSJ7NUIyRDZFNjItQkU4NS00MzMzLUJCRDEtQ0ZDRTQyNTQzOTk1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RkFEMDE4NzQtQ0U1RC00MURCLUI2RkQtOEYyQUY4NkU4QzM1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODIxNjkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1MzE4NTEwMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzU1MDk4NjA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4032
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\YUZU EMULATORS ARCHIEVE LUIGI PLAY.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\YUZU EMULATORS ARCHIEVE LUIGI PLAY.rar"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault35bb5956h26aeh4344hb326hcb39f4ade791
1⤵
PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffceead46f8,0x7ffceead4708,0x7ffceead4718
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6621261844745645234,8576626136009347512,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6621261844745645234,8576626136009347512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5340

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5476

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:5524

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateBroker.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateBroker.exe" -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5776
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /broker
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5796

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc
1⤵
- System Location Discovery: System Language Discovery
PID:5836

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateBroker.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateBroker.exe" -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5984
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /broker
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6012

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc
1⤵
- System Location Discovery: System Language Discovery
PID:4072

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\fdc9194581234e2a83f52a1fdea88332 /t 5484 /p 5500
1⤵
PID:3216

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3340

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e381cd143da54f94a49693efac4de9db /t 4808 /p 3340
1⤵
PID:6064

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5264

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\1fda3663958b414e879ab774967e8eb9 /t 5248 /p 5264
1⤵
PID:3912

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\95c03c2d6b7a466d9984c7dceae851d8 /t 4472 /p 1880
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
908KB

MD5
353ad5246d5ae00c1d5715b3301088b7

SHA1
dd1c3f7aeac30dd88d03d7f364ccf0c2e92e9d69

SHA256
ea877899a335a432b083d8c18b2d66a9bfc5744e036d4d8028099c1e8771b706

SHA512
e06141bd913a468d23f5cd8ce8d4a20998c74cc87dab45d03252d4ceb58b4d4bad99120620ef9bd574e90505f3749a3b625a762263b131754725f8508028cd68

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
912KB

MD5
d44627e06a6f153a5bec234dddb43ad6

SHA1
97b3703259c0db3835278eab76dc6c75b4ea46fd

SHA256
3ad1f47bb241a46f461c9123bd2c59bfabdacbaf2146f18d82b7d950d5535dbb

SHA512
a642bd25814b74a1f27dfba460b674caf215590354bab93e242f25e3e297d9c24198662bc9881b64377fb5241373e008eee2b12615751d0a672f7994255996c3

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
913KB

MD5
e35d2159e1bc441597ae2f6c8d748e46

SHA1
4dec2767f1b51279560ed37f1a1453c2e8a7876d

SHA256
dfa88b4feae110057caa9b5510cdeb7f8f6e2593392cfdebb17c429c61159593

SHA512
3f7796bbc2f4007af6b86e3f5d9870241d7c63b00dd6ae9aefdbc814f2120584e655f1d28ada7d4e21cf6fba72938bc42314fb420a2b4243fed32719fb16abda

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
915KB

MD5
10b33714f77ef3ccbe8966d6a796f295

SHA1
2783cab63c33c06c3927ac653095e1d99d85795a

SHA256
567dc3058e9bc529905f7e140ede09affbfc0c4e8f982b6662d693fa7eb5782a

SHA512
ffa899a98164eef017b926d72d2b2df00d79e5756afbc3a8c5c66666284dcbace8adddc4dd17ae815eaf3d75a984d4100959b83d454d0a246344bd7d97ac3be0

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
919KB

MD5
08851bef35b501128b874bfc3129a33a

SHA1
124942fc6a765de196c2fa7cbe71680199721f6c

SHA256
cda2bcddb80fd3dd22e9def34cdecda2ffb223a2d0debb0a1ec17ecd9a8162c2

SHA512
a25ca3ffdca5961262c0e62c5e1df638521d404ac336814af4bc5f6292613f21f49f1edf043de48daa77cdb1e0ace74c008212e1777ce6ec80a0810ef3bb6254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
801be0c9974f5b19e11410cdca27cef7

SHA1
31a5e111c6f20b94362d662d101cca5edb64b401

SHA256
9a89f5f26ff7dea0fd13726ed7d8e9dc9535288c75b25eaa6bc254324aa5e36e

SHA512
4bfb4783ca4f9e0affe002b2dbafc3f40e1e051cd5e8a787f6a926e467f307ee253c8a84a43b6882a2b1d11f8e17bdb02c4d74247a1e1716a65ab74df7fc1135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6393f79a5df6261cd25a71a1c7cf2a13

SHA1
881fc5e01962af69cd5cfb630a37f2e7da96e95c

SHA256
551698eed11cef04d0a7bf97ad2c84e78cd45d1e984d104c95b825959d9b9674

SHA512
f9f2b59ed4a20270213d3ce4883ada26edf911df2928fc6f6572812ef70103c61497a8ae4b75c4bcbd6048e90e329b4bf00d07b2d22b5a0c5fb67c9781373852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\623363b9-5489-4107-aef3-3753846b1f28.tmp

Filesize
1KB

MD5
92cf62d80aa725b9baba37d09205cd1c

SHA1
4669cd6a6762beff19cdcbe9de0337b6f50fc81e

SHA256
023a83babf0d736761c3f6d935d883e07fefce6cf330d47f0f134029e7fc9e0b

SHA512
6627ec9007045aa9a1807c0e75a32b40eb6b8790f8ee8301e229a7aac2ca33509ddda06499a6b4d1b1434db09155a0a778bdc82223094b4cf876b5ddbe5f470d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
3.1MB

MD5
7eb66d902a9fea69f5d102cd45d4968a

SHA1
455744bea634c8591d9be582b0309bfe78384197

SHA256
71202c82ff652ce504699be3d9b639cb1946d913051d884fdaa1e1ec92aaa6db

SHA512
5eff336a897eacfd95ea9a56177247811d6b8eb6decb9f7a590fe823c723f4275980a5626c282dd6773ad256758352b8d3b63ecf46150e3c15a96e6228610a97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
862552cff570c620473f65d8e05fe627

SHA1
c0224bf41a1d9acf0b1d004463abc5f9cafbd2fa

SHA256
0ec60cb9d9f81ff7e63c4b8ea18da4545095206037062e1ab2629365b0d6c13a

SHA512
ffb1e88d12d259971b315882eb336e97cb4a1174863418391d68cec94542af2ab16d17c806ee20973e14c6d4a6aaafd68be59a71297989c2d3eabf596d00c277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b479d0f3178ea381f59147f92a8e15ef

SHA1
b7da0c6c1f0e8ad5df47e20448f4a659bc6e0851

SHA256
023a953e75915372160ec01d48d571bcd8c2a295fa8f5e65221f86d27c3e9fe9

SHA512
29431e59c0011bea5523b75c6c2627a4e1ff693faa57e48e38fd5fa832f5524afd4c9a241d61cd404cf75abafe2f050748ad6ec22e3db366f7f8c4ade3fadc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e3354a7573e151b9c50be59bd0b228ca

SHA1
efc3e26f95b05aa8541cf97c030b9fad052bc5b2

SHA256
2de1020afdef9fc7277d45b730df6e2e6564e7f20109b8b9ec3bf023fa212a56

SHA512
ac43caf6fbe00a0130fe090a43f0afcf20fbf72c3dc9ee3aaf53dc89bde52650f56d5f191c67199f576460ec90608e097dfcae3f9a43d8ddf32424c70eff11df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
d241367c9918c0951a0b907738098388

SHA1
1e5782942e37ddcc8b29e8d81fab00762a534bbf

SHA256
7128021dc54c00c5f474a0c1f8da97fb30edb9c3f190a54a5c349edb17af42de

SHA512
e7d7d6c0db350773db612aa44a7cbe04a4a7e5248c1053f62673015441315297e25e341e0da4a7defd00902d0a28c70d5d89739808af6c293c0100df135e50ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
fc2da71f2cddabb6e5a59e5a209f4340

SHA1
c9f32dbaae849a8885fa2a54fde53ab2e48e7381

SHA256
1fd30d548d24bc50b6c8ca80f4e30dbd069d3d53421b0a4db9826a612f722749

SHA512
15873a3bb150c83c39dd556ad68960049c6222f7231f78df64abf000ecd44e322ffcb721032c0be9102d90b84931719ec8581ca2cf1302f7ce457aa5e9602819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d9e8208ba8cd94d50bb5d45b0494e2aa

SHA1
daa9e8426b3352bdcbd2bb4be20e90683fe5c35d

SHA256
c937c707a0c4f0c911c924783d6c49043aaa839f86ee095a5779a2ab0e2581e5

SHA512
fafb265c5c9ecf220cb97ba82d19bed29ca1aed019de9b187f564d9d9b85cd71e924a352dd194f6d970075a4674bece813b1de08f916934024928aa13b100536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b3ec9b073acd9895c2291ac3b4bea73

SHA1
9d43beec1e00fb98e3980281d7fbecfcf7f0e3ce

SHA256
6ad76befc88b97b770bfde7447120d5564950a1102da0adffd690974af2c2fa5

SHA512
0f65b574ae16d3f6eaeef9b8e3ed8f12adc5f2f0a1ffcc665fe030558c7e40d0b834c578ad573e8d86edf098f7d6e3954f0662edcd5bf0f4dda31dcf628c31b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6e56d6f35d0b457145c4f8e6867537ba

SHA1
57a2cf7bcb4a6859300b60417871f7ed31390403

SHA256
e00bfd0b6929b6d54a74c6bbb20ca57ea9e30a4f3f872f14f9b70c6cf8113f46

SHA512
726a9fd10530026b057a82060e4da5a90e7453dfea0a376c9fdc9f9cc27110f90c0f2d1b55d3eb85e22576d18cd98e9b82d1c2bf0cc1acd7793102ca5ee37556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5cedaba5b0bacac853306ea3a0c8ad40

SHA1
a859b5b899d4967501eb7aa0567d51069aa196d5

SHA256
acbd0f4637b91a53fe02d61bb81c02c383ffc58fba28735395fc84703c2e1745

SHA512
29eedf2b323a20c63b5115538bafbb989b1e9d64bac20c96b2e891a4fb975abe7faa003849f6f9216769f27909d45c64d513fadb456f08c3f537a8f07c3c267c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b043bca09752e2b027941e6e8e1e995e

SHA1
31c9853825f88d0e4c7ca65270e06478adf3ef47

SHA256
ff862dd6b3a21dcb27593fdb306ff72ecc4e80c22047c64f036d244f21ccd70e

SHA512
617c850a6dfda7e038b0694ca205988a91401e4cbf52304558522840f3a95e59aa51a0fedf3923a35f114dcc4c06ced4f5fae77b3fd6ad85f6ed60b99504f851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
47f9f1947b6ebc092a3db1f16081d2a9

SHA1
be9519ee73a6be34433e2c88ded9b2d65118d6c2

SHA256
214d917d6121f303b41652c12dd72f09b3b8233d406523336df740a677081231

SHA512
b6c3ceb7877d168f9e7ad2bc907efe53043a3fc877a093eb032b94ec469960a9c61b3b5a6bf8f28479a5282e7c2bc5f3ea05bd62d6adcf1c7a38a6ba1ad8eb19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b3401bf97a1aaa774b5962681e3878c3

SHA1
64fc3d1e221d4ebc4710771393d8cbe1dcc7431e

SHA256
ccd05738cb94bd0dd578b7187444a3701a4e292eb5b78c77f749d8a042338381

SHA512
48dc9cea2f4a8774d730906d627c61eb8f48f2e1ff6aadba4025056d4b6e10ab7c5137b12f76aedb4e83100851324ab21aa9901f2d19d9026a4939d30119db43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bf3d06ce6da4435d353fefdb658f94e0

SHA1
fa42154a8717bc6c7818da6f72927efd3f047760

SHA256
28bc1db8420f9e8cf0086f88178e32ab3fb4eaf6e2de4f9ae7317af900b38425

SHA512
c49d4b65857648ac444561198bbd8e1c3759f760815a49fe694e107e618b26d252aa11eea24f6c8c12f3eb4024ee6592ca29a4bc3c8cee2d30e355a13f6051ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
59b06362baeba118b3d96eb08c30dc7b

SHA1
57c363b92c6a7a44697c1d2c0a274adf5a21b756

SHA256
a49c4f8eb4a098d1cbbbac171efb41b11631f8dbe7bb72e40359af4054338a23

SHA512
ef29285feafb3c231cadc55ade3a3675bc18b5e15c16a333a3c57d5837fe9cc2d36f87fdf4b0a74419503445c5a8a3a5d4b55bf2752a7250cb8842d789a95b60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
78f21a05e05db396a887607214140a7c

SHA1
4906f8566646cfd80a2197cb6a67fbbb6fa012f5

SHA256
6a646e78f64f223bea6c8430bffb8be33d7481d8b1fa510f970ea3a8aea66950

SHA512
be28b8bc547cd5db1aaefd86b6e93a989a2e4a98494963d2afdc62f1476bb4a86aeebeeb41690ee7d747733a169348a8b3d793f6b1ca7ac15cd11b271efa009b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4dd83a5d8b9afd87b349b8603cae1042

SHA1
5a1276a187bb4a777f7269070e7d54c9fef13c81

SHA256
b54ff6e7fa95a3529dcb02c1bff36f7b4db2c9e6591c5cbfebcb4a0fa4144514

SHA512
af76ef2b094f441c2ac7c10ab2c56a758754e14ad6430e7c0c0e93878d3d33930280652b73972823d83197616ae100c194937a54ae673aca6a1b98e5730463e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bf14cd8ec86839c655d1c515b4eee447

SHA1
6bd3ca6638d3eb0423c7c72cd32c1933a1c1d522

SHA256
9790c43f196d861547456f5982da476499299505cad9abf5dd86cf7b118383d3

SHA512
e28d39684a4f2e10699bcf927c4df20c4e4eed4edfafa7f151b241d426b581b6a8e8d3144d354200e299b86fa07440ef18940f6823c7de417fd720ca29e3b1f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
89cd53f7cb7b868ddc7d56a237761129

SHA1
9862afcabf51b2fcf6386b0b12efca89ef04611b

SHA256
2f60eae54d208f7f2b5e59f1eed09770d1b1c6ba5a3dc457f154adfb75eba82d

SHA512
07b11d93c0592d3c2546033d9475f2635cb3af4ba97a9dcb3a9e6d17b93a8ca1564d460858f258f604b869e523817e5e0386e28d461689964611f9b5ef8f94e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7b85d980e25e4b1343d4ba5c7b861170

SHA1
6e85279b63910e264729f3ad46566eeb94fd586d

SHA256
04f00339046088a5cf0e2dd8852ed051ea42a89daf8c8d883c0325a6d0accb73

SHA512
c74cad7f432d4dac23a99b7b34e56dd9719f205582690cc988cf39f8283d41cf9c30d1a2a9a9961b442dd3ac0c28c045f4399beb326adf65e86a92664692b77c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
263f0e7937f85cf5fa8cec6158ed7b81

SHA1
3802f484fe268b2cadd6d727febe6fb16717bc6a

SHA256
d46f054e056823a5b7be808aec41f4f637d10c0bb0e231158396bb7f071033a9

SHA512
ab71b288d0b386bcb47a7d2b1abd732e2ba4f8b771f0cfbf07ad45be19b335a153918d45991380d00a2e2b8a4edd2b696a5b17606d414e720ecbee06c534f2af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
13e42cb516399584751cc8f18c56ccd1

SHA1
a7b5c91f104948e8dc93435cbccb738359bfb054

SHA256
125248a2518531cb0175dc0bd6eff167665152796c4e7849b4b6ddc872c31a80

SHA512
4d0e778f823a9d1117c63ebdf5db941c01b0b832a124af3a22cc3757ab862365b6b8023ff4157d1b2e7240fedc5a80fdc48695db5c69cb80574168a267674827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d5929aa985ef7aec2ae0833afeebba9a

SHA1
855afbd927cf1ae0c14b7e47c7f0a97b3afa4e2e

SHA256
7515fc4b1e14f1937ff900bbfc447d549e204421e90fce6dc10b7ff409c662d3

SHA512
ac92e2e840d5fddfb7ac49c70b7fe7660aa5f525f6f3a4cb839f341d73db32fd9e4c42189bd6df20deace95dfe29b58d93aa02f2c6fd424e825ae205a5bf61f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
34a05369f93b500a24424af6656f6816

SHA1
04961308410a13e17426f8a46eddb027255675b1

SHA256
42750515d2746f94e7117b124bfe8c8e31b2fa8089dd09e3c4e0b198aa12f80b

SHA512
f7ada9ba04aa8d4d5721003c1ea75cf2cb9c9f44c9907e8c057b1713f102944e424a0772bc83efb1fb5e574401bfa6d0c567530cb1fbbd8d7dcf5fd4eb79ff6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e93dee38bf17405c42b92527d4449f6e

SHA1
70aaf985be514ee3efc1eadd580fda62148726d1

SHA256
77fce573280466e721de703dc70c647350babaa7fa8d6a42e6001d8e3dd66213

SHA512
67ae6c8baa81a9c5bb5d2ac56cf6142f4769c2db30eccf313ff2461b23bf2d59d63c210030cd5eb43c22a2c50d66f79ee1e5c1385ffd8de8248c1c0f9fc73398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c801716be551c356c01bcab673681435

SHA1
2fbd54fc5731afab601d4a0a3074b657bb6cfa9d

SHA256
8c3df4fe7909612eb2b6e09a4afeaa0fe0e3ccab5409acc1971c1d75a575b27d

SHA512
4819e8e39c591e814e2ee967d8acd4a16ba0761cfa145b9559a86a73e4ba55b660dbb310d840aa794248117443fe98b73f4c9b6e98c476bafedc5d493317f3b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59482b.TMP

Filesize
1KB

MD5
9f4188456f947a61b32a3b698d71aa47

SHA1
cee8ae87c1ee280ef1f7c1c868841e99c3268c86

SHA256
8aa2ea1bd3111d0ae2ef7b3bffc3e8584ef4ca0f7e3859bc22fe695e901caa4c

SHA512
4ce9f3b287b2879ff711c973be228bd6a4ea1ec93b75b0b9d53ff3491ee7229993a3ee4ae98bd5e29b419bbe921fc255456ee0e4f609c72d2b1884f5a88ba3fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fcbf7a6007f2fd70c5a4df35386c1a68

SHA1
f305c612dd08af53cd62230a28b18adad4857837

SHA256
3b13fc783901b07cd04e12fbbe82bccead041b0226ff3d62ffc434d19e7928ea

SHA512
aa5a84d4d4f1d5ecc8aabaab402d506155053389f7bbd80f838dc6f8c600283258f413b5e713041ec2d9c5cb7621cf785c294ecde8dfecdd5ea63052ccbf6cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7bdc3ec0c4e01c0f5e15bbed2e452383

SHA1
c8108ee41956763bea6af126ae6cbe0b1998786f

SHA256
ad29ab9ebf79a6e0148e46c09e8b00ce139477898ed198d9cc5acc2e136ebc50

SHA512
e7cc291c977323e2e03289103229dfaa54a001da621bca5218a52461f03148870bed5692a35f0a8ec543a828508ba38b653c1e70fad3e00ef78e62949735e246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9fa7a032f31509be11e4f05b1611782

SHA1
116840c3326f6dc2fdc5f20084aa47dbbf68e676

SHA256
547bdf925ed00ef1d548112c970c4c3b0fa1edc0ee0fff53d9642db9b6fa047d

SHA512
5cffdb3de9aa45f515e87e433d6282a9f97d149c29a8e9d7d8a5c29e5bd7683bb7a678a34825259aa5d2c300840d58b68ce2063e5ad93fc413743d35de0743c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b3b5eff156efe1eb53717dc382cff9a3

SHA1
d1cddabae4d3aa2f96cbaeac26d2fa02b8d2df2f

SHA256
90e124baed505ccd1ee26ee148bbe71540355696bed94166aeafcd246212636c

SHA512
55cee6a444d9ae45ff9107501f7cb35f628a633c5d99cb543cc14590c73e13b2b552cfce5dfd4525a322cdca7e244683429eaa79bde169ca2b1e727bbc08590b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
acf8983293ff64ae08e8404632e0f11f

SHA1
959c6aaba10e80a36e11b90ed75edf49a6ec9f1d

SHA256
23b6f46d41a278fd6992698eb347a383685edf556524e79c559a3ba7ee18f262

SHA512
b35e07fe30469691ad61e49af07bee45bb71eb86efd2259bddbb335ef68a6dcf32035c43e2d17db5cf619d8dff0e9b2709fb2969a2009f6d7e3f929ae502314f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3f4e387479acfeb8744383150d891e68

SHA1
60bd8978245d8da34ce9450fb80c451b24781866

SHA256
58e58cb7ee0fd90da2278f050679345dada603e266e7b7d952ffdfbad9f18ce9

SHA512
7968f51b88c04d5691e640a12f91978b36eeda8c9c03a623087477b37cdd7b7f05fda30169171d42cb52839e151cd45905df4bfcea82f58a6b048531c7446fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
518c565775a7f081e64815c19d93bde2

SHA1
28954f723d3680d404d5bb977356a0551f1c947b

SHA256
86accf91729f4b6eda9c0ce7c0b2d8defa66c6d65a3d0aaccfdda120c3217238

SHA512
e61e59eab288b407792ade06d1f23e76fc6aa6fc697c75572bd25ca1899c4985cf499d83c05b2ffeb9ec2ea0f42c51044225c2c968ea5027852931879f6159a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
8ebe528082e5469f3827a537b55242ca

SHA1
8706155b464eb289a812937b04f6e7fbc9150823

SHA256
8a5b7e3b1492ee13de98d2411ae9c4a69d287b5bd15a2d339c54243d675ed07a

SHA512
bbc6e6298443aae3a7aa4a6971b822e35b1160ccfc3437639dcaa295566ac0ee02d5084ba47341df6649f58ea133527c6c4515a4cf5d05f0f01645f80e76e07d

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
564B

MD5
241bfb8962f8b8188d1dbb46ca5b3522

SHA1
8ce7f9a9ece7603a2977a6257361e1306a90f49c

SHA256
3364a5bf4848cefdd4570ff97569c60d6df2192317a2466d92cdd6a373a9c085

SHA512
964b58487bd1c24c0ddbf72d569f0ac18c8c66231afacc6233529abf9e72c0f8746a7cc5ad4eb61913536db76b087b2cb012f3c315601819656e696aa40de7b3

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.rm2208

Filesize
564B

MD5
eac637e88319d7f16249841ff3a0a378

SHA1
99c77e2a6bd4af4e2cc6a861d6560b72836a9c3e

SHA256
549a5c9b571eba0d0e147a52cd8051394168c014efa914e69fb361fbb0f11619

SHA512
7d309e97bf3e59361ad91792140c1628a9a73a6b128b9905063c36bb6b375b866eda349c5c451a221e4f9bf248b58e1bc90e4c24af77f5b2e2bb5f8be7309b59

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
memory/1764-821-0x0000021CBDAF0000-0x0000021CBDAF1000-memory.dmp

Filesize
4KB

Download
memory/1764-820-0x0000021CBDB00000-0x0000021CBDB01000-memory.dmp

Filesize
4KB

Download
memory/1764-841-0x0000021CBDC30000-0x0000021CBDC31000-memory.dmp

Filesize
4KB

Download
memory/1764-829-0x0000021CB51F0000-0x0000021CB51F1000-memory.dmp

Filesize
4KB

Download
memory/1764-843-0x0000021CBDC40000-0x0000021CBDC41000-memory.dmp

Filesize
4KB

Download
memory/1764-845-0x0000021CBDD50000-0x0000021CBDD51000-memory.dmp

Filesize
4KB

Download
memory/1764-844-0x0000021CBDC40000-0x0000021CBDC41000-memory.dmp

Filesize
4KB

Download
memory/1764-810-0x0000021CBDED0000-0x0000021CBDED1000-memory.dmp

Filesize
4KB

Download
memory/1764-809-0x0000021CBDEB0000-0x0000021CBDEB1000-memory.dmp

Filesize
4KB

Download
memory/1764-823-0x0000021CBDB00000-0x0000021CBDB01000-memory.dmp

Filesize
4KB

Download
memory/1764-811-0x0000021CBDED0000-0x0000021CBDED1000-memory.dmp

Filesize
4KB

Download
memory/1764-818-0x0000021CBDED0000-0x0000021CBDED1000-memory.dmp

Filesize
4KB

Download
memory/1764-812-0x0000021CBDED0000-0x0000021CBDED1000-memory.dmp

Filesize
4KB

Download
memory/1764-813-0x0000021CBDED0000-0x0000021CBDED1000-memory.dmp

Filesize
4KB

Download
memory/1764-814-0x0000021CBDED0000-0x0000021CBDED1000-memory.dmp

Filesize
4KB

Download
memory/1764-826-0x0000021CBDAF0000-0x0000021CBDAF1000-memory.dmp

Filesize
4KB

Download
memory/1764-815-0x0000021CBDED0000-0x0000021CBDED1000-memory.dmp

Filesize
4KB

Download
memory/1764-793-0x0000021CB5940000-0x0000021CB5950000-memory.dmp

Filesize
64KB

Download
memory/1764-777-0x0000021CB5840000-0x0000021CB5850000-memory.dmp

Filesize
64KB

Download
memory/1764-816-0x0000021CBDED0000-0x0000021CBDED1000-memory.dmp

Filesize
4KB

Download
memory/1764-819-0x0000021CBDED0000-0x0000021CBDED1000-memory.dmp

Filesize
4KB

Download
memory/1764-817-0x0000021CBDED0000-0x0000021CBDED1000-memory.dmp

Filesize
4KB

Download
memory/2208-891-0x00007FFCDADF0000-0x00007FFCDAEFE000-memory.dmp

Filesize
1.1MB

Download
memory/2208-892-0x0000020A5E520000-0x0000020A5F5D0000-memory.dmp

Filesize
16.7MB

Download
memory/2208-890-0x00007FFCDB3C0000-0x00007FFCDB676000-memory.dmp

Filesize
2.7MB

Download
memory/2208-889-0x00007FFCEEB60000-0x00007FFCEEB94000-memory.dmp

Filesize
208KB

Download
memory/2208-888-0x00007FF71C260000-0x00007FF71C358000-memory.dmp

Filesize
992KB

Download
memory/2400-490-0x00007FF71C260000-0x00007FF71C358000-memory.dmp

Filesize
992KB

Download
memory/2400-491-0x00007FFCF65A0000-0x00007FFCF65D4000-memory.dmp

Filesize
208KB

Download
memory/2400-492-0x00007FFCDCDC0000-0x00007FFCDD076000-memory.dmp

Filesize
2.7MB

Download
memory/2400-493-0x00007FFCDB5B0000-0x00007FFCDC660000-memory.dmp

Filesize
16.7MB

Download