hxxps://github[.]com/ek4o/fake-exodus/releases/tag/ekoTools

Resubmissions

03/03/2025, 16:00

250303-tf222asjz2 5

03/03/2025, 15:28

250303-swbpca1nz4 10

02/03/2025, 14:26

250302-rr1x1awygx 10

Analysis

max time kernel
1789s
max time network
1733s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2025, 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ek4o/fake-exodus/releases/tag/ekoTools

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
808	vlc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 56 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "10"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\SniffedFolderType = "Pictures"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 200000001a00eebbfe23000010005d01dd0d6cb0d5458c4cf5971385463900000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "11"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000000000001000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000009bdadcdb4c81db0103dd54d45581db01936e3193578cdb0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
808	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
1484	msedge.exe
1484	msedge.exe
2608	identity_helper.exe
2608	identity_helper.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
3756	taskmgr.exe
808	vlc.exe
5044	OpenWith.exe
996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	taskmgr.exe
Token: SeSystemProfilePrivilege	3756	taskmgr.exe
Token: SeCreateGlobalPrivilege	3756	taskmgr.exe
Token: SeSecurityPrivilege	3756	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3756	taskmgr.exe
Token: SeSecurityPrivilege	3756	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3756	taskmgr.exe
Token: SeSecurityPrivilege	3756	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3756	taskmgr.exe
Token: SeSecurityPrivilege	3756	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3756	taskmgr.exe
Token: SeSecurityPrivilege	3756	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3756	taskmgr.exe
Token: SeSecurityPrivilege	3756	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3756	taskmgr.exe
Token: SeSecurityPrivilege	3756	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3756	taskmgr.exe
Token: 33	3756	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3756	taskmgr.exe
Token: SeTcbPrivilege	2436	svchost.exe
Token: SeRestorePrivilege	2436	svchost.exe
Token: SeBackupPrivilege	4888	svchost.exe
Token: SeRestorePrivilege	4888	svchost.exe
Token: SeSecurityPrivilege	4888	svchost.exe
Token: SeTakeOwnershipPrivilege	4888	svchost.exe
Token: 35	4888	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe
3756	taskmgr.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
808	vlc.exe
4660	mspaint.exe
5044	OpenWith.exe
1824	mspaint.exe
3180	OpenWith.exe
4164	mspaint.exe
5092	OpenWith.exe
2108	mspaint.exe
2108	mspaint.exe
2108	mspaint.exe
2108	mspaint.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3712	1484	msedge.exe	86
PID 1484 wrote to memory of 3712	1484	msedge.exe	86
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 4772	1484	msedge.exe	87
PID 1484 wrote to memory of 3920	1484	msedge.exe	88
PID 1484 wrote to memory of 3920	1484	msedge.exe	88
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89
PID 1484 wrote to memory of 3280	1484	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/ek4o/fake-exodus/releases/tag/ekoTools
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd51246f8,0x7fffd5124708,0x7fffd5124718
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,7609889789809984786,5811294567571466488,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3684

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PingDeny.3gpp"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:808

C:\Windows\sysmon.exe
"C:\Windows\sysmon.exe"
1⤵
PID:3776

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\My Wallpaper.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:2384

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5044

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\My Wallpaper.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436
- C:\Windows\system32\dashost.exe
  dashost.exe {9af1bb40-8dc0-4c4c-8b0b40dddf933e3f}
  2⤵
  PID:1500

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\My Wallpaper.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5092

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd51246f8,0x7fffd5124708,0x7fffd5124718
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 /prefetch:3
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,7236046258641573080,6292939890090839277,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5088 /prefetch:2
  2⤵
  PID:2404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6738f4e2490ee5070d850bf03bf3efa5

SHA1
fbc49d2dd145369e8861532e6ebf0bd56a0fe67c

SHA256
ca80bbae3c392e46d730a53d0ee4cfecbbe45c264ad3b3c7ee287252c21eaeab

SHA512
2939edf5e6c34c9ea669a129a4a5a410fbbd29cd504dc8e007e9b3b3c7fbb9bea8c14d6177ac375d0c481995774a02d210328569231cb01db07b59452333b22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f26c6527981fa81a83e126aa48a3474b

SHA1
b1e454bd2eff22e1855e6f210a239c86d4b780a0

SHA256
8d3b6a85a89b3a3d84ea7032bece4d826f7646acb5e41a335b337ec3b650298a

SHA512
ba15a05a1c8c2219bdc00a212dba0e9fb8fd95946af2401d372cd7072ea78594b4036ceb947be6f455a0bf9ffbe14fc35bf49915ebe4baa6a3da42d34b740871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1af5f8bff816f07133802323434ce71b

SHA1
f4996fcce06b6360fdde8ad6fcebdbd78ec11ddd

SHA256
6a18d1399647df7b8e91fa653c4701766f9e1a453c45ae829e4b1e6904e8b24a

SHA512
82eccc964f68d44162e03186471387056670ed11af57c929bef1064f5890b6a8f3234fffdacc820d330f5a333fbe62356dc9d729004947838084681c2e7b65d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
93be3a1bf9c257eaf83babf49b0b5e01

SHA1
d55c01e95c2e6a87a5ece8cc1d466cc98a520e2a

SHA256
8786fd66f4602e6ed3fa5248bd597b3f362ffa458f85207eaa154beb55522348

SHA512
885b09dd3072921f375eedb5f0575561adc89700ecfbe999bc3e5ea1d7cb45e19d85c5e420f2c0a12b428742e1110e66f4ceecbe5a6badddd36cc9e0aff48e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
5a19e23febb6cfaecf3221a677548e6b

SHA1
f61d2922da7ac45e119eb684d6566bcc9e5b691a

SHA256
323d96fb06b0368541c5b8066512a3af651237da37297498c6bbd555e5ac8f61

SHA512
95638626b2c9f259c3a80c30696d41598e1219a2bbfb02e6011b60e3fe82d6576dbc31f20c727cf0ef13f9cd9616264a15da6016b1f3976aa212a2a3ed68ba78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
7e7a1a9293d8d5b08c3616e1a08eb88a

SHA1
deaa685c8fbf8fe9a0adaa2f8647c07489472381

SHA256
43149618032bd84cda19b1e03f4e01ebb879093a12fbe7a987db4ad2ff0b520b

SHA512
71b4369230f4753b4eebf47db34078247c0db19208c0316326ec2eeaa5d592313df78a042b4f706375212df911fde3100834d3131ac7d27032f9ff67b6fded70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
12c6e8b8300505880d454f68ba20bae7

SHA1
2915bf5894f31f57dced027153d04691fa38292f

SHA256
686f24c4af9bcb3949ddd994a90e2469a892e01914e75537cd9d3eba71da5f15

SHA512
cfb76cda8d353ef77a902ec1400406ec373d71384f92cee2027ab3179f9b8d21844de985bcbedf1ec13958923f4cdf1aff40b4742892a18f7484ca9e64d0f81d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
0449612b55524a3fe343619cd5617dda

SHA1
5a80f6ad63e7bf00d9be0bb5cce20e007f9ff2bc

SHA256
8e20c7db24583330a42d5da2d1cfaf8ac879fefdb83b1ddafdc7b5048d7bba21

SHA512
86651b126d3b6148c7f79bd01c4f937ab1d88f274f92945abcc74bbaea911a39f1229d3f3df34dd450bdec8fbbbe1e17d21a8b0a84b87162ba9eca435f39c894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b9878e98f32efd8e7219643ff06f7c1d

SHA1
0042b5820deb6f7416d50fe70628cf6fbabea394

SHA256
3a6df3b04d6f36eeb784be19307922955b30fc62b884aee2c208c83bd55c18a6

SHA512
37e0bea8f5721d9b063a0b2fa503931f75724aeb650739a89af5260b6b5e901522ffed87ce9fa4ad2c055a935203889541ad10726a72f18a034f860e7ac73561

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
dd64592012925e1943a2b91ca36f60a1

SHA1
60fde32c8e6b37d8918f5fa2d0b6df77e2f121eb

SHA256
816a4464e4463a01afc74e6f07f1cbc43da7158b209c3ba43cdbb3961deaa170

SHA512
aae69f3f9145250cb3f99905a7d762b4311a7e8386b806d0984e885c1ec45687d3816d10e1314a065c7cacfe4eb5d7ba64e03331954c24a9d47d39c74ee7fd30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
01370e2ed8ccbc469f8a8de6d5f8190b

SHA1
74bd1461038a91cf742489848a1c7f5d88eab029

SHA256
90b9578de361bf8aedd24f2540af8e106bab18fa78aa5ad35af6a9f487955972

SHA512
772ddfc911b2b4e68b3245654df13a053c76a85309129dd8db1782e6cb697e5316ae41c3eff7ee09aa5671189b029244832aa5e26afae68df5e066c40eaa708a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
76eb71192f94388b03f530fdaacc0d04

SHA1
d8286ef3a3e2ef2906c99c1a4b5bb687d3beb353

SHA256
00d3fede93435ecfaef93f14b8f914d3a32b2de6fcb777345da8155a32f46332

SHA512
c3cc1d9605109d6c2d6de5fa62d6b6fea0c72e1f8cef6e1d4803ace7f654d35b8b6c0e91008b63e1951aa4aab2507ef8199d327adeb14b7904a1a8a432311e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
692e8b3dd1c620b00f5a385a58280e1b

SHA1
d0b534d3eefcb8f0db00fb1f603bf63e382dec77

SHA256
a24e940affa30be114c937282d5b85dc182783688ce899f595bac7d520c5895f

SHA512
4d801c1497209f882f7710e508f2c01b756888387f9de6c414cbba7e169635e4d3f4721ef6244f10bddcb2aa59b4cbdb266f5fdee67b2fda59ec8371eaa3c78e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
ecf09571aadf20a95de9bee02b5d91ea

SHA1
18b3774f2ffa5924c248d38749013c7f609baf90

SHA256
d408030fafb9ac855dcefdb5ca47eebd4b89f51de3848655ef4612e56802bd07

SHA512
2415f40026196019e9ca08099009b938d8b02ab9135b02b54adfec8d42777125fe29fb6ff6ba3c83a8a3edd1e59b72d781d7997e688cc128710da3d80f6b8d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
3e990969f821101118fac9a9294ca1d9

SHA1
fb72112e4b23d37f6ba06a27ecfefc7f5a93b032

SHA256
79608c55804bd23d3885db675e3d25500f68b9ad53061bf4d61aebdbe82d851c

SHA512
a526b14b84df811141a46a678fc7364ca5850c7d557d82ed01219337fa088bdf868e8692b84713fb5c50b8913af590f86048b8091f18408271fe4122a4ffd070

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
761B

MD5
04d88214f1036f4d3d5dfdd2dfe7e04f

SHA1
c2f3f4765e75c9116b2e693a8651f60052eb3a00

SHA256
a29af33dfe27b37f4b3fa954184bcb720f8117a418a221bbc21b003625adac20

SHA512
accec1544dc6f46eddb7e41e4b5ec0cfd54db29303360a7641fed5c62ce2a74a7b6351f3d6f5c8dd799b1b349c5885d98d3a88a7a59da359cd01c3f2e74995f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
9KB

MD5
a4250b97773e2fdff44517f71de0d622

SHA1
5b9cefbde58a867bc5ae8c97462fa9a3d086e330

SHA256
ebab8f0cdabf9a04532d623da2abcfaf2522550e90dc5e4a80caa191e37572f1

SHA512
4793789cade00ea195c955a7e0004e91700ebbd0c612664c269a71e4f27dd022deb8686579f3cca58cbb81c036815195b05738cac9f370b5f313d229bcaceedf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
21a83ff4dcb4735bfcaeed62b78762c8

SHA1
3910dd7aa6056b70df8d09876c20f11c281a06e3

SHA256
a1616cdaaa7b847f6ecfa6a93baf028045ff4f522873e488990775558d674c42

SHA512
61be95bf2f2e2300e426e1b4a3c389c5eee6c4446169d90a2847033dacef5274fd29f5fba9ec52098c383f295c4cd53609e3705ed37157b179f1462a640f310a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
a63cf222f64dd1e8f66bd3cd4d98d30b

SHA1
16d0fabf8f8d84f7887ff021f3fb6c76a81fec30

SHA256
76f870dead25d873301171d4f3eff4be0d310f81d6fcff46dd7d5dc55edbd7ea

SHA512
7eb1129a25da32570f2f011fb2882e66a1e2fa7f8f0b969f1a528a0cc202414ec3e69ce27db62bd687e61ae11967a6d4fd28c4f6b2df8fa8bfb9dfc2ca83bd62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
81b59ca260ea7dfa22e1a6bcf27cf563

SHA1
97757d0f2935dba172e5fe8128fcd73991d46884

SHA256
4897bae97e42bde7f3b4a467dc8f9bda245a8dc74c721dd58b2375e8c31c6c3c

SHA512
1a4e4435d44987c35c3113101c2c0f49a7ff7a99433e3c194e5a91731b64e65a832a8f6a3174a7944dca8aa781d85b1bc4cfe61ab3b571e8c14ef0f2dcc6358a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1169688446ddf48b66dfa898d95055ec

SHA1
313dd154f3477b67fb553416943f25d6e8afe73c

SHA256
85f0073446500af5feff89aa84c948da502ab65376e57629993d7d1a27b9b3a2

SHA512
257eafcb52e2d71f69ae5e8f9b46fe1cc4fab18757bf3668c389cb08457c61a56e81b1631d672150ef86f745d7504a92faf3625280cb72dabce1176308b373c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02256fefa2650bb49dddeada81e34f45

SHA1
0d6e7973ae08221eb1f454e2ae75f373574f7a3f

SHA256
ec224055b6ec5a74a33abd0c41544381a134db645bb1a6401181696eee7077b4

SHA512
f993b015427bc6f99804ee95cdb65707d9652fe61377a53e6d61394ee3521a618bcdd0ebbd1c38b3d0817bad9d30b1757fb825b2f1097951b156bb6f1b8da019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4e65b234e74c97e09708c47f27f373eb

SHA1
dcfc0881f5f5c47f3e31c52a448994322a7968d4

SHA256
443cca936b4edc513b67f4a19ce3543e738ac6c1f2e2bb1386d08e1f54bf8e38

SHA512
ef4debc8d2d4b1688b221dc3e8e1a926ef81ab1874209755ebdb4e14eb77a134dbd2c88ee0a8d9d192038b94111ee802dfa268df9e257c3da51abbe7307b85dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a8df877ed9e5a1992fd4914af5c04fd4

SHA1
95ed292c608628e057e4bca3e0a22a3bcce174d6

SHA256
e0ff59a9bb7e514c66992ad4ec16ec2fc59e41d1587b5bd02f9951961b2f9dc9

SHA512
1dd57031a571e5cd2eda2b496260b15aba7705645d423b3fab2f4eb9466090aea97d4cee3ecfaab2f2b7c22e77bea213a22a9a9b4d53bb9b65f610caa8930775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2343ea7e35e751fe8ed6940af09fd8fb

SHA1
586be06dbd3ed5e32d660d1a3717f172146c2000

SHA256
e631bc1919907eeda6565b2478d3cef719a78a590dc047837403f57b0bfec8cc

SHA512
c59521ee7c8cd0d371caeaab98b74920245e4f05d0b5f5fa78793f788487329179e70da92612d9ab95f181f89e6b00606a7dd55ee30fa0f9e8b0ae62490ffb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a541d34123252a132e0dbb8b6ffd69c

SHA1
8bedbe648cbaa22f34b7352173b232789e3f1158

SHA256
e538d77005d5abc4947e5b3eecc8108309ae094a6ed28612110b9e2ef885b8f7

SHA512
7242522cb2874e286703a425372589d39374d03408d314d7ec3694285e1ebcb9b43a2e54718d0ad3fb53484c018b46fa332d2eaa188180962c3d9b9a44f73083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
396B

MD5
1cc988043e4e3f295289139abf08e2e2

SHA1
02f6944f0634e4bee96d89697623c7e1708d4bf0

SHA256
a2d83afaf5fc5b379add25129bbe80d3c7c9938759fb007843c30cd27f6ab1cd

SHA512
675399f6f0ff7eacae2a918ebd1587ec6e7b17b7dec5724d3d32232adecf2ae63e5a50445d9f669de5e61d4625de17f7fc462689d4b280a606af5c03d007ef71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
322B

MD5
60e3d465b8a022078b163deabb9b9a54

SHA1
78f0ffd312cce853740382f6fcab0707975d95a3

SHA256
e3d536da540c767c4ba49a678128429eb1eeb2625d6a6270a6ac83db4e527709

SHA512
5cb7e220c9bebeb466f663ac8addccb6a8cfaf361eeaf8809ea1a8558b2781ae9833a550a0aa969d344ebbe1d522412bacbca90364f3c8ba0b4044a2e8cac4ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13385491258068825

Filesize
6KB

MD5
9f44e10a71fdcb37571cd97a9af67eb4

SHA1
52f2b5a8fadb5e09ee40c782687159d924a436b2

SHA256
ce71dce56b777901ab6ebfcde2e6328b8fda666a3ea1583da0596a5edb22c5ad

SHA512
a7b9aea0b11e9851e024a14e941a3a3a21e489e04538996baaa2d39a883de0e35127b7b2fa46240eb18b7ad9e89d0856657a8c0326a50892d3ea75aecbd12cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13385491258252825

Filesize
2KB

MD5
09a5150bcf785775ce52670445f220fa

SHA1
04b0330c1846f78e8d8ea763b090aa87bbe7c117

SHA256
3d1cb54decf96e9e0d9990d2b35ad358cc44ca75a51a5c0b9067211080f2c675

SHA512
de1e04894d6b8120ba1fcc0c01b22076278466fa1815b7ffe0913520d950c77a12b2de7cda4f4139439bb31569198311a7ee07cd7657428e7cb4546b0d3552e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
115B

MD5
59c15d61be447ec2f9e0daf7963c02b0

SHA1
14b1a9bc84c2aec430a3bb4d9ae0426ad71104c3

SHA256
e95a49059b2318aa526d31e6deb5159e29901a5ccdd611abcbecf58e8fc4c68f

SHA512
5447f006fbee0399383fb97295485b819df1e63ecc05b6063947eb5f0c8325d13e0adcfe0e7d5c51b5ccefe450700338a40c47b55c123dcc6d507a1af7a3d93c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
3da7d21f853f89bbdcaaa63da9f2d297

SHA1
6a8718220e52e953ec6ffa45a4a303b103038b2e

SHA256
d4caee21633632dd2f70f7cf8ce16877c52bab4a02f6ef0d2ede87b698dbe529

SHA512
87c6854d4d19cdfda296278b9c772bc430dc3592cc312537c98abe81953988e39153e3698de2b963bbe93416c5084724cd0000cf1eebc51cf8166455bfb2c4ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
9909467c28f3054e727c299182203f47

SHA1
0ec0b799305f0b0a36290a609e33a2335e812fa0

SHA256
aeeb10018a7e8aea94024aab6fcd143abb77f2b6ad4d1349f0014f06560beb91

SHA512
4fc09d3626fd6297483a17b681666f862fd061c1fdb07f10a119584e373d8f0f6edf5f3fd27a7160855004dfd4d99708b431c5cc85372c16c0f688e98a2295e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
804f47694dedf03cb1fd21a9bca99d05

SHA1
6e27f5af0716242a4a72d7048d6d6fff3837bcfe

SHA256
bfa0650e63ba0d2f2f48c70fca858a26870867ca198cb8d734f4b61b57d7dfe7

SHA512
c01526d8fd4625033f31286f55fc81c87a367afcdf406a311f2750737edf1db0b9732bf3e087b2811ff18c25dad28148cdf2c8a42a8d8a19b852be8ce5c2ce99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7724d67751e1ab578c625bf45fe6ddf1

SHA1
f6bb536b63d84c58da0cc77b9dcef33430f16243

SHA256
e6487ff7ac4963b39b3eec0b329be1b994f45724b3a1750ec8f130e4367525c9

SHA512
d01838f9e3857a64ae8f922d7c23b95329623d1ed0f09bc8eda15279f47362317f22850e016602f162199bc3bf5efaa32306872a24d30586eed42c4ccd18051c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
3822e730749b4bb29570f5a28dcd0923

SHA1
6d135fcfcbbfbb369511c2038788a30f60dfbca2

SHA256
256658c233a79b165f57b36eb479dbd8edb046f3b2e1a401cf88fda9afc7ca49

SHA512
5ab8e1866bf39a03d2804bad551417f5d488accf4d7107d3a8d140aeae86b62e32b0e653174287c994d4b6a7079abd8ea4cd7d1f66382d904b8ccf97d7d17aa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Filesize
10KB

MD5
1de238021c980d74887a2062e0750273

SHA1
31273afdb854f465ae6206f495d9ea296b330a1e

SHA256
26d79a9926def252dded4fc1916b3093bd49fbba072ec5177b093427fbb34921

SHA512
badb87ba19b43d04167726f2621892dc422762c4cff4e5c91d46b890d745e44d71393e92a9e51e56e9a82f4d01ba2e7b40dbbaab5b40f56b99628c57ebd3c163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

Filesize
136B

MD5
b4fb0940606542e57fc7a9d1321c0884

SHA1
85a2256d82f4bb07ca877947cf888177e30e9950

SHA256
b71fd8ac04cdd59ea5f665fa61d61a5cefcc1e7707b67ef9620571f9047511e1

SHA512
b892d608759b46b6e5383af9bc3fe5e582eb94b226807327a704ce0be7c6d754dcea19e42a2b355430c7174261c3e9730a769a84c68cf779ba4dc31c7d00883e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004

Filesize
50B

MD5
031d6d1e28fe41a9bdcbd8a21da92df1

SHA1
38cee81cb035a60a23d6e045e5d72116f2a58683

SHA256
b51bc53f3c43a5b800a723623c4e56a836367d6e2787c57d71184df5d24151da

SHA512
e994cd3a8ee3e3cf6304c33df5b7d6cc8207e0c08d568925afa9d46d42f6f1a5bdd7261f0fd1fcdf4df1a173ef4e159ee1de8125e54efee488a1220ce85af904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
52KB

MD5
cef242512f698aea0dbdc01240fe8233

SHA1
43d405c72269b3711c01985b5f2722fbbf74fb03

SHA256
24cf2d6ffb60be5a19a2b38d1430f274a17c7e1c98524040f19604658e828bfb

SHA512
89a579abfdf96e497f14018c7d7a117713a43ccbebf2f0564bf495ff7efa2aad73f41be7b15dfa65f9b420ac0a9a192ce42f76023c4ef09e4b5814b71ac6fbe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
213B

MD5
f38236e3783bfefcd63b4d262118ca36

SHA1
87e87d4e26ec4b6054a1d899b538310b448dccc3

SHA256
e41099d92ba2f1c127ab5a995cbba2077a027ccc2879ea94daccdbf0a1bd674c

SHA512
7c901b8ec961bf1c954492283950d846915d1a6de79a674d97c37b9fc6b3dc469bb90a46aab6f9e67c7687315e1a778b42d376c0d6327390be775bb1d63b5a87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
a7ca6ca65ed1d603e4cf9eeb5d745c21

SHA1
94c55683b1a77208cea4d248a013648ce3c8a700

SHA256
3724883baf7cf89ab70ce8adc0f131f4b1e4858c2c5fd9957043bad9452f54f4

SHA512
434afec71f88c382558690972ebea435ffc3f0a7b86e2a6f517b90153c0e8ca874767a628950e003a739a14dae603e2c1f21dfae2099439374163bfda2084279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
9aeca0b56d50c71f8c54924b6d34b046

SHA1
c94b613f4078ec57ec3c829793e121286599e384

SHA256
72fb2863295fa52b226e1859ea678fca13afed034126500b537911f47df8e01e

SHA512
138ee954dad265c131623b289a4d38a16d68b3ca79748ace451d68cde423c9530c9d0c921f10b1aab480f285e9fa6bfc480e02f9fd91fcb071373d92cab2e7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
c0126c0c8ec4fcca87bd36c105e0ea4f

SHA1
29534fdc4184dbf41232b296630abb08ec0e7cc2

SHA256
eb2be3f4fb9dfce023974da511f9f495889cceb7185f37135a57872965500db1

SHA512
a7f962b35b7d49aa1bc69480a8a900d59ce9c734e66f4e1d50c03b320dbac882c163e5e6ac076c852bab7f77c5b0c7e8f8deaf6b33b3ea68949f2fdb72ffdabc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
ba1123fe707b5ce34997a9ff290777d7

SHA1
fcaac6174a966ae2dd3eba2d5da3289dceb41720

SHA256
cf64c0a966409d1675819abee079c95d7f3c7da2097d0da3c0fa471d3c02c498

SHA512
3bf06e3fae998d713e4f1ce96ace1534dc1cc0049ffebcb0f8d9dee620283a96d113267b1ff23d32fdb45f0be2adb065753919444814a5167f2e4b0c44dbcc93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
69a119a2b525c2b922cc39e49c431c4a

SHA1
f9cb74a19ca9d825a6918638264784334f7895f8

SHA256
b8979bc1b5bb0c0b8d3178a09e6899b7832e1cc2dfd213e8553a3ddbf9058d1b

SHA512
1f12bdadb63579c0725609dda3b167e79953138786bfb81886ad72292f2a3188ca088efd1de5cadf100a3d56f2882a895e0465f1ca53ddeaa6c0d58bbe6ace6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
e190d9a6e3ea9d7a7a55c7343a2a263b

SHA1
66edf12836491f64459e19460a391c6fccc7807f

SHA256
911ca1012ad0d8b52cff6efb8c71f2e1c0f9b0bef886fc254fb3180f71af5080

SHA512
ed561bc055f2101e8e0b8f295241c1509caae49839d246684938f88e719de32d89c8c12aa1ffdca3376a790f5ae7f967ee657f0c598c3e2d3707ad6c53a5ee0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
17KB

MD5
6bc4851424575eaf03ebe2efee6073ab

SHA1
2d014fe2feb929d03a46322645a94556ca5c9e96

SHA256
abaded8e235fdf329521806af30a1cc7701eaca3fe2efccb9da760ec6d8e5e4e

SHA512
af3b7d93fa2243475d74d4bd7f918ce2706bf6eca28029b9e49869f5f793e483efaafdfab1fed6306d5fc77a5ed3b27097b27448cd04560bed4df6fa3268ccf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002

Filesize
17KB

MD5
fc97b88a7ce0b008366cd0260b0321dc

SHA1
4eae02aecb04fa15f0bb62036151fa016e64f7a9

SHA256
6388415a307a208b0a43b817ccd9e5fcdda9b6939ecd20ef4c0eda1aa3a0e49e

SHA512
889a0db0eb5ad4de4279b620783964bfda8edc6b137059d1ec1da9282716fe930f8c4ebfadea7cd5247a997f8d4d2990f7b972a17106de491365e3c2d2138175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
71312f2fc0247b50add941171b56b129

SHA1
8931b7250611ffaf291acedbeac98327c401dd16

SHA256
cc452288647010152000f03bdbb847fd47d6769eb0a95173fab56330ea5ef04c

SHA512
f4387c575de6bc3c37a81623b63d4f585918c486799a80e2065858fd714475dd10cef8f28af9a0255156d202cc586505b181fc3bff2a48eb86516f0ed9520eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8573bf0c3caf0c98d6cb8e5a50194c80

SHA1
7d5fe432513ec829f7cf16707a0f9bf216963d55

SHA256
82c73b1bbde5ab71720c2d27552baf76335f54dae9cd8cd56eadbd9cff45d4be

SHA512
3c5768e2a15660be8915fe46e0ddd9be998bdbab741d2bd0d83a189f9465e2246653e3425bc498e0fc86d0e5bd07966dc3f16ba12d357c7647f06741e5ec001d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ac13e119cb8677d425a5f0a43d4582fd

SHA1
e417f92face817f07f400132c5934972133f5adb

SHA256
e246b18745108d58e7ef4bcc4892bce7b3782d61d86bbc35369b721abff1da09

SHA512
3e18159e3bc01162d3562a922eeed3d66a9d16e072af338467d157ab4de38a00b42c318bf2a1a7afee7e7938ef58972997caf7d5ec08431b2b04679082b0c5aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
14f0a711686a6c09fba1bbd124057962

SHA1
1a1ab33040b0e975cbeace81f44b117f3968a0cc

SHA256
85085b2953f33ecfceca0d203b338bd9f52cfc14ab2ca3276848c0eb78f785aa

SHA512
3000adbcb0373d0889e6aae90bc15b2d63b6ea17c35dac715ee3a29d6c9b7e86b0b6321b97aaa4dadb19b5ee5682a64cb468799a1a794ecdb7e2b14bc117bd77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
d87a48f6b335cee0ba7eefc98ca59ca1

SHA1
de1ab839219bdffc41c0faf2d79a9cd8a066d65f

SHA256
6411c65c46e6019d997caa7af9d31cffabcff8ba6cd5aea599a6c6723d53323b

SHA512
ba91286801123746eab5bb88a686fdaee9dd34800c8e5fc2448a1c5cdd4486980cdd6a2994ef84cd8e1efd4842ee6a6f0720396305d98a2694974c60c7478ffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
f703f0013699ae7a4943a8d5c08b4b51

SHA1
78a3a7cd42c5020d83d1af43ead18371c3a1ee46

SHA256
c1ed12fc8d81d270b0d51daf34c48dda8f41e1ce4e661c4a40c5c8c1db12f196

SHA512
8e1210fe2c0400974191bafd98dba93b1e5a4c6ddb6a902c547a3904223b93a928646a65c8a26a032379539a1b1eb24c1f9a14e594d53b6b08d7ffcccfcc14c8

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
74B

MD5
685468b2b1d7bc95cda77402ddbb17d9

SHA1
a7bf8b2dbd5f7677924f82688d6d8509e4be88d3

SHA256
c0ffbd7bed790f700b606fff304bad0b3342dbb9fea8861e2f62892d4d966a70

SHA512
14ea6df703e21bd7e81362e82bae366e04fff6c4a38cca84182f5de5c29597ef6b5d640f8c5c180f863941079a67865fcb7fd1ef5b4638ca1b3d778d638bacda

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

Filesize
17B

MD5
f8d491bb4fc8889c0d8a395bc33b5965

SHA1
2683d57a4eede5b5fe4bd765e792547bc23a4cc5

SHA256
ce9efc64be890221c3d09c5b78515722a54ed12839e6a1d4e513db6a38b1f940

SHA512
934f8d8d42c992f9a3db06ec2d71beb04ebe96ee7a6c99caf46281c15c4a6ced5d542d36188ad8f936be645868204c6f5d5f3e24795403bd708a3c6c4c55b06f

Download Submit
memory/808-367-0x00007FFFD5340000-0x00007FFFD5374000-memory.dmp

Filesize
208KB

Download
memory/808-366-0x00007FF683DB0000-0x00007FF683EA8000-memory.dmp

Filesize
992KB

Download
memory/808-369-0x00007FFFC11E0000-0x00007FFFC2290000-memory.dmp

Filesize
16.7MB

Download
memory/808-368-0x00007FFFC2DF0000-0x00007FFFC30A6000-memory.dmp

Filesize
2.7MB

Download
memory/2384-381-0x000001A37CB60000-0x000001A37CB61000-memory.dmp

Filesize
4KB

Download
memory/2384-370-0x000001A374860000-0x000001A374870000-memory.dmp

Filesize
64KB

Download
memory/2384-374-0x000001A3748A0000-0x000001A3748B0000-memory.dmp

Filesize
64KB

Download
memory/2384-383-0x000001A37CBE0000-0x000001A37CBE1000-memory.dmp

Filesize
4KB

Download
memory/2384-385-0x000001A37CBE0000-0x000001A37CBE1000-memory.dmp

Filesize
4KB

Download
memory/2384-680-0x000001A37CCD0000-0x000001A37CCD1000-memory.dmp

Filesize
4KB

Download
memory/2384-675-0x000001A37CCE0000-0x000001A37CCE1000-memory.dmp

Filesize
4KB

Download
memory/2384-389-0x000001A37CC80000-0x000001A37CC81000-memory.dmp

Filesize
4KB

Download
memory/2384-386-0x000001A37CC70000-0x000001A37CC71000-memory.dmp

Filesize
4KB

Download
memory/2384-388-0x000001A37CC80000-0x000001A37CC81000-memory.dmp

Filesize
4KB

Download
memory/2384-387-0x000001A37CC70000-0x000001A37CC71000-memory.dmp

Filesize
4KB

Download
memory/3756-154-0x000002F4F9510000-0x000002F4F9511000-memory.dmp

Filesize
4KB

Download
memory/3756-153-0x000002F4F9510000-0x000002F4F9511000-memory.dmp

Filesize
4KB

Download
memory/3756-159-0x000002F4F9510000-0x000002F4F9511000-memory.dmp

Filesize
4KB

Download
memory/3756-147-0x000002F4F9510000-0x000002F4F9511000-memory.dmp

Filesize
4KB

Download
memory/3756-148-0x000002F4F9510000-0x000002F4F9511000-memory.dmp

Filesize
4KB

Download
memory/3756-149-0x000002F4F9510000-0x000002F4F9511000-memory.dmp

Filesize
4KB

Download
memory/3756-158-0x000002F4F9510000-0x000002F4F9511000-memory.dmp

Filesize
4KB

Download
memory/3756-157-0x000002F4F9510000-0x000002F4F9511000-memory.dmp

Filesize
4KB

Download
memory/3756-156-0x000002F4F9510000-0x000002F4F9511000-memory.dmp

Filesize
4KB

Download
memory/3756-155-0x000002F4F9510000-0x000002F4F9511000-memory.dmp

Filesize
4KB

Download