hxxps://kiddion[.]net/

Analysis

user interaction
yes
max time kernel
78s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://kiddion.net/
Sample260417-vbss8sdx4j

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 44 IoCs

pid	Process
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
117	api.ipify.org
282	api.ipify.org
283	api.ipify.org
284	api.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_691046710\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_691046710\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4980_1346285224\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4980_895333520\_locales\as\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5056	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209181957420713"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{7C940C0C-0AEE-45B7-936B-75DEBF069E5F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{534BA303-DDD4-43C9-A0E0-E9CDB4C2143D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4856	Kiddions Menu.exe
4856	Kiddions Menu.exe
5332	Kiddions Menu.exe
5332	Kiddions Menu.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
1716	msedgewebview2.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
116	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	Kiddions Menu.exe
Token: SeDebugPrivilege	5332	Kiddions Menu.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4676	4980	msedge.exe	84
PID 4980 wrote to memory of 5048	4980	msedge.exe	85
PID 4980 wrote to memory of 5056	4980	msedge.exe	86
PID 4980 wrote to memory of 5048	4980	msedge.exe	85
PID 4980 wrote to memory of 5048	4980	msedge.exe	85
PID 4980 wrote to memory of 1464	4980	msedge.exe	87
PID 4980 wrote to memory of 1464	4980	msedge.exe	87
PID 4980 wrote to memory of 5132	4980	msedge.exe	89
PID 4980 wrote to memory of 4836	4980	msedge.exe	90
PID 4980 wrote to memory of 5132	4980	msedge.exe	89
PID 4980 wrote to memory of 5132	4980	msedge.exe	89
PID 4980 wrote to memory of 4836	4980	msedge.exe	90
PID 4980 wrote to memory of 4836	4980	msedge.exe	90
PID 4980 wrote to memory of 1580	4980	msedge.exe	93
PID 4980 wrote to memory of 1580	4980	msedge.exe	93
PID 4980 wrote to memory of 4288	4980	msedge.exe	94
PID 4980 wrote to memory of 4288	4980	msedge.exe	94
PID 4980 wrote to memory of 3768	4980	msedge.exe	95
PID 4980 wrote to memory of 3768	4980	msedge.exe	95
PID 4980 wrote to memory of 3768	4980	msedge.exe	95
PID 4980 wrote to memory of 2340	4980	msedge.exe	97
PID 4980 wrote to memory of 2432	4980	msedge.exe	98
PID 4980 wrote to memory of 2432	4980	msedge.exe	98
PID 4980 wrote to memory of 808	4980	msedge.exe	99
PID 4980 wrote to memory of 808	4980	msedge.exe	99
PID 4980 wrote to memory of 808	4980	msedge.exe	99
PID 4980 wrote to memory of 1744	4980	msedge.exe	102
PID 4980 wrote to memory of 1780	4980	msedge.exe	103
PID 4980 wrote to memory of 1780	4980	msedge.exe	103
PID 4980 wrote to memory of 1780	4980	msedge.exe	103
PID 3412 wrote to memory of 4856	3412	Kiddions Menu.exe	107
PID 4856 wrote to memory of 1716	4856	Kiddions Menu.exe	109
PID 1716 wrote to memory of 2368	1716	msedgewebview2.exe	110
PID 1716 wrote to memory of 4196	1716	msedgewebview2.exe	113
PID 1716 wrote to memory of 4196	1716	msedgewebview2.exe	113
PID 1716 wrote to memory of 4196	1716	msedgewebview2.exe	113
PID 1716 wrote to memory of 2892	1716	msedgewebview2.exe	114
PID 1716 wrote to memory of 5632	1716	msedgewebview2.exe	115
PID 1716 wrote to memory of 5632	1716	msedgewebview2.exe	115
PID 1716 wrote to memory of 6040	1716	msedgewebview2.exe	117
PID 1716 wrote to memory of 6040	1716	msedgewebview2.exe	117
PID 1716 wrote to memory of 6040	1716	msedgewebview2.exe	117
PID 4980 wrote to memory of 1608	4980	msedge.exe	122
PID 4980 wrote to memory of 6108	4980	msedge.exe	123
PID 4980 wrote to memory of 6128	4980	msedge.exe	124
PID 4980 wrote to memory of 412	4980	msedge.exe	125
PID 4980 wrote to memory of 412	4980	msedge.exe	125
PID 4980 wrote to memory of 5316	4980	msedge.exe	126
PID 4980 wrote to memory of 5316	4980	msedge.exe	126
PID 4856 wrote to memory of 1892	4856	Kiddions Menu.exe	127
PID 1892 wrote to memory of 1768	1892	msedge.exe	128
PID 4980 wrote to memory of 5700	4980	msedge.exe	129
PID 4980 wrote to memory of 5700	4980	msedge.exe	129
PID 4980 wrote to memory of 5700	4980	msedge.exe	129
PID 4980 wrote to memory of 864	4980	msedge.exe	130
PID 4980 wrote to memory of 864	4980	msedge.exe	130
PID 4980 wrote to memory of 864	4980	msedge.exe	130
PID 4980 wrote to memory of 5604	4980	msedge.exe	131
PID 4980 wrote to memory of 5604	4980	msedge.exe	131
PID 4980 wrote to memory of 5604	4980	msedge.exe	131
PID 4980 wrote to memory of 3768	4980	msedge.exe	132
PID 4980 wrote to memory of 3768	4980	msedge.exe	132
PID 4980 wrote to memory of 3768	4980	msedge.exe	132
PID 4980 wrote to memory of 5184	4980	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kiddion.net/
1⤵
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff96dbc188,0x7fff96dbc194,0x7fff96dbc1a0
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,18136095388997493608,4113087038367199321,262144 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,14096128462139690406,9395165439417031227,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,4753881067507546932,1589947959035780497,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,9800264665279584939,14631464493486553823,2097152 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,1046642635861066702,4782305298567377108,2097152 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,11080020087674647765,12542263621252969424,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,11152067791344094009,18342149469646706305,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4944,i,14025490295977387168,15453944935894481563,2097152 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,15800693378749624202,15439004476926623841,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,15800693378749624202,15439004476926623841,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,13212706518886385853,8328167195632334565,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6352,i,10362872041598910871,6332130870178981111,2097152 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,13913964189808429873,17511566716409144766,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6724,i,4426406816889130417,10144583034188297460,2097152 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,1563195637106778979,11501559343773456844,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,10999760033430273388,13273399639369113412,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,11136553159703713683,1068727608473780741,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,17689638444533932500,10307948503399881874,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,4349513916843044353,3331122792766086865,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5004,i,8120326336869392565,13334973233887988118,2097152 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=2956,i,15775100607810891833,17737207766452842248,2097152 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6760,i,5175443617294128278,8101394011804056586,2097152 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4944,i,8089953781221172901,5230375056422646573,2097152 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,9646900263138525631,5058990499799159410,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,6440366521706866251,9151382912700912491,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5300,i,3070578322243827888,18177463644494883407,2097152 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,11284967541302346457,1245722468056081330,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,2653986385683326926,11079841385950501409,524288 --field-trial-handle=2284,i,623006183359246702,13129629244218523955,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2656

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1916

C:\Users\Admin\AppData\Local\Temp\Temp1_Kiddions Menu.zip\Kiddions Menu.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Kiddions Menu.zip\Kiddions Menu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Temp\Temp1_Kiddions Menu.zip\Kiddions Menu.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_Kiddions Menu.zip\Kiddions Menu.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Kiddions Menu.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --disable-features=ElasticOverscroll --mojo-named-platform-channel-pipe=4856.3508.5103151973426804158
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x174,0x178,0x17c,0x150,0x184,0x7fff9150b078,0x7fff9150b084,0x7fff9150b090
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,6770246372832495639,12237321448651160622,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2060,i,6770246372832495639,12237321448651160622,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2376,i,6770246372832495639,12237321448651160622,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3660,i,6770246372832495639,12237321448651160622,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://jump.offerclk.net/aff_c?offer_id=55820&aff_id=335999&aff_sub=AffiliateApi&aff_sub2=9v19p&aff_sub3=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJvZ2FkcyIsImF1ZCI6InBvc3RiYWNrIiwiaWF0IjoxNzc2NDQ0NjI4LCJuYmYiOjE3NzY0NDQ2MjgsImRhdGEiOnsiaXAiOiI4NS4yMDMuNDYuMjI2IiwidWEiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTMyLjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEzMi4wLjAuMCIsInJlZiI6bnVsbCwibGFuZyI6bnVsbH19.-rAf4SeZXMaBXYXZud-_hNvqvgcvQoSFzr6KW29v5Ti1Fmzbh6CLSk2IvQS4r-BzvMEV0IRLgHBO31D2x3gCeQ&aff_sub4=&aff_sub5=
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://jump.offerclk.net/aff_c?offer_id=55820&aff_id=335999&aff_sub=AffiliateApi&aff_sub2=9v19p&aff_sub3=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJvZ2FkcyIsImF1ZCI6InBvc3RiYWNrIiwiaWF0IjoxNzc2NDQ0NjI4LCJuYmYiOjE3NzY0NDQ2MjgsImRhdGEiOnsiaXAiOiI4NS4yMDMuNDYuMjI2IiwidWEiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTMyLjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEzMi4wLjAuMCIsInJlZiI6bnVsbCwibGFuZyI6bnVsbH19.-rAf4SeZXMaBXYXZud-_hNvqvgcvQoSFzr6KW29v5Ti1Fmzbh6CLSk2IvQS4r-BzvMEV0IRLgHBO31D2x3gCeQ&aff_sub4=&aff_sub5=
      4⤵
      PID:1768

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x310
1⤵
PID:4336

C:\Users\Admin\AppData\Local\Temp\Temp1_Kiddions Menu.zip\Kiddions Menu.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Kiddions Menu.zip\Kiddions Menu.exe"
1⤵
PID:2540
- C:\Users\Admin\AppData\Local\Temp\Temp1_Kiddions Menu.zip\Kiddions Menu.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_Kiddions Menu.zip\Kiddions Menu.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Kiddions Menu.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --disable-features=ElasticOverscroll --mojo-named-platform-channel-pipe=5332.5708.7910958708224497385
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:116
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x198,0x7fff9150b078,0x7fff9150b084,0x7fff9150b090
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1992,i,10267166169113318695,8910488443312368940,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1764,i,10267166169113318695,8910488443312368940,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:3
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2284,i,10267166169113318695,8910488443312368940,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:8
      4⤵
      PID:864
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3520,i,10267166169113318695,8910488443312368940,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4980_691046710\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4980_691046710\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 85f80100856d77899f4ebf4f1815d6783d2c362ceb4d3bfa6e257577dc3993c3
MD5 866db3de45fab5da61c1fb35f2a4cb0d
SHA1 1192a94fcdb5d792ddaa890f2b1e73789039bcbb
SHA512 b723d5b6629e4a7273f5d613828e7cfda3f9ff8e95c05ce308fa90ea2993e54053d01978973002af70bccb7fde31160966694255c1b9edce8e0a5216e6f349fb
TLSH
T184E02BAAD872AC3B1CFD171850501646EB5513972781888B3E3C930C8FB5937499BC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d01ce2605913d94d5bd90e68b82a77da86f80a6ebef443aa68d8e5c180f4d4d7
MD5 1c4d30520b01a79c89199c53be90a085
SHA1 9564b85725beeac51661c26a5cb62d23a68cea53
SHA512 11cf2bbf14fbf5fcff66e779ce36ed713fcabbc49c5855bde1537df5e79eecfca85d9c551167e36f51e11d0880aafc12363773d56845b6f0d7bbbbb655e1c193
TLSH
T196810A0CA196D625E7E06D70D7DD2B7E76745B0D428F0E9931F80E3CBA6EB26C19881C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593e76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593e76.TMP
Size 3KB
SHA256 5ef094940295e4cb182aef1dfab479b23708c54027dcd3ddaf680361b55f9541
MD5 d047803c0c7e3e6f7464e37101b59c49
SHA1 23fb778e18994fe69af6353c7e999710ca93a713
SHA512 5e842952d0fa556c3d09e681c69f68a0e6b500d74ce32a502b9c1b3f720609b4af5bab01d40401544df718ad5020574e57801ba41d9a4522aa48a90fb313a9d3
TLSH
T15C614C5C91968524E7E09DB0D7EE277E76704B0C414F0F9831F44E3C8A2DB12D1A982C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 fc7ead472098eff645b2fe49fa5a7d10c49aa790c535a3c6e6d7ee9465b6df7b
MD5 78371a103ba5191165071b7b479c4707
SHA1 c1d4fa65e7d08cfe8e654cde65bf7b58e7d97573
SHA512 deae0437bdbb25325eacbf5a9c4fe663cedcfbb153106ac0fb950d99e1c98e5cfe445a750898843f711500329dfbd9c2583db6c8a19c29849cd2032aa8f36641
SSDEEP 192:D1Y6v8baq30//oj6S89iyJaqhLLAs1TqrzqACpDf:D1Y6v8baqE//oGS89iyJaqhLLAs1Tqre
TLSH
T15EE1DCF3C3E5866EC91156F0AB146E1BCF2E0518832C3D5A89D4EF9B93E3471E24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 98cc3b3c443cdbd27d6a0b9fe2f14330470ae5b9be48f032eb2631f511b4da90
MD5 c900e732a0a18f3f6c0c3af716c3f9ea
SHA1 96bc64c7f31efe76b8928f1bc7977e7dab0585b3
SHA512 40dde9fccd3a4d5e04e5faa185f1ba35ef3efb00a69b72e1c46621f16c95f586c78aa0d2a11ee2b71679ffe621cf09156410df6d3ad5b13925eca1b2545a0472
SSDEEP 192:sxZ+VR3yMqZ/K1Ml8Mjt/flsYbVpOqrjTWzodp0WCYHW6+WNcOr0LaI/zezK030t:sxZ+VEbt/flsYbzOiNZHb29/1m+WOl
TLSH
T19E72D816B63859778CDBD31AB5457B67DBF91123D1904E84AAFC9A1C00E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1d2c3aacd3a1ed2b41c1a237373ed5eb2bd8b1ddf9640beedd32b5323de8e7fd
MD5 aaf1af2a05975fe372e59230b47781ce
SHA1 daafd8b0107f6b26c33e40509658df84aaa95e44
SHA512 a02bda82b2f34616f21404d6dc8548b8752eb1f5721fdf803eef30bb185f705de69ada0167d8210aedcd58f34f5906edaae67ad8660cefac29f4b70e85233a83
SSDEEP 192:sxZ+VR3yMqZ/K1Ml8M9t/flsqgVpOqrj1Wzodp+YHW6+WNzr0/YK9fRmZ0IgjrJ:sxZ+VE1t/flsqgzOivjHbU/Tm+j9
TLSH
T11372E7156A78597BCCCBD309B5457FA3DBF91523D1904E44AAFC8A1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 14e9c9662b8963fee4eaa8b46c864cc6fb94f6c9bada69e534db4d4139f6a6f9
MD5 95e546d941fa7ff578f23be48871c58c
SHA1 edaad200a1dd58026614f7ebb93946f14e38f8fc
SHA512 3992a5134ffe2003ff2b1896032b65b0a6fa37ebffde6f9e132b7cce3dc8a00f85b897a9b8774fff62a60482636693676d12f6309b0eef1bce695c3a3ebcbad1
SSDEEP 768:DcgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6MKJLlhzCpUroN:DcgLiAUE/aeWvaShqu1javMKJLDOp/N
TLSH
T18AF20C3B2C0CCB7E4F844E9CDC2ABE8E6DE802CB9698895447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a28618e1544120c8f753cd90e496bdd4b91cd96b142807cc8a1a8b08b1c71b56
MD5 845fe6eb7dd18f251855ce93fdff4fd8
SHA1 7e1e69bbe294ef9b0605fe6c6fc953fbdbd87b36
SHA512 b6178ff22e2d6b0f6b812ada3ec8f79e40cc8c59f126828faec3a227b8f13cca7fdc095e52f8744bb7fc5b8bb667f6f12ec6616772a377c5da12637123d3863d
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BNjnq:krN/INhx+kcxKBzxNDq
TLSH
T1FAB23911717A42903A7E398E8595B82F26C230637098F53B7BB914A60F6BE20DDFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b51b823851410f2040684ccf0d7bbe961e95138739098db61cd63898ed3e9cc8
MD5 8cd76d60711394cd8ae87ed67b40774c
SHA1 24f54cfe056abc7bdf464eab1adc9f4ec258cd40
SHA512 e647ce81a85a0f41da3c6969f5d809391f983475d912ac996ae7839b4a76e03cd3f794ef5747c74bb90b3f958af927b78401478cd74072d44841c26f21ce83ff
SSDEEP 384:nGiFavqMg3sN/8TUNTUlIm2ZTPEN66Owf3YQA+I+6TH3Ra43GrN1k+5vI+6J:tFayv3qwgHZyY/+d6b3RaDS
TLSH
T15EC24A35ECA8DEABEDEA9FD9A7097603AEE01167D48C0AD4DAD81E0D008319D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0b8b60ab1dee28394b68276b2944f191c7e06f40402f52d9c18f3bf013dfd853
MD5 dcd991a72457ee345563af80e766a608
SHA1 714252a722fd7993f8397d5b1aa151e9e11b0400
SHA512 4aa35478722d715382e4adc1fe5b222e3448e69805b39797fcf5d2cb1152a4365937d6ec8b1303a9dc5ba6eebfa0d3aec3788199bc226761f47c2982941b0ac4
SSDEEP 384:nriFVjccCs+Bt0S3MsNcb8TUNTUlI4KZTPDH72Owf3YQA+I+xEbSBF3+frN1k+5e:GFFccQszbwgpH7GY/+dubSGL9w
TLSH
T1B5C24936E8A4CDB7FDE78FD9A31A76579EF01167968819D4D9C81E1C00872DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ad99d1df6211ac629e64de04a58f1f97e0568eb2b2a5e35852af1fd996e068bf
MD5 7a856ab624844cd25c93952981720ee9
SHA1 74acbf1add4fcf3562f97bc37ec37dcaec9cdafd
SHA512 2755f9100bf469bd9489f0c551d18d30867283eb70e06bee193474fe1cb89d80610fb3b1c25cab44c07bb509db5479f16c4a51202a04562766310b201ddfe9a1
SSDEEP 384:ntiFVjccCs+Bt0S3MsNcb8TUNTUlI4KZTPDH72Owf3YQA+I+xEbSBF3+frN1k+5e:kFFccQszbwgpH7GY/+dubSGL9w
TLSH
T193C24936E8A4CDB7FDE78FDAA31A76579EF01167968819D4D9C81E1C00872DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fb19a2dfea7146b2a42957b97d98bb49fbe521b1c43ad22d90544f98b510d5be
MD5 bee58062afa2953e122ce153af0186bd
SHA1 8d2ec8c4ae579792fc1d5bc3a0b4785270a72fc8
SHA512 3970c3f38e3d04065a53ce2305018dfa3aaba8d35eb7760c5a3014d4dc1bf0e19477c09c37385967f92adf0ced3d65a0ff1ce240b35ca7918cdc013c05959e54
SSDEEP 384:ntiFejccCs+Bt0S3WsNcb8TUNTUlI4KZTPjV672Owf3YQA+I+xebSBF3+frN1k+s:kFIccQ2zbwgpU7GY/+dAbSGL9w
TLSH
T178C24936E8A4CDB7FDE78FDAA31A76579EF01167968819D4D9C81E1C00872DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 eb038111387cd61a2697a7c575119e3ec9e399ceb2b6b8667293e564de83d2ea
MD5 19b10425db0d29e1f74325993be679f8
SHA1 ecc9ef9ab98428cb2d2351b7f9b9a77f2919ca8b
SHA512 dcdb8e2f6ea1959c15d8ead76be94ed762cd80beeab1afeaf389f55891b7e885da4b50c4a0c4121b79cd529688492340798b88f85e6f1e56291558172013f668
SSDEEP 384:ndiFXjccCs+Bt0S3ktsNcb8TUNTUlI4KZTPH672Owf3YQA+I+xYbSBF3+frN1k+s:UFTccQazbwgpm7GY/+dWbSGL9w
TLSH
T142E2B3F198E78976E8AE4B97A33D2E029EFCD163B5481984F7841D0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e6503884b1ae71cc2348dd82b6128cc12086d368808f5aed43626871da05f9db
MD5 03191fe778783b559d1d17adc865ad81
SHA1 d428e2f035ddabe03387f653ef67da54d3401a56
SHA512 864ac043471b7e456aadf9d62a9210f6af0376f86840aa7297abd595786ceb4cd5b40cc5d0b6a173c88690496a593bcdab2f7b6257a809795f1746f602362eb3
SSDEEP 384:nriFJjccCs+Bt0S3lsNcb8TUNTUlI4OZTPcH72Owf3YQA+I+xEbSBF3+frN1k+5e:GFJccQFzbwgFS7GY/+dubSGL9w
TLSH
T120C24A36E8A4CDBBFDE78FDAA30A76479EE01167958C59D4D9C81E1C00872DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6ecf7aa607ff024efe7eb8efd1b3ccdbf6e14187953f802bc38fba6cd7c8bb19
MD5 b69fd23c0808492b4a922f2ee897e040
SHA1 9c08aa622a055975467b31f447e862361f260b83
SHA512 2e5579a0942c829acb3b6f656e64d83def29bc0813b47dffc38a2df67fb0b359b13e2cc80cd6f0dd21512fccc23a92d44ef4e125a00a578bae920a6124c778d5
SSDEEP 384:nuiFavqMg3sNIb8TUNTUlIm2ZTPMgbOwf3YQA+I+xFb3Ra43GrN1k+5vI+6J:FFayv3DbwgHRBY/+dfb3RaDS
TLSH
T18CC25A76ECA8D9ABEDE68FD9A70A7603DEE04167D58C0AD4DAD82D0D00871DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 69a45ba98e5a2fa3fdfeede5a2e0a259932024ba5ef82ed7bcbe369cc1e0e121
MD5 35e6b96a99e978a50c84b1c3b73a0fa6
SHA1 f84f3626c43b695c712b02ba3760abe5ca7e8336
SHA512 ddd23f00e6121ff7496ec85698227d4203884eb16c3c47b1615c7ec6b0243f611b5c659cb942a3a860556a96640e937a4647820efa3d9af98d46ba37111db6c8
SSDEEP 384:ndiFejccCs+Bt0S3ktsNcb8TUNTUlI4KZTPHF72Owf3YQA+I+xsbSBF3+frN1k+s:UFIccQazbwgpJ7GY/+dGbSGL9w
TLSH
T170D23936E8A4CDB7FDE78FDAB31A76479EE01167968819D4D9C81E5C00872DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f85032587127811b3377b19579d8e5481b9b936448561b542bd60c79f828f32a
MD5 09ae86f6118d4ffd3af6059a30f66a00
SHA1 2a6965f351939ded0008b7e20831799fc2dfabab
SHA512 e159a54a72978690cc585890363a2dd7755db2bbbdd06f177d174f59c48cfe40b705562daa0d2d424340a5306b47cea332449e947e192e60410a9106d0f7e1d2
TLSH
T1B4E00213E35104F3C10D033100D71341B2F3D63003D3530D9C53057028413060D74D04
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe590611.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe590611.TMP
Size 392B
SHA256 c16f4e76846e27f6c1ac1bf6c35b36353843dd866ddb01b2c87c25d48fbe90fc
MD5 096e131671e0d6814e5c3dfd60c82bf1
SHA1 cd22aab6f8d2d38833a0159a1c99cce334cf56db
SHA512 ca1a30335ff2e2ec90783046b233085ad159651bb0e844637822c1047b3c73c654728726142df19f9b96dbddccdfa2d22c65e03c5ef3c175254bc3e5272a17c0
TLSH
T1E8E00411F3510453C105033100D71340F3F1D71003D3530DD45305703C413070D54504
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5ce0018f8ce95fbd156a197b152160b15269562b8496b10a485377d16a487191
MD5 c843856bb05a3d8f80b18405b0661eb9
SHA1 de3d93da9bc1815073fd37079754fa00ff159afd
SHA512 28788cafbbea09ddb5fbcf4a7bc4805766df23245ce886eeae2234c0bfe6e4c981924d1a6ec285bff7f1bd5913eab58ea7615f277df60cf6e0307181633581c3
TLSH
T112412B58BAE91148B3B77F56AFF2685E48BB79772E06D55D00010E4F0623E41CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_asyncio.pyd
Size 70KB
SHA256 adaaf0c703641f6dbed30d101a5e23c17cc9454c36303394b9e28a52ea457471
MD5 0693819137d5c98bfae7f06b0d76a8f9
SHA1 d9d92845f0f41a600e3967a1fd05ca69f2147a34
SHA512 ab08c8fc551d96c5f5cfa81b72f2ef8256c852c676cfb2c60a93f06dbfd07577679ddd0cc3356092ac91412e6442572f8af92cc467c4cde0475c4cbb918ae4d2
SSDEEP 1536:wCY0h2ZouTTuqsHQH79Iyvnuyrcz895fIiJ:wCD2rnuqsHG79IyvnKRy
TLSH
T1D3638E87A2A44247DA97B274C5736F56FBB0F6521902534F61E8C28E2F13791C3FE622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_bz2.pyd
Size 83KB
SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
MD5 ed9f4c1cf33db08cac3c7ba7a973e61b
SHA1 b0db47ca7be3df00d1585fdabe13fb983cfed04d
SHA512 dc5f79944f9acf910d4af892d8a7c2368d2de29bf8ade2feecb056b2b3416d55bd22aacd16a7dc4488c4a1a5682409430f6f210e7396af4f14fd5f307ba1926c
SSDEEP 1536:OZ5Az7KPZG1uDiYhGlHjecH7rYiUO18aBso6lIyLVryrcz89SfIie:mWzdMiYQzrAO6aCo6lIyLV1cZ
TLSH
T115839E82F39967F2F49B81B546C10757F770BA51075093AFF288C2952F03B91AE6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_cffi_backend.cp313-win_amd64.pyd
Size 175KB
SHA256 0e3d149b91fc7dc3367ab94620a5e13af6e419f423b31d4800c381468cb8ad85
MD5 5cba92e7c00d09a55f5cbadc8d16cd26
SHA1 0300c6b62cd9db98562fdd3de32096ab194da4c8
SHA512 7ab432c8774a10f04ddd061b57d07eba96481b5bb8c663c6ade500d224c6061bc15d17c74da20a7c3cec8bbf6453404d553ebab22d37d67f9b163d7a15cf1ded
SSDEEP 3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
TLSH
T178045B56329C11B2D692517889275B57E3B3B47013419BCF01A4C3B62F2BBE2BA7FB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_ctypes.pyd
Size 129KB
SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
MD5 ab19e3dd4731ed075589abadcde68991
SHA1 b51ed4059d7d0ec7cbd5b34767e310bdee9cb4d4
SHA512 6aa9cb0e5cc9514d71bf7a2ab21d24a3fd5ef0eb0f0e7bf26a4a807914c7a3cadf73e1bd6cdd9f31d8594b72272eaccc79632f9dfd9534da5c8217d0eb0e9cda
SSDEEP 3072:oNxNJni/7u3vSKflXTf/FIBIQ0Jr3rc1mAj5IyyPhnIH:a7ni/7IvBjf/FIWQ2r3I1mqvH
TLSH
T115D38D0B775800AADAA79178C573AF47DBF1B453161187CF02A4C69A2F637936E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_decimal.pyd
Size 273KB
SHA256 90045140e45edcfe4f4859b3190184faff1249220011330a9d01319745766607
MD5 90071379b9e53b2d1834d49f4fd804ec
SHA1 c4cde25cff9cbf90c55bf908bdaa8a14a82311ad
SHA512 a67feade76fda58faa8a9842f6a07d8b12eb477c5baaf51f323de90fdcc8c5f62f2a756f30e1ea494b95eaaededbbe95f2aaf6659175e6e141057af0aac6f514
SSDEEP 6144:nkzuKqPj7/lk9VLCLko0Xoy9qWM53pLW1AyH3V+METaei6g:nxLlk9VmLko0Y7ePXV
TLSH
T127546C97A2090CA4EA738474D95B9B47F7F278960321C78F43A48AA73F93393636D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_elementtree.pyd
Size 133KB
SHA256 6fcc5528ce81f4514fb11cc7248080fd335a3c60d898e845d3341ee589887da1
MD5 a52f49f8fc408a15e0717c1d7bd1c803
SHA1 45b8ffa6f2e04494c274cb2fb176af60091b1092
SHA512 fb2a5d88f43b2370681de2e46042e7568ccb503568473ceec1c993e9e936b275ee3b4ab968a12740e567604d2490b252104c8a9aa079644ff935693ec8afc745
SSDEEP 3072:Xn4rCCrToRaQi3+al3fJ5LaYLZbpO0brsHL8nf4QWTVIyzf1i1Yic:Xn4r3rToR79al3fJNjbIIf4QWTzh
TLSH
T103D35B4B7165C06BE0A35038D2678F56DBB6F9A20E0087DF2284F29D9F373913E69715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_hashlib.pyd
Size 68KB
SHA256 1430e4a2ed19eda840668a292c39ff44488b598f53e903a61739a86b779ecbfe
MD5 9ec1021fa8a3c252e1f805ac7f172753
SHA1 773a3069dfb3711cb6f07c1c4dbfbab8b7c779d1
SHA512 0940c59f5c1c4afe5457d16aa5053aa7e27de1ac2748de5a0614ec01d630f76d75a86159260a6c53209d098da16d50fa0c4ee3427c04a38180fe9eccc4e6b034
SSDEEP 1536:R46Ee9w2oW/Sd9/LOJu0PuaY9IyvIWyrcz89RfIZRVjE:RdEIoRF0PuaY9IyvIS3ZjE
TLSH
T157637D95AA884091D92382B5C8E34F43FEB4F25217119BDFA3A8C18D2F237C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_lzma.pyd
Size 156KB
SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
MD5 d165b7b9a127f66704ceaa196be319e5
SHA1 ee3de55b32d1357599cef86df35e307477038a15
SHA512 b99214ce14899656f9c0fd23b219d06de383aff95b344def145a9304c47e41b1645bd3544f4fb83ac070d42951de228873a99feb98948910fdd0e7fcc54a3122
SSDEEP 3072:r0Vfr5vC9v2J2dE2AowznfB9mNouhD28ztJLlIy01nF7qV:rSr5YBW5YOufpJL49y
TLSH
T142F35C86B794F0E6F7728C38D6624F57E7F5781A0310929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_multiprocessing.pyd
Size 36KB
SHA256 7b21c5b0ebee82b0d85724f245857d65e23f82c6aaf392efcd4f800462025d92
MD5 25fc0102fdb08c54e6bd72c0b11b1a4c
SHA1 2dc0d9a3bbcfef184699c147ac2cfa2fcb40a7b8
SHA512 89640ff838030ca75309184bcf1ad58a8ad3a917564a4185675bc7494630bbfc5b821dfab53081b5a786553aae89958b057c369b4d56af12ccb0fcea983e3d03
SSDEEP 768:L+hu80ZnR2VcZ7Dz2dtIyntAXyrcEOJh2Ip4i6Cxf1mlY6Ce:Khu80Yu7Dz2dtIyntSyrcz89WfIie
TLSH
T122F28D4AA6684053E963A671C5A3DF8AF538F7831B21864F7195D2CD1E33381A36E34E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_overlapped.pyd
Size 56KB
SHA256 fae5e0e822434da7b1707b9ae4c77b8fa7d1d7b810e7e2f5cacf04449c714086
MD5 4a721637bc0c8b53d13485f5030da7b5
SHA1 7424dde1d136649e68b1f13cd0e738a1d428393a
SHA512 fff4270fd6d759d31ae6784510208ab4d2eb0b454799d393f4d2155a6dad9c8b836233eb3d233002491019bbeba87e9e862c8eee608a51a0f83194a9a5110e13
SSDEEP 1536:dMm7HdS/l5atPzKAdE+DRIyWt9yrcz89WzfIW44zvrdn:ThBzVdEeRIyWtnaW4IDR
TLSH
T1C1437C496B9400DAED63C1B9D5A38E47FB78B3D34601531F61A8D24E1F73392B72E289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_queue.pyd
Size 33KB
SHA256 08050f94efe7bdd9d7cbe85b1196de391cac1b30f4a4918610cb174ae529a5db
MD5 8fc4810cff733e6f17a7530d3fb67d58
SHA1 20163031892c87a67169f4ae25115e4e33845626
SHA512 c45ebdb450f30d034ba113729ada2a006baa2ad8c7a83cc59ee55e6fd10511d6f663b1d7f24fbcd493884a84cbedd1368e3a2136ff7da58fb47394147b021f45
SSDEEP 768:BFJpl1r6rWcgds5Iy9UxLXyrcEOJh2Ip48XlCxf1ml0ZMz7:BDr8Wcgds5Iy9Uxyrcz89ayfIbz7
TLSH
T10AF28ECAAA684047D663C671C1E7EF42F974F7D34A11879F2169828E1F23381F726329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_socket.pyd
Size 84KB
SHA256 c63e8e6a369cbe86e57c9823fb48bc5d4e7bb18455b9b001986b4768c49007da
MD5 c2938dbdcdaba1ccbefee37f6a06cd0c
SHA1 944cb024144f327ba517ccf72af9bb9a79b8b23e
SHA512 79e9f40665b7049c9feb04742a91c8c88749c1998794f1a51ac7b47a5f5ac3c1a2b441dcb9cd126e395581d9553305c24356b54d81d0a9fbecb41a4341af776f
SSDEEP 1536:axl/h+6SDo3OkB+ecI4xyJwoQlyJ+9+nzpjTOKxtS44O05IyywFyrcz89jfIW44a:axko35X4yJwoQlyJs+nzlqKxBw5IyywZ
TLSH
T154836B10A69041FAEB63D1B5C2639E63FBB4B5C11391A35F0066C55A1F333C2BF7AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_ssl.pyd
Size 177KB
SHA256 11572f6eb63e43cdc2908812506ffcdab21be2be5931f1e38d856c15f5a79e6c
MD5 893ee1e905ec5a1f74b10d73a8b94e6a
SHA1 23d6eb756eb48c1632b02a24f53aacf71bdfa409
SHA512 237c9b37f4b44ae37726f3fef750f6eda65b9d8a540f386c5a43e1bcef400dfed0f9f37f2dc4042fe0c4fec0ed9aeb700797396bae2e5f052525851760288b61
SSDEEP 3072:/TzN6X1nguzjfD6C3xPsMn6osf87vOifHZHmzislIyL7rXH:/TzgX5gID6C3mMn+2s/
TLSH
T12B047C47B5842AF7D813E4B9C2234903EBB1F155331257DE48D6EA490F03746AEAAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_uuid.pyd
Size 27KB
SHA256 6a3e6d89e71a803609e6e765a592011427a5b6e7a4766bbca7790b601bb66dbe
MD5 8cdd2cc12be9491bf150e366e81217be
SHA1 6567dba49c9bac718a1badb504fe83b1d3755c66
SHA512 c573f46295699a7314dde633b04e331f292aeafb36f813055144c95f24bc386ce23704980e3cb6a491d4a05e207cf2517526fd0c602b53cf514a7c2b8d27a338
SSDEEP 768:sty+WlIy0wvXyrcEOJh2Ip4B3Cxf1mlPr50BP:sty+WlIy0w/yrcz89BofIT5+P
TLSH
T1FAC25B899A648043FA539B70D1A2DE83FE7DBBD35A90869B316991850E133C2F31736D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\_wmi.pyd
Size 39KB
SHA256 a7cc096244a497219269a3ee1cf2526a2b613d73fa566749f8f2408f5f4117d4
MD5 609206d81f38626f1c022d1a0ff1466b
SHA1 cef724eceae7995d425c169912e292ac43572ed7
SHA512 e973f30ee976b580913f3a5c2d762364897054f958fb26236eeccd17832cce0bfa1bc04c0981d221c0536f5c9b1d21551ec12a873cbae64fc6b50634dc9d0166
SSDEEP 768:ZEpKg2a5YDQy1ZuNccibJlIyLiMXyrcEOJh2Ip47YCxf1mlPrY0Bb:ZEkg2KY3UNccitlIyLiWyrcz891fITYW
TLSH
T16C038D89E7644052E663DB75C9A2DE43F875B7D35B11938F326482980F233C1E73A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\base_library.zip
Size 1.3MB
SHA256 b452ad810fabb6ea013518126355ccb14278df9f30ddd664069ce789eb1059c1
MD5 157683410eddb901d92923b5bb2cc824
SHA1 0a27ee9beb16322eea4578b8861f4421d1b09c0e
SHA512 bcba2286dfaaec3b60ddbe5164705e4c97fb24cc5c0ab46b51d88e9897e17931a7d068abd4fc01d50a5e53d4c41d08eee39b39b2fce669faa7fd55b0982d243d
SSDEEP 12288:e6CdjdTmuOBa80201jwCVRDVoioSYB7PtYzGNcT1QMyCMWfKUqwt3i2cPPdxhYA0:gdZmzuSeT1hqE5cPPdxhYg7Wpwq8i
TLSH
T118551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClrLoader.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\clr_loader\ffi\dlls\amd64\ClrLoader.dll
Size 8KB
SHA256 9eb57d53c8e0a75fa59abfff0eee2b06cef24f0135162afe62f7c0e63b16d9ed
MD5 f594879ff24a7fccab25ba55ca39a0c6
SHA1 8600256ccaf105103c67ee9b1ed7172372c5da36
SHA512 ab2612552b19385752bccdc27bc3c8895c5ddf8f8d8c14d55953afda37b9efe4c65884de62f747c0ac59d5b6f2f5ecec5928a36fba091e913d9493fae8c47819
SSDEEP 96:sUKGbwe+zfHRQVaU6KWJS/OnUPfmOGUiLlg21O8ftdiMnSX5UByUEofTdUUX:suFafHRKfXmgUxft1nSpmt
TLSH
T1ED02F807E7E88B22D8F74B7CAD73934443B5FB616A51EB1F5C81508E6C533449AB0B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\index.html
Size 44KB
SHA256 a48fa952deb44a04cbb3a36f560b96f6e63ba1e71e7452d03f9f0ccf1ba53ac2
MD5 8797216f641fb96475e5ae68dc9a0a88
SHA1 c08eaccf6058bc441ef94c8cae87b8030a230c9a
SHA512 bbfafc68e3f4b57e1f39215da13fe9c4065eefbb2f4978453cb3033ce0a987ced2907168de747b57aa5117eb8aceec364817193d2f4f344d1ef0245929306067
SSDEEP 384:o7DHxgRHRvJVB1eFq94R0Bk6ar4B+Z1iKEAEZEvNUxWueYdm:o7DHx2RBNBBktY+rCTqvyxNM
TLSH
T16F13FE2665F220625153D1E62B734B1F7BA0E507C50BCA083AED97D88FCBEC5CCA7258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\pyexpat.pyd
Size 199KB
SHA256 567f19a92479e66b652ffaadbddba26b7c5dda43d5e97c67a4a76a076021b736
MD5 feb79984518146b9703d3913d54f2106
SHA1 6a4eb8d7e593f008308f05bf26f7caf7d76a1716
SHA512 4b5a67c38aa149cde71ccc1171cd55af8a12a66d514f63fb543005d9ee8f19226f839d28782187a0e46e0f205e3307e4e0739e1b2bd64c0e99e0af794c1836e8
SSDEEP 6144:xS4jcle1bq6XFdTW4yxB+LjrKHP1XcPump:Fclaq6wT1Xaump
TLSH
T143145C4BB1A6C0EBD8538038E6978B07DAB1B965039097DF22D4E77D9F2B7413B28315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\python313.dll
Size 5.8MB
SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
MD5 5acd4d4f35e13ef79c883ace05c4eaf5
SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
TLSH
T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Python.Runtime.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\pythonnet\runtime\Python.Runtime.dll
Size 439KB
SHA256 d204ad74dc18cd07320c8e665bd32ec6549b555ce97e61e4d3cf88437a64988e
MD5 78ce21de5b188fca28ec79febfd1ffbd
SHA1 0dada9b4e0def50e91993b626b26ba25550e8e51
SHA512 b952a3649bd801371e0fe387edbf68dc6c3150d4a29fb4cc566800121361d7ae7de36e34884f78d20f35a52d553a592470ddeda9fc1c4f7f68e82d424260e650
SSDEEP 12288:JbxqPcP0ccwfaMaTWSkSU8Z3yKq6x6VvMsh:aPc+wfaMaTWSkSU8Zvq2QvM
TLSH
T1F9A43B1063E48A7AF7AD663AB430483F4BF7F0775963E3999A44E0E52D027859A107F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\select.pyd
Size 32KB
SHA256 d1e486de9653640be7c3a9bed04aa716b29ea76a69e1de758dd9fa708f2c9d38
MD5 e5728d041bfb1841fc460db4027a2952
SHA1 71e6aaa90e905a72ac83450796af4fb2bb3503d7
SHA512 a53efe3872b035445b7d66a71dffb690cfd00ff6296af25d0dbdfe92c904a8d06442c91e9638b2d5e54420f6998220d65f39b35ef3c1a87e812e9deea1967ab9
SSDEEP 768:hCOFHfRme5Iy9GKXyrcEOJh2Ip4SBITxf1mlDeI6QKF:hCOF/Rme5Iy9GEyrcz89+0fIUQ+
TLSH
T191E27D8AAB245047F9A2C97185B6DF43F939B7A34B11829F30A5D2990F137C1F73A394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\unicodedata.pyd
Size 695KB
SHA256 e7d0375a7064b1c8916cca7cabf7e3df559fc8463dfdf831f403e95c79499121
MD5 0a3be15d03e1c55c4df0c7e4fa4005bd
SHA1 a8b30adb77dccd9b7bdc1ec3b1800127e586e3f6
SHA512 2a408d178dd0261dfeccfb791fe05a40caedc64b7ad6cd543fafd31d1e676721240020ad43f26cd8adf94a8c3e68522fc96ebb0f987fe0ba15b9287aac1242b2
SSDEEP 12288:aYgdLI/X77mvfldCKGihH32W3cnPSqrUgu+f:aYgW7qNxr3cnPXu+f
TLSH
T11FE4F6D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\webview\lib\Microsoft.Web.WebView2.Core.dll
Size 589KB
SHA256 cb8c852fcc4ef55d630b64d171dc11538bb25258041ed22cf31735982a2e09e3
MD5 c334bf0e13293444c1abe63572578fff
SHA1 abf40cdab606064cadab4b3d255c5d2f7a96ada6
SHA512 07c0e4cb501daf2461ae5cba0ca5a429748fff6028903a9ad760f402425089cec82d12ac79c329a9b2deadc1fda67eab5da43d91b0d958bdc31290b00be61a1a
SSDEEP 12288:hR6yRjrpQ322fy+uFKcDmuRFNEMzeu+imQ269pRFZNIEJdIEY0lxEIPrEIgcvLcp:Oga
TLSH
T1E8D45F2227FD865AF5F27BB5A57802308BFBFC96B979E35D05A8141C0D72B4099A0733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.WinForms.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34122\webview\lib\Microsoft.Web.WebView2.WinForms.dll
Size 38KB
SHA256 e62056bee28ab094071144b47371009a6fbc162f9aea184719f2e86ed515f7f8
MD5 a934654c9f25d855091fe5b970f8e95d
SHA1 77fb3e762f51d41ed8287470308ac7fa985979a8
SHA512 a45bf9a47092a4bf1c89c938d3c972c7d8e4717470195dabf3491c96ae6de3132e1496bd22e333784cace77c4da37dac220a1f18fe93fb3119f0dd98d4e8b6d7
SSDEEP 768:ElN2oOMtBtKljdCyXKGc2QYZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSf:Q2oOrsItc2QYZDgcEST3p4JjrjaeFSUV
TLSH
T1FF034B0082ECC517EAEB6FB8A9B482610BBA7EC37E60D3591D88B1D90C737D1561477B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 10a7471e2112aa1703841065e4f30da9f98dbf13e5b4836749f78e3f7ff2f154
MD5 7414e685c25e02a7de939bdf45a68ea6
SHA1 e526b80896bd30b650098ce5ac6e2d5fb6abbbb8
SHA512 5f0d774f12bcd4cb14bdad22ebb670ee7095548475beaa494a37bb854240cd5cd8f6421f61813223facd934d565df0ae444f8633c27b22a00caa65ac1019eebb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 905c33259cb9d9b855cbd430e4a75b027f7cb3e352d900140e2dbc707c913a4a
MD5 48a5d898b5462e28e8c07bbe0dea964b
SHA1 54f3938b4902bacad7db0ec74cd33cb6ff3b88fa
SHA512 f89118ab0afeb3ddc832ba9dc20423db4ded611224bd938fe28bc5b9cb9d50747465d0636fd95c6bd3c06dc8d943e8c2363f065dd3122e52c2a61960118ac79b
TLSH
T128D0121332420E34C02421730002A1090641DA0F814D41006428E61D5B280501A12491
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView\Local State
Size 1KB
SHA256 baa23b31c75ab3601d7393b5811ba101749be047c963a2f94cc6fe2235ee52da
MD5 e1c3a99a89fa689cb39a8178eff5906c
SHA1 c75e340ae4ecc258dd69a9d096751067c80dc5e1
SHA512 8d2036734a117a7766210223e483fcf324230ebfddfa9b296a47adfdc577f8247a66df820fcbed63567e57df0d97693b768ca010f7bf62ffd42be67d52a946da
TLSH
T10A3115B3BC941F3269925642714A6F7B2E36206AC2514EC496EE5B1C02D76CC963FC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView\Local State
Size 2KB
SHA256 747d7052c6532283abfe0ee9174fb70d12b5011429baf4c2e2cd3edf1d75cefc
MD5 d2ba1ac44032ad8531cdb31303c37f2e
SHA1 0f9514bb76ccf339255c17b56f566c63dd8542ad
SHA512 5a5c8bcf5b11bcc2365db81f2b0339ad155a61e6a8bfb20495f91edd9335ff20c176e242cbef1b0b30fedead121abee6780d7c69f6c09726e455ba741c10e95c
TLSH
T1A25174737C145E3749E35A05754A2F36AE3A6165CA921FD08AEE1B1C01CBA9C2357C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView\Local State
Size 3KB
SHA256 3dbd6ee206e1e4d2665070a5b919ce455a5e86b1e1694018f965beb2bb78a3fc
MD5 f041af43f45db2398773f9e799f7f16b
SHA1 57522bba5184e9d112c8dbeb61261d468edf84b8
SHA512 f93222699dc054aaba724bca6c87012816f179e618be57350082d1bb6fe0339233d1acb1ae541d52b94411ba990ee56ab0c4d762270876109e16239a3f259397
TLSH
T1627173377D649A274EF39A01B88A2F26BA692127D5952FD5CAED0F1C01CB7881353C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView\Local State
Size 16KB
SHA256 2dca7ce2d3c40f0d7c5ec7f33a9732fd9186d790fe3b72dd73407b5513b4cc47
MD5 42a7fb5c5529b87a78f3730d46b1af1e
SHA1 775d1b0994d97bb12c9e9ae8ecb618794e6338b9
SHA512 8f2754c10258273c5f27d65974c0aae1d79d3a5a9f6eb7a0ecb00078c5b3adcaf5b360e7319f5bcd0ed65809b98a16e15f396fff2529f2a29fec5f26c8ee3e1f
SSDEEP 384:z9fRE5BdEZfr0kuh9Rt/nP9y/3NbUP4C2NBNu5Qh:9RkurqhNs/kb+BGQh
TLSH
T1D3729E735D3099276CF7820B390A2B06A9BC905996D62FD4A8DE2F1D06C7BD91353D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe592e59.TMP

Path C:\Users\Admin\AppData\Local\Temp\tmpci1jchho\EBWebView\Local State~RFe592e59.TMP
Size 1KB
SHA256 dedfa4a0bb284d5fbcbc1a92a569d981ffe396da56bed174645f2e153efe86f3
MD5 70b3af58b6c117d43adac02630ee244d
SHA1 f73fa3eec9f62ffc62354d955e6e4a6f0050a583
SHA512 490bd003b1cf902df4322afa95149dd9a3024d97bfb1b2d7721104b66e3b893b1c23d519564879a2cd7166335e112ab68f9dc5481375b7fa03731ed60800155f
TLSH
T1BE211073EC941F31A9915502B14A6F6B2E65606AC6518F8896EE172C12CBACC963FC33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 14eacde19f4140112125263b19301f02d70c227d4117d26af3662000cbf7f007
MD5 4f47db96025b901ec22ec982ab2c2df5
SHA1 64ea34b7e78ce08701c7a7729f6c8358366bc5f6
SHA512 54cc2372ea66b2bc7fef3d11dc2e361f40b7f6eb856ece8bdaa4b7dd8ee124d066e1b51e9b76b7516a08fac6875c8b3c4958d81317933a332797604b2667c657
TLSH
T1CAD012323301013CC05024330052618D0400D10B50054341A42D892D1F840901E06451
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Default\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 bb581314ffd932f5dcc47fc8d6968eb1eb7c2e4e5396ec0c3a4f6ab13e95ed09
MD5 9609e5da4e1f0c5b239facb54185f62c
SHA1 a1fe6e1ca75361c9c2b805d7fb94015d0b46ad48
SHA512 0492047e983c4648f91961198694340385a42df4dd57e808a71626c6f0e420ff1ef7a53c6dc9d6c2f61b5b893cf3a7b389fbd4cca331329a9214527352008d67
SSDEEP 3:MsEllllkEthXllkl2zEklFrC:/M/xT02znZ
TLSH
T1C3440404FFC17445C51034304111C7500374D41005535F4334D10413DDCD5401C00110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5912e2.TMP

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Default\Network\Network Persistent State~RFe5912e2.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Default\Preferences
Size 5KB
SHA256 b10fce348ad184ca54c7c86961b71286b2f664003514d4722431643a0ac01cdd
MD5 7e75400cbd04f22a37c93a0314a65dad
SHA1 ccfc55d3ba590b4296d6c4baf6b3a7f7baac1493
SHA512 e1b39c50b89f4d0804d3d24f3659e37b4e51c550705284529c2ab39b67b6df3a10455c158c364875506c3e1b2a81f7f5ca5beffdd4f26775889bd25e04f4bf0e
SSDEEP 96:stf5E+/8HXb9bVaW8i0vhE7klm/7qx+WVHMSm+uecadQjn+ghuwbMsB:stfO5l8W8pah/S+Wi8dyuwbME
TLSH
T168C1A9536E2869774CC7F21A79357B53E2F6206262D50E98ABFC871C08D66CC5307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58fbc0.TMP

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Default\Preferences~RFe58fbc0.TMP
Size 5KB
SHA256 712441f9fcf34bb63cc234eed4deef8b37890ed3203c4f2ad480ae0603f23973
MD5 4b8bc9e6e91038cff1aa61af614b7c83
SHA1 54088eb6c0c960a5700dbcfc7bd314db9580ab4e
SHA512 d7006b1a9b9e242d5c6cb5c66870301c629c6caf47b1f11043c218c5d838452eaf87ddf6226dc01bc1ef7a4a6622924b5ff1d02c5e89811cf6d722c9f239df62
SSDEEP 96:stf5E+/8HXb9dVaW8i0vhE7klm/7qx+WVHMSm+uecadQjn+gCMOB:stfO5X8W8pah/S+Wi8dycMC
TLSH
T1C4C197536E2869774CC7E21A7E357B53D1F6202262D50E98AFFC461C08DA6CC5207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Local State
Size 1KB
SHA256 53dc01eabb7b6d1e8c3d1444dde74531ddc48d4986b07724789d78cfd96b8542
MD5 ce26a663f3367b9f4d839eb50f72834f
SHA1 50213358b4e489ee358b04b1d1c437659a005c85
SHA512 71813e58ccdf2b16316d715a3391033e2287f368ae4795e4fad01df045f1c4ae187eaaaabf1971c622dba8f69a6f57a4d401e63ec6e2e838fd151324d8caa3d0
TLSH
T148314277F5A416765982660232077F672E302079C2568F88A5FF071C01E77DCB52BD32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Local State
Size 2KB
SHA256 b4b16b5293ad0f54fede581e0cb628169b93946c3cc64a48c8b4561fb5659f70
MD5 539fc5cbae637b952566df3fc9e8bf8e
SHA1 a57c4f0c7524646f0998f92ee7fabdd008d9b395
SHA512 21d5f2ee2787be178734da7f143badbf8837e1489d5ee425c589a2e50a898e932b24f49dbe28fa515db53b60e7d9362e5105e6ec1cdf6ffd689acad3141702ee
TLSH
T157518373B85496778AE35A0579463F23AE3561A5D7962FA09AEE1B1C00DB7DC3303C22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Local State
Size 16KB
SHA256 3afa2972424c46983bba23f9d315395c98a57774e26cce05d5d5772ffe9989f6
MD5 03b03c456fad6f380a2b7d22eec780af
SHA1 3af9d59351aab331c15a0c73dd32f0c1dfbb6627
SHA512 5feb75bc64c77e6d6718c0bd2c9d0930770eaa653bb35c6d157de5e9d53b5614a24a0e11c46d9108b3b90821fb7d0736d15d51b05e2e9a01f4125783f4d8bd70
SSDEEP 384:zAfRE5BdEZfr0kuh9Rt/nP9yxNbOSb7GuUaQl:ARkurqhNsl3xQl
TLSH
T11172AF735A3198375CE7860A38066F07A9B8909996D62A98BCDE2F1C06D3BD91353D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Local State
Size 3KB
SHA256 eeda5cac56534349971a5a3bebe160448bad28445bee619afbadf676b1348266
MD5 da714325cf774303580154bf34216a81
SHA1 2c02c251e3e2181bcea97bd35d899ef6c82f2dfc
SHA512 a840966cc114bb23a365bd0a4334ea4f0b08e6df271fbc4b787af77fcd4d55cf8bbccbbafc373cdb4e3d315340b02875ffbe73a09d77ed94b892e58388795523
TLSH
T1DB71853779A4A5374EE39A0178863B277A752136D6953FA4DAFE0F1C01D73D82342C12
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Local State
Size 16KB
SHA256 ca20a2d6ade2a9b184eec30edaf0b9fbff2283395c1bd7de969537b55870a37c
MD5 f3e2fbcb9099d3a886cd74493295d74a
SHA1 861cd68a7a0658f8275e953ab47b02caf1e75daa
SHA512 bd8ecedb45e0bd398082d80a9c280616706d067a33e52480a084c434af837d6c27574d3e9f3e5d8cf4cba211586e27689f885a974117a73c810c933dad11778a
SSDEEP 384:zKfRE5BdEZfr0kuh9Rt/nP9ym3NbmQb72buUaQl:GRkurqhNsmZ3HQl
TLSH
T132729E73593198375CE7860A38066F07A9B89049D6D61B98B8EE6F1C06C7BD91353D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Local State
Size 16KB
SHA256 3b8f0bd42f7affbb4d192d2b04b5979943ee2769da427fa84ec31b6ddecbe566
MD5 fa765b900d955e99f255c38f65c7ed8c
SHA1 fef523120b3f0b17a5a82eb515f770bdc1bd2c18
SHA512 bf5fc13f207fe2946aae0c9ea87e85d3dab587a7b18a2f9f18339469d3ccd1cd09ff8ec9e03bd95416e5f2c88075fc677cb39145785201051243d718da39754f
SSDEEP 384:zXfRE5BdEZfr0kuh9Rt/nP9y8NbkSb7GuUaQl:DRkurqhNsm3xQl
TLSH
T18772AF735A3198375CE7850638066B07A9B8904DD6D62B98BCEE6F1C06C7BD91353D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587059.TMP

Path C:\Users\Admin\AppData\Local\Temp\tmplzt24u6w\EBWebView\Local State~RFe587059.TMP
Size 1KB
SHA256 f99ed3cb5a9c38c993824a88acf77550c888224c49c11ce92571aa3d6573cc2b
MD5 2e7d406003d3c211e71756d023dfe23f
SHA1 a81adcdf164ccc1d82872614829ae1679ddc6a92
SHA512 c3a0c0912d0652d0eadd22f88dd5aee980b8222f31ba3697a1f7509945b8a79c7ec4d4b7a55b29dfb34f48eb6bc9e6e324474d7a5e0d394969b41c64024baea3
TLSH
T145214077E4A81676598259127203BF572E7025B9C21A8F58E5FF031C01E7AECA62BC32
MD5 SHA1 SHA512 TLSH

Submit Download

Kiddions Menu.zip.crdownload

Path C:\Users\Admin\Downloads\Kiddions Menu.zip.crdownload
Size 11.6MB
SHA256 f33320614ef26be5019ea778c20dcf227ea47460129267afc8f713ce5d30b89c
MD5 f7d2b593a37b8dbd07c6527b4139ccd6
SHA1 ce30a1c8da59090aad12cb2e871789ba6dfc432e
SHA512 3e7eb0e0a847250bc876c61c9451b8f39b864a365561bf69a535ec1a3e26001489f7d14aee5a795bad0797bf6d2f9329713fd5180b58598b6391140e91ded53a
SSDEEP 196608:NHGo3Zd6ZD1YtRRf5xvKgybWcuDWIr4OjW8HG+zfsMD+zBBfi4hbKMeP49NMcPMQ:NPd6m95BTybZuKdqnffYBBfC9w91MXur
TLSH
T16AC6331C7A9686FCE272E75FC92DCC74122D8B0331CB4624950B965434B49BF26FA8DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-1449-0x000001CB5AF90000-0x000001CB5AFCB000-memory.dmp

Download

memory/116-1448-0x000001CB5AF60000-0x000001CB5AF87000-memory.dmp

Download

memory/116-1447-0x000001CB530A0000-0x000001CB530AC000-memory.dmp

Download

memory/116-1446-0x000001CB53060000-0x000001CB5308C000-memory.dmp

Download

memory/1716-1075-0x000001F3DC070000-0x000001F3DC097000-memory.dmp

Download

memory/1716-1074-0x000001F3D17D0000-0x000001F3D17DC000-memory.dmp

Download

memory/1716-504-0x000001F3D17D0000-0x000001F3D17DC000-memory.dmp

Download

memory/1716-503-0x000001F3D17A0000-0x000001F3D17CC000-memory.dmp

Download

memory/1716-506-0x000001F3DC0A0000-0x000001F3DC0DB000-memory.dmp

Download

memory/1716-505-0x000001F3DC070000-0x000001F3DC097000-memory.dmp

Download

memory/1716-1076-0x000001F3DC0A0000-0x000001F3DC0DB000-memory.dmp

Download

memory/1716-1073-0x000001F3D17A0000-0x000001F3D17CC000-memory.dmp

Download

memory/2036-1445-0x000002600B610000-0x000002600B640000-memory.dmp

Download

memory/2340-212-0x0000026233200000-0x0000026233555000-memory.dmp

Download

memory/2340-211-0x0000026233200000-0x0000026233555000-memory.dmp

Download

memory/2540-1454-0x000001BE29690000-0x000001BE299E5000-memory.dmp

Download

memory/2540-1453-0x000001BE29690000-0x000001BE299E5000-memory.dmp

Download

memory/3412-1081-0x0000021883680000-0x00000218839D5000-memory.dmp

Download

memory/3412-500-0x0000021883680000-0x00000218839D5000-memory.dmp

Download

memory/4196-369-0x00007FFFB23A0000-0x00007FFFB23A1000-memory.dmp

Download

memory/4196-523-0x0000028D80DA0000-0x0000028D80DD0000-memory.dmp

Download

memory/4856-332-0x000001AA2EBA0000-0x000001AA2EBA8000-memory.dmp

Download

memory/4856-328-0x00007FFFA29F0000-0x00007FFFA29FA000-memory.dmp

Download

memory/4856-339-0x000001AA2EBE0000-0x000001AA2EBE8000-memory.dmp

Download

memory/4856-502-0x000001AA2EA40000-0x000001AA2EA4C000-memory.dmp

Download

memory/4856-337-0x000001AA2EBE0000-0x000001AA2EBE8000-memory.dmp

Download

memory/4856-336-0x000001AA2EBF0000-0x000001AA2EBF8000-memory.dmp

Download

memory/4856-335-0x000001AA47A80000-0x000001AA48024000-memory.dmp

Download

memory/4856-334-0x000001AA2ED80000-0x000001AA2EDA2000-memory.dmp

Download

memory/4856-333-0x000001AA2EBB0000-0x000001AA2EBB8000-memory.dmp

Download

memory/4856-1079-0x000001AA2CA50000-0x000001AA2CDA5000-memory.dmp

Download

memory/4856-331-0x000001AA2EBC0000-0x000001AA2EBDA000-memory.dmp

Download

memory/4856-330-0x000001AA2EC90000-0x000001AA2ED04000-memory.dmp

Download

memory/4856-327-0x000001AA2EA30000-0x000001AA2EA3A000-memory.dmp

Download

memory/4856-338-0x000001AA2EBE0000-0x000001AA2EBE8000-memory.dmp

Download

memory/4856-939-0x000001AA2CA50000-0x000001AA2CDA5000-memory.dmp

Download

memory/4856-1080-0x000001AA2EA40000-0x000001AA2EA4C000-memory.dmp

Download

memory/4856-501-0x000001AA2CA50000-0x000001AA2CDA5000-memory.dmp

Download

memory/4856-341-0x000001AA47670000-0x000001AA47708000-memory.dmp

Download

memory/4856-845-0x000001AA2CA50000-0x000001AA2CDA5000-memory.dmp

Download

memory/4856-345-0x000001AA2EDC0000-0x000001AA2EDC8000-memory.dmp

Download

memory/4856-343-0x000001AA2EBE0000-0x000001AA2EBEE000-memory.dmp

Download

memory/5332-1452-0x0000023000DF0000-0x0000023000DFC000-memory.dmp

Download

memory/5332-1451-0x000002307EDC0000-0x000002307F115000-memory.dmp

Download

memory/5332-1155-0x00007FFFA29F0000-0x00007FFFA29FA000-memory.dmp

Download

memory/5632-419-0x00007FFFB1BE0000-0x00007FFFB1BE1000-memory.dmp

Download

memory/5632-418-0x00007FFFB2260000-0x00007FFFB2261000-memory.dmp

Download

memory/6040-474-0x00007FFFB23A0000-0x00007FFFB23A1000-memory.dmp

Download