vipkeylogger | fe82ebf70e17a486c040741c41f882d46bf2328986276bc4fcae991a2c126a18

Resubmissions

25/02/2025, 14:57

250225-sbpqga1pv6 10

25/02/2025, 14:53

250225-r9dkes1mz9 10

Analysis

max time kernel
191s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2025, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AWB#5305323204643.exe
Size

1.8MB
MD5

f4aafd3c1d6cd42208b22a1247c9173d
SHA1

1fe9b387b96e6a6b2dc0736bea67a3a93b0357b6
SHA256

fe82ebf70e17a486c040741c41f882d46bf2328986276bc4fcae991a2c126a18
SHA512

746572fdd1dfed6465ffc065f1f3d5ade6d1f995af3fa16604872473023d657c587e26cde9fffbd5b000e0a7b0d7714a1e93bf3a86e79e2fcd1c586b3ec8df2a
SSDEEP

49152:+19q39adgJW0w0s/2gzOkB8IaEAehfeeAi4jw0+EckLh0Y5Y:+19aJm/dOS8IXAehfSdwPVkLiL

Score

10^/10

vipkeylogger collection discovery keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

https://api.telegram.org/bot7552206830:AAGZUrvJgSRgT_tfVCG5NR-NdC35UuRR1yg/sendMessage?chat_id=6357516296

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 4476 created 3480	4476	AWB#5305323204643.exe	55
PID 4884 created 3480	4884	Unrestricted.exe	55
PID 6044 created 3480	6044	Unrestricted.exe	55
PID 2240 created 3480	2240	Unrestricted.exe	55
PID 4916 created 3480	4916	AWB#5305323204643.exe	55
PID 5560 created 3480	5560	AWB#5305323204643.exe	55
PID 3328 created 3480	3328	AWB#5305323204643.exe	55

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Unrestricted.vbs	AWB#5305323204643.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\unrestricted.vbs	taskmgr.exe

Executes dropped EXE 3 IoCs

pid	Process
4884	Unrestricted.exe
6044	Unrestricted.exe
2240	Unrestricted.exe

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	reallyfreegeoip.org
138	reallyfreegeoip.org
139	reallyfreegeoip.org
141	reallyfreegeoip.org
144	reallyfreegeoip.org
145	reallyfreegeoip.org
31	checkip.dyndns.org
35	reallyfreegeoip.org

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 4476 set thread context of 3560	4476	AWB#5305323204643.exe	89
PID 4884 set thread context of 6096	4884	Unrestricted.exe	157
PID 6044 set thread context of 5960	6044	Unrestricted.exe	159
PID 2240 set thread context of 3120	2240	Unrestricted.exe	160
PID 4916 set thread context of 5068	4916	AWB#5305323204643.exe	162
PID 5560 set thread context of 1096	5560	AWB#5305323204643.exe	164
PID 3328 set thread context of 4596	3328	AWB#5305323204643.exe	166

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AWB#5305323204643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unrestricted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unrestricted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AWB#5305323204643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unrestricted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AWB#5305323204643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AWB#5305323204643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4476	AWB#5305323204643.exe
4476	AWB#5305323204643.exe
4476	AWB#5305323204643.exe
3560	InstallUtil.exe
3560	InstallUtil.exe
1676	msedge.exe
1676	msedge.exe
2348	msedge.exe
2348	msedge.exe
2032	msedge.exe
2032	msedge.exe
3156	msedge.exe
3156	msedge.exe
1556	identity_helper.exe
1556	identity_helper.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
4884	Unrestricted.exe
4884	Unrestricted.exe
4884	Unrestricted.exe
4884	Unrestricted.exe
1456	taskmgr.exe
6096	InstallUtil.exe
6096	InstallUtil.exe
1456	taskmgr.exe
1456	taskmgr.exe
6044	Unrestricted.exe
6044	Unrestricted.exe
6044	Unrestricted.exe
6044	Unrestricted.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
5960	InstallUtil.exe
5960	InstallUtil.exe
2240	Unrestricted.exe
2240	Unrestricted.exe
2240	Unrestricted.exe
1456	taskmgr.exe
3120	InstallUtil.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	AWB#5305323204643.exe
Token: SeDebugPrivilege	4476	AWB#5305323204643.exe
Token: SeDebugPrivilege	3560	InstallUtil.exe
Token: SeDebugPrivilege	1456	taskmgr.exe
Token: SeSystemProfilePrivilege	1456	taskmgr.exe
Token: SeCreateGlobalPrivilege	1456	taskmgr.exe
Token: SeDebugPrivilege	4884	Unrestricted.exe
Token: SeDebugPrivilege	6044	Unrestricted.exe
Token: SeDebugPrivilege	4884	Unrestricted.exe
Token: SeDebugPrivilege	6096	InstallUtil.exe
Token: SeDebugPrivilege	2240	Unrestricted.exe
Token: SeDebugPrivilege	6044	Unrestricted.exe
Token: SeDebugPrivilege	5960	InstallUtil.exe
Token: SeDebugPrivilege	2240	Unrestricted.exe
Token: SeDebugPrivilege	3120	InstallUtil.exe
Token: SeDebugPrivilege	4916	AWB#5305323204643.exe
Token: SeDebugPrivilege	4916	AWB#5305323204643.exe
Token: SeDebugPrivilege	5068	InstallUtil.exe
Token: SeDebugPrivilege	5560	AWB#5305323204643.exe
Token: SeDebugPrivilege	5560	AWB#5305323204643.exe
Token: SeDebugPrivilege	1096	InstallUtil.exe
Token: SeDebugPrivilege	3328	AWB#5305323204643.exe
Token: SeDebugPrivilege	3328	AWB#5305323204643.exe
Token: SeDebugPrivilege	4596	InstallUtil.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe
1456	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3560	4476	AWB#5305323204643.exe	89
PID 4476 wrote to memory of 3560	4476	AWB#5305323204643.exe	89
PID 4476 wrote to memory of 3560	4476	AWB#5305323204643.exe	89
PID 4476 wrote to memory of 3560	4476	AWB#5305323204643.exe	89
PID 4476 wrote to memory of 3560	4476	AWB#5305323204643.exe	89
PID 4476 wrote to memory of 3560	4476	AWB#5305323204643.exe	89
PID 4476 wrote to memory of 3560	4476	AWB#5305323204643.exe	89
PID 4476 wrote to memory of 3560	4476	AWB#5305323204643.exe	89
PID 2348 wrote to memory of 5072	2348	msedge.exe	101
PID 2348 wrote to memory of 5072	2348	msedge.exe	101
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 3064	2348	msedge.exe	102
PID 2348 wrote to memory of 1676	2348	msedge.exe	103
PID 2348 wrote to memory of 1676	2348	msedge.exe	103
PID 2348 wrote to memory of 5084	2348	msedge.exe	104
PID 2348 wrote to memory of 5084	2348	msedge.exe	104
PID 2348 wrote to memory of 5084	2348	msedge.exe	104
PID 2348 wrote to memory of 5084	2348	msedge.exe	104
PID 2348 wrote to memory of 5084	2348	msedge.exe	104
PID 2348 wrote to memory of 5084	2348	msedge.exe	104
PID 2348 wrote to memory of 5084	2348	msedge.exe	104
PID 2348 wrote to memory of 5084	2348	msedge.exe	104
PID 2348 wrote to memory of 5084	2348	msedge.exe	104
PID 2348 wrote to memory of 5084	2348	msedge.exe	104
PID 2348 wrote to memory of 5084	2348	msedge.exe	104
PID 2348 wrote to memory of 5084	2348	msedge.exe	104

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3480
- C:\Users\Admin\AppData\Local\Temp\AWB#5305323204643.exe
  "C:\Users\Admin\AppData\Local\Temp\AWB#5305323204643.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops startup file
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://5temp5/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9ae4746f8,0x7ff9ae474708,0x7ff9ae474718
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17877414354219925382,5374367885061888975,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17877414354219925382,5374367885061888975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,17877414354219925382,5374367885061888975,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17877414354219925382,5374367885061888975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17877414354219925382,5374367885061888975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17877414354219925382,5374367885061888975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ae4746f8,0x7ff9ae474708,0x7ff9ae474718
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3096 /prefetch:8
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3824 /prefetch:8
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3824 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,697440148259552139,17669424015303591920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:2424
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Drops startup file
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1456
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Unrestricted.vbs"
  2⤵
  - Checks computer location settings
  PID:2948
- - C:\Users\Admin\AppData\Roaming\Unrestricted.exe
    "C:\Users\Admin\AppData\Roaming\Unrestricted.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Unrestricted.vbs"
  2⤵
  - Checks computer location settings
  PID:4040
- - C:\Users\Admin\AppData\Roaming\Unrestricted.exe
    "C:\Users\Admin\AppData\Roaming\Unrestricted.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Unrestricted.vbs"
  2⤵
  - Checks computer location settings
  PID:6080
- - C:\Users\Admin\AppData\Roaming\Unrestricted.exe
    "C:\Users\Admin\AppData\Roaming\Unrestricted.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\AWB#5305323204643.exe
  "C:\Users\Admin\AppData\Local\Temp\AWB#5305323204643.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:5068
- C:\Users\Admin\AppData\Local\Temp\AWB#5305323204643.exe
  "C:\Users\Admin\AppData\Local\Temp\AWB#5305323204643.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Users\Admin\AppData\Local\Temp\AWB#5305323204643.exe
  "C:\Users\Admin\AppData\Local\Temp\AWB#5305323204643.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c6e13dc1762aa873320bed152204f3c

SHA1
38df427d38ca5ce6ce203490a9fb8461c7444e12

SHA256
5c441148843b7c8dbff4c4a72962a532aaf0bdd484d07a03dd9a32fd461b1371

SHA512
133054cb042e11013bfdad1bd11e3407d08cf26a66d0743bea9708d261aa904a1047bb0097b187ecf8436cb6cff3bec28c89e435862cad0e0fa264799556b70c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5da507c2059b715761792e7106405f0

SHA1
a277fd608467c5a666cf4a4a3e16823b93c6777f

SHA256
8c1d99de087ac5f2e7b2afce66eff36a646bef46800c0c1d7737d6f0df74b7e8

SHA512
01c92729dd8061aa122b116a674c73bb78016f66d2cb8f7fb64907352758a825e87a1e345334386440699d2a6d1e17baccb400c5aee151eb64e64019cbebb870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f37d2335c33a1ab36fe0d33a9da7e73

SHA1
9d7e9dc7db6c508418fa98d073fb1b4ab594eaeb

SHA256
bc0a1b16a51249eabdd4a82952bdc9220ba861b83ccfa9119c14834cc24ca580

SHA512
5cfa7645688821b7f7581c7ee5bca2a2a257536b135faf6d68a696287eca6e689e0511c7f5c176f1ec1c99b43e9c5175c79329f27d592824d036b5e8bf66b88b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f203d2ba3090fcb5eb19057f50c544d

SHA1
e9c4eab99cf78a80e1b7d7a68a667ec0a072c731

SHA256
59641258c0d4af7d8cdc2bda378902f4d9d7ee38d45e0c6e5bdb34a3f5d65b3f

SHA512
7e0b2ea9e50191f7f84522f7a5960d54a2d88967ba21bce45238d1066b6697a45bfed7f10fc1fb0707478dc00e49681f71e95e2c7c0c06d1575a02e5b05c920b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
82ae79c45fb3b65170644ddbdaa01219

SHA1
b0ca1c946463492758d00813d5e29a3ebdea8f4a

SHA256
c4565530165d9c03bf1adb9e84a95834a88c0af56d741b9b770f96027b466756

SHA512
dc434606f8d89a07c4718554a881bf2bd5f0f8bd92a496d0952c0a79e78a168f5b7476fdc76f1d7cee081859e0abb4239bfa1343c21146b431fd7186995bdd19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
e037765b8dd65ed8792d39c740ce5488

SHA1
06e6a8f5f37b0dd9051b2da1cc9c4f859f6448ff

SHA256
3c52d99d258623b4b3be6f907c8513d08e6ae287686f8f81b0273e263d9182db

SHA512
4946c7ccff6727c8a9a439487b4bd9d13dcc3dea5cda53c17f73f95138a666034d925f7c9d262375534ece3a2dbebb501c5f3a0b14b3ffa39833426b711654db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
73c52c814a005a48e77c6b95037bf608

SHA1
678bb8f0b67d4cfd3eb394f2aeb449269e02941b

SHA256
a1cecf47e5894ee9eb6b90503b2502706cc9f7c2b5e0d60ad11938839c0a090f

SHA512
681f08bf143cf15cc7c3ce6ab8f2e336bbfacc14ffe3a194c7ebdfca0dcc06c4ccc349497a95274f860f0673fd9e00f7d131edb5612c05d35ae38dffb96ec37d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2887c6bc7485086f2084f58c09fd651d

SHA1
61fcfa7db54a80e3d7f1502ed37e00a2993a322e

SHA256
2f3cf1c60cb77e7ff3a93b4ab5e37dbab594e82446ae8245b63f43ca060697f8

SHA512
202e676a892ce6a9346ea8adea1786651408cd0ab95dc5a5f702cb3ad87a86f34afa55e0ccf2c41c071fe04a23f9f6adcd068d0eb3d71d4d96daaebbb0fe5d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
5fb4d07615f5b3e213f9ed4a12cfa60c

SHA1
0215e52adcffe2427d8e1975c03700c4756860c7

SHA256
c7eba099c4b4e13b71681a648ccfa3f0dcd452ae75e325125b655a24c0ea2f64

SHA512
e6f24d70ddb17105da06711ea1b519d89e4b4c4c76e5322b73621ad5001e496eb1947d465fb1a3c567bf4441870fd0a9944c744b5aa39f66b231ba71dc582718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
6B

MD5
a9851aa4c3c8af2d1bd8834201b2ba51

SHA1
fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

SHA256
e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

SHA512
41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
617d11d3cfb6216b6c5d7d4f478a08c2

SHA1
7b9ae9fa4470e05cfcebfc6a67a5c044f1847539

SHA256
5317fe26001a63fd90288f8859732788ab82c87e84f63295fb15e0368eedf108

SHA512
ee2cc15bcd455fd23f08151f61340118024fd873dd04a966aa727b6ea3c18d04434c520a0dae0acabcbf5d18cc39dc8b0240503492901b0d2b86c908f5039255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
906B

MD5
9659b8357252e3b675a65619e025fd27

SHA1
c49addb7e2430121e25edf4f3d605da60c14f6af

SHA256
744b8903d3e3c131bbf02dbb6c56e59bc8bd44a66d42146945f24bb686f17018

SHA512
ae6edaeea945e1c45334dd82cb76727f94a9020064df0ae43cae3cfcbc19a6c2406aa20d5785d6b014697c99c6e7b28e3b5dc7ddec137d98215d2adb341757ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44bc8e587ca01f7c9f14f76273b60dbc

SHA1
d262cfd5e3154869b27647409032d98629756897

SHA256
1fdbd6209ef6863a3eca2f1628c19b477579fa0b82de6c25706a0951d854ca16

SHA512
e0711b8a888b25c97f51b747469fa2c04a712ed348ee3751cbffa2ebcb9c02e3133e06526a7fd074fcd49cdb19c2c7c6d19791b0469dcf890ee4ac46f5cd0a98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9b1eda0613ab44442ea834dc13f72066

SHA1
d65e5c624f2b31e89c46ba31411675ec337d8953

SHA256
f3b349d0f041a9d8dda543424f66ae8d5054fdc2008771a02f727267b8e9e46e

SHA512
addf07832dca030bf040dab9cb83b067fb51b0d0c5a6208849391f1f288f1448aa6d8a91c250c6a0f2e70ef75b07461e19b6eb58b8c6c2f51cf51e8bdb182545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
69bdd727947cadd817158d6cfa619e9a

SHA1
8a424a5c60ddf60bbb78291a2087a1a3be871197

SHA256
5716fafb3f3cf6e1b1012ada2f6027e3e1b60d1964f3306bbd295b7a09cb547e

SHA512
59bdeef371de95501c218b7b069a8ed56d9e14308dd1ac30e1d6032a201d0f02a48bef5b5a9090c5aed449a7a63b954cd31dc57b06e61d76d7403b12a1768744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65802d9aba5556671a932717ff39bb17

SHA1
e194d1da6ca446f59ef34fa67740ba7a1672319f

SHA256
f7f091cd0fb434d29619ed66ff667d4dbcffdafc34e5fa3cfe159334ac48a53c

SHA512
f13e56b21fdcd59765da223420b941544738a46146d3c0c2a2594defde19eebacc8d790c4ec2e43156b5e313046ae6b2ca0b3e5a4b4aa9b1bd6032d1ba71d35d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5352fc15bcbf36cdc873c354a30fa443

SHA1
830131d6472767a8541b3f0323a6ec1310a05bbe

SHA256
9198a331288a12a9c65c69dea14c428f93f448a148938ee92262c1be56e1eb51

SHA512
bad8d4b77a3eb16a732f3bf89bff755f653c544ebfa49dcfec231e455a9538a1d1be369ac1826a8c4cef5fb8e4e05068dc37d65443b6d0db91f650b67b5fee1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
137B

MD5
a62d3a19ae8455b16223d3ead5300936

SHA1
c0c3083c7f5f7a6b41f440244a8226f96b300343

SHA256
c72428d5b415719c73b6a102e60aaa6ad94bdc9273ca9950e637a91b3106514e

SHA512
f3fc16fc45c8559c34ceba61739edd3facbbf25d114fecc57f61ec31072b233245fabae042cf6276e61c76e938e0826a0a17ae95710cfb21c2da13e18edbf99f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
7c65dfaf403995c98e822a2321699993

SHA1
cb3d4336a3cad1915cd47a316f1ddd41bfcd65f8

SHA256
2a338d98e7cffc74ba059aa6fd82d1bb814a8feedab1932d070bf84381fd81ce

SHA512
c19d36e4b282748a1062ff969a3a75956da97d600d30802c9923b6f37bc2e15d7d5b5c63dfb3de5c54f7d7668a077c4390bfc0c332300a3b65ba2bc5ee1425a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13384969069002568

Filesize
1KB

MD5
5a6351dacfe17703f67c3030fd4b99ea

SHA1
fff66d26dd028f4b272aacc2cef36c863a0b5447

SHA256
6ef21086f59ddbed8961176ead6988df665b7fc19102fb2c856ad87dae15e8f1

SHA512
aeca994480cb97e834946a2343f784cba64b6e5ec1bd8b1149d166ce9ccb335fb4fba199503c9acfa54d788212242c47aa003b1356496e9b0d63e8e80e6f7408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13384969069207568

Filesize
1KB

MD5
288577d13543bd0d9219840f90cc187c

SHA1
9cd0b19202945ee5a75a4c0c2f38b3c82635b262

SHA256
5192ab4b2dc14cca9da4fb3016450e1d0f07821f6a8dadd70963aa90c94e7549

SHA512
75eaef63d216b99877990a873e4a835bc230bba03109420bb9a20b39f422c12034dbc956316cae49abafbb3d40bf784fc9cb92f9071b66996f5d49dfedeff028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
c75eeb177d2270067b23ff41b14fc70d

SHA1
680d052ca6af3badf9f1105fa0c683de3f0f1c70

SHA256
d2a7b76b9b1ed7be5c81befb2cb2a92614ada5bedfc46f8600adadda887e6210

SHA512
8140b0adf29b462bea77ba4c055b51a4d41baad80c6eb18ea1470a4aa628f25ae71bc80e0790bfdda7052b457ba054d5913b356a5b895b292060c998399b2242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
02f3719e6c6cba67791b992f793a4cdf

SHA1
e0eb038f4ef3da98b47fc09a99097ab08a47d0fd

SHA256
16ada1cc9daf3da071fb0dfac1bf65524d4e615b9141274c5067236a9b452774

SHA512
8500606ffa1c89f88b2f96b751730ffcb648706e5e31808a6e8958d29fe4727b7ec83b5ab48ce5c103ea33ca75c3fabf175fe5532241ea30abfba024df973ca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
e27f8fd0e1cca1d93f1b5078dd187e0f

SHA1
02a427424baaec1f2639614476fdb34008c84c3e

SHA256
0d92863f428e408a6812b4077a91d1cbe8d7595d3fab40a8d1053147f38c6ebd

SHA512
13cf01fe830f53d8e92ce674a790456661fbc7934984fca8cb82c7dda10357053118616e829a2c5fc501d7fcf48e253c9d7ec44c76ba9d819e587a94dd60ac42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
cc458b4cd556069350d99ca45b8fd199

SHA1
3438fdf84ad249452180524bc8a3de33ada1278a

SHA256
a53ffd387c1bf283bb55d3b42fa2ba720292fdf5d34a5cfd374768ec279d918b

SHA512
f59200d16ec72a181e69b01e27188b895b6d356415ef30f8f66ab4600a8d11de1e0044d271b7e2f56e0c96ea758413483beb7ac97e82f3688a3987f89870db45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
194B

MD5
a48763b50473dbd0a0922258703d673e

SHA1
5a3572629bcdf5586d79823b6ddbf3d9736aa251

SHA256
9bb14ea03c24f4c3543b22a8b4e9d306b926d4950cfcc410808ecac2407409fd

SHA512
536406435e35f8204ce6d3b64850ffb656813aacbc5172af895c16c4f183005d69999c4f48f948875d9837890f290b51a7358ff974fb1efc6ba3d1592426cca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
6150ec345d7cf216a6d95e906b97a185

SHA1
ca6dbc1b8c7d7ca953058aca2337ece8b62bf2b2

SHA256
d5ffc6208ae4446c6ca05a8ffbd0e0ddaf5e872db8866677701f83f17b06de03

SHA512
a35dbc26d01bfba597fb2756b3c269f2f682abb4a1e6d43c1f116b9233a79d96239bd48ac4f589ce48f9c144aeaed0f9035d2d5106baaecfa18f076c888a16ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
15490c57aaf99501596fa7385a78d8d1

SHA1
1bd3381a2c780e438ceef0728b09729a60336f90

SHA256
54da506bb0d602af0c9ca8a6b4ac81fa17d3b91b98fd4e25280a772778869572

SHA512
dca5bccd6828aa6a83b6fdf01dbd7ca296e79b171051c0506165685ad8284c6271f71fd30a135696273f8797c75dd1b75255812abbdd3941046e9ce3c6cbdb2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
19ff60aa3307ec76102542d781e93a4e

SHA1
28fc3071bd46c6327ee0bd0432aebaac057a692e

SHA256
4f3d5091860dc63a3e76e59a6e42f363a77370de4c8a06290fe96cadab54f186

SHA512
68868a294e422b4e7a886d1f022f0debe5bdf728293426c09dc7a57f796d6fed3161397564d4c910e202b3b76decdf1e56c0eff414a69f4d36b3644d91bb9873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
b14a74bf1165ba949ef44289e9f3b80f

SHA1
b04c4dac48277b5ea294f31e5830c20e253a2c8d

SHA256
b011ed481250718a99820b20c083efa01a816e08bf9b7cad849994a66ec33999

SHA512
5df6499e5ca0b925890b917185b88dfda50f28246fcb9058760f20225561248a20934cea3b67dfd9f2c45449412947a41751f1bd5eff6dbf8849d47c2ece4feb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8aed7e2ef372374408cdbbabe4c1c0ef

SHA1
a0016bee0b35318982878fffc71026a53f145956

SHA256
944a313f1be150282b158176b6025bd3c5e9ad6a7b6cc445cc7b6a1ea54d40e3

SHA512
ec5ba84bb776005390c51f2bb6a8936312078a0800f544c80d1841311393afd60c692271eddb98b908d15146bda39bcba9f670342c737645af13e82060fb6a97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
70780a58b2b5c0f5f7f63e6690797132

SHA1
71aa229bd9e480bc8cef6bc27996a2449ce73b22

SHA256
4d01ba0711b3d47a13a52059365afec7b1211c14d11ba9d9ae42b51927c93687

SHA512
8f3194f884067d87bbc5b633ec9ffaa8177411075c7caffbdbeeab0185f08a36880ebbe9f5a8426bea8a9fabb4807ce6f3eec3d693cdcc84acec99350a1e4912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d9a4c172-ce9f-414e-93fc-0d0b050dc13e.tmp

Filesize
10KB

MD5
832adc32e6784395bbe2f4ffbed543ed

SHA1
58ad1de06f3fdd5ebb8b466f2262b1db2cfec689

SHA256
9d06f198bf1dd9963739bbf8abc7e6e409a2edfa2e739a9d58f8bac69823828b

SHA512
a8ed1d46a2a5db67bff4bb3a8ca141cd7684f06dca451c50d8016b74bf028183da896abce2e5ea0f9331e3ea6cd53a5735ab622aa98fc7921ef4e412e2119fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
4bc52bd19776147d5f22e62338342f97

SHA1
8659be7737b0420a6eb7cd343c138d68ab448002

SHA256
8d436080ffd8cacb719c6a664522b35d4f557b2b344698260cfefa8fc90a63f9

SHA512
08a5783fa2fbcb084997b51aae1ba6ed7f09f9c9026af6b598a555b99ec52c656f29038d6b396a6f5d88f969ea74d9aabeb8f628c4b36cc40f5ff85161bcb886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
e8c006b1123945061e7b7a70ddf97b34

SHA1
eb2af7834c2a1f61a3afd43c00d56018b1197cf5

SHA256
682bcbdab782777c2977878f9c61a39a8410d6a4779eac6cb966ddaaa5bfda33

SHA512
11374d0b41ef183fdbb053edf96cf5341cca25f913f66af93206f42b45b3d955f2d1279644dd94e4a89ee22a20d0c2cc549cfcdcb02b8a407725a3be897df20c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Unrestricted.vbs

Filesize
87B

MD5
477547309908425c8d527e4c021fb512

SHA1
21a84e227da6a3ab30c828607ca996813d10ec8e

SHA256
7de556d4d0551fe84058633f3be309d3b7e923590c7e69777e44c9c02dd4bc39

SHA512
2704d4344de550ba8b4636593c6ecf5af6516710476fb0820392942de79657390c01a8f76b597e59e0626a2c8f009983ee390e896a1557949b62a7d499b880c7

Download Submit
C:\Users\Admin\AppData\Roaming\Unrestricted.exe

Filesize
1.8MB

MD5
f4aafd3c1d6cd42208b22a1247c9173d

SHA1
1fe9b387b96e6a6b2dc0736bea67a3a93b0357b6

SHA256
fe82ebf70e17a486c040741c41f882d46bf2328986276bc4fcae991a2c126a18

SHA512
746572fdd1dfed6465ffc065f1f3d5ade6d1f995af3fa16604872473023d657c587e26cde9fffbd5b000e0a7b0d7714a1e93bf3a86e79e2fcd1c586b3ec8df2a

Download Submit
memory/3560-1344-0x0000000005480000-0x000000000551C000-memory.dmp

Filesize
624KB

Download
memory/3560-1373-0x0000000006B50000-0x0000000006BE2000-memory.dmp

Filesize
584KB

Download
memory/3560-1342-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/3560-1343-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3560-1374-0x00000000068E0000-0x00000000068EA000-memory.dmp

Filesize
40KB

Download
memory/3560-1345-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/3560-1346-0x0000000006980000-0x0000000006B42000-memory.dmp

Filesize
1.8MB

Download
memory/3560-1347-0x0000000006800000-0x0000000006850000-memory.dmp

Filesize
320KB

Download
memory/3560-1348-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/4476-42-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-30-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-1331-0x0000000005070000-0x00000000050C4000-memory.dmp

Filesize
336KB

Download
memory/4476-1330-0x0000000005740000-0x0000000005CE4000-memory.dmp

Filesize
5.6MB

Download
memory/4476-1340-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/4476-0-0x0000000074B5E000-0x0000000074B5F000-memory.dmp

Filesize
4KB

Download
memory/4476-1329-0x0000000004F50000-0x0000000004F9C000-memory.dmp

Filesize
304KB

Download
memory/4476-1328-0x0000000004ED0000-0x0000000004F32000-memory.dmp

Filesize
392KB

Download
memory/4476-1327-0x0000000004D00000-0x0000000004D66000-memory.dmp

Filesize
408KB

Download
memory/4476-1326-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/4476-1325-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/4476-14-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-4-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-8-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-10-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-13-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-18-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-16-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-1341-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/4476-20-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-22-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-26-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-28-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-1337-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/4476-34-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-36-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-38-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-40-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-44-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-50-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-52-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-54-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-56-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-58-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-60-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-62-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-64-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-66-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-46-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-48-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-32-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-24-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-6-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-3-0x0000000004B30000-0x0000000004C35000-memory.dmp

Filesize
1.0MB

Download
memory/4476-2-0x0000000004B30000-0x0000000004C3C000-memory.dmp

Filesize
1.0MB

Download
memory/4476-1-0x0000000000040000-0x0000000000218000-memory.dmp

Filesize
1.8MB

Download