be2056c94439eeb49f54a2f1665079f4bc5f35b96ef6855b4abc90fef4d6b999

Resubmissions

18/07/2026, 16:06

260718-tkjq9aav8y7

18/07/2026, 15:59

260718-te38pse16p7

Analysis

user interaction
yes
max time kernel
390s
max time network
391s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OpenLauncher.exe
Size 17.6MB
Sample260718-te38pse16p
SHA256 be2056c94439eeb49f54a2f1665079f4bc5f35b96ef6855b4abc90fef4d6b999
MD5 93ce75508674176b6c12228e7c8a2146
SHA1 6e21e7af4dbf5f2c8608098e4a857dbffba8d810
SHA512 5c7ad3cf7ffebe369b5cd0868ffc17c7c377076c37ebe4d8cb44fd3537790560dc831c9c7c2a4032a627d2c013e8bcf2b9cd9edf71c8f9c02e0a6791dffca0e3
SSDEEP 393216:dRoKMFQXghMgIfUKOcSr6tZq5XO6ZIHsGEDweqOBUhb:rkDK58KPSr6tZq5Dyt7eJ
TLSH
T10F1733C8B7C80D65F497123C6AE68E13D2D1B13427618EEF17B206395FA33D18939BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
5376	java.exe
3868	java.exe
6864	java.exe
5732	java.exe
2348	java.exe
6900	java.exe

Loads dropped DLL 64 IoCs

pid	Process
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
1748	MsiExec.exe
5376	java.exe
5376	java.exe
5376	java.exe
5376	java.exe
5376	java.exe
5376	java.exe
5376	java.exe
5376	java.exe
3868	java.exe
3868	java.exe
3868	java.exe
3868	java.exe
3868	java.exe
3868	java.exe
3868	java.exe
3868	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe
6864	java.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_890430777\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1624871044\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1624871044\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B24.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b15b9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1943156683\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1175802756\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1175802756\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1175802756\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\Installer\e5b15b7.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1C3621CF3C873AF6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1943156683\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_890430777\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1624871044\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1175802756\LICENSE	msedge.exe
File created	C:\Windows\Installer\e5b15b7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI24F9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF05EE6BC0DA08E412.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1624871044\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9D450299-EAEA-400E-B520-B2F280B79DE4}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF67824896871B5169.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC6FB13DCBB80C442.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_474537786\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
856	msedge.exe
1532	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	java.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\	java.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	java.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Colors	OpenLauncher.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288640232288775"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 60 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	OpenLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	OpenLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	OpenLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Eclipse Adoptium.jarfile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	OpenLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Eclipse Adoptium.jarfile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	OpenLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	OpenLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	OpenLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	OpenLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	OpenLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	OpenLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	OpenLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.jar\ = "Eclipse Adoptium.jarfile"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.jar\Content Type = "application/java-archive"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	OpenLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	OpenLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	OpenLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Eclipse Adoptium.jarfile\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Eclipse Adoptium.jarfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Eclipse Adoptium\\jdk-21.0.11.10-hotspot\\bin\\javaw.exe\" -jar \"%1\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	OpenLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	OpenLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Eclipse Adoptium.jarfile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	OpenLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{215EE3D3-DDDF-45F4-95BA-D61A41953B9E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{57589C0F-1B4B-4814-BD04-5B56DEAE871B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	OpenLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	OpenLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.jar	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2788	msiexec.exe
2788	msiexec.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
2564	msedge.exe
2564	msedge.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3184	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4860	msiexec.exe
Token: SeSecurityPrivilege	2788	msiexec.exe
Token: SeCreateTokenPrivilege	4860	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4860	msiexec.exe
Token: SeLockMemoryPrivilege	4860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4860	msiexec.exe
Token: SeMachineAccountPrivilege	4860	msiexec.exe
Token: SeTcbPrivilege	4860	msiexec.exe
Token: SeSecurityPrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeLoadDriverPrivilege	4860	msiexec.exe
Token: SeSystemProfilePrivilege	4860	msiexec.exe
Token: SeSystemtimePrivilege	4860	msiexec.exe
Token: SeProfSingleProcessPrivilege	4860	msiexec.exe
Token: SeIncBasePriorityPrivilege	4860	msiexec.exe
Token: SeCreatePagefilePrivilege	4860	msiexec.exe
Token: SeCreatePermanentPrivilege	4860	msiexec.exe
Token: SeBackupPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeShutdownPrivilege	4860	msiexec.exe
Token: SeDebugPrivilege	4860	msiexec.exe
Token: SeAuditPrivilege	4860	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4860	msiexec.exe
Token: SeChangeNotifyPrivilege	4860	msiexec.exe
Token: SeRemoteShutdownPrivilege	4860	msiexec.exe
Token: SeUndockPrivilege	4860	msiexec.exe
Token: SeSyncAgentPrivilege	4860	msiexec.exe
Token: SeEnableDelegationPrivilege	4860	msiexec.exe
Token: SeManageVolumePrivilege	4860	msiexec.exe
Token: SeImpersonatePrivilege	4860	msiexec.exe
Token: SeCreateGlobalPrivilege	4860	msiexec.exe
Token: SeBackupPrivilege	2832	vssvc.exe
Token: SeRestorePrivilege	2832	vssvc.exe
Token: SeAuditPrivilege	2832	vssvc.exe
Token: SeBackupPrivilege	2788	msiexec.exe
Token: SeRestorePrivilege	2788	msiexec.exe
Token: SeRestorePrivilege	2788	msiexec.exe
Token: SeTakeOwnershipPrivilege	2788	msiexec.exe
Token: SeBackupPrivilege	964	srtasks.exe
Token: SeRestorePrivilege	964	srtasks.exe
Token: SeSecurityPrivilege	964	srtasks.exe
Token: SeTakeOwnershipPrivilege	964	srtasks.exe
Token: SeRestorePrivilege	2788	msiexec.exe
Token: SeTakeOwnershipPrivilege	2788	msiexec.exe
Token: SeBackupPrivilege	964	srtasks.exe
Token: SeRestorePrivilege	964	srtasks.exe
Token: SeSecurityPrivilege	964	srtasks.exe
Token: SeTakeOwnershipPrivilege	964	srtasks.exe
Token: SeRestorePrivilege	2788	msiexec.exe
Token: SeTakeOwnershipPrivilege	2788	msiexec.exe
Token: SeRestorePrivilege	2788	msiexec.exe
Token: SeTakeOwnershipPrivilege	2788	msiexec.exe
Token: SeRestorePrivilege	2788	msiexec.exe
Token: SeTakeOwnershipPrivilege	2788	msiexec.exe
Token: SeRestorePrivilege	2788	msiexec.exe
Token: SeTakeOwnershipPrivilege	2788	msiexec.exe
Token: SeRestorePrivilege	2788	msiexec.exe
Token: SeTakeOwnershipPrivilege	2788	msiexec.exe
Token: SeRestorePrivilege	2788	msiexec.exe
Token: SeTakeOwnershipPrivilege	2788	msiexec.exe
Token: SeRestorePrivilege	2788	msiexec.exe
Token: SeTakeOwnershipPrivilege	2788	msiexec.exe
Token: SeRestorePrivilege	2788	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
4860	msiexec.exe
2220	msedge.exe
4860	msiexec.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4332	OpenLauncher.exe
4860	msiexec.exe
2788	msiexec.exe
4332	OpenLauncher.exe
1748	MsiExec.exe
3184	taskmgr.exe
6864	java.exe
4332	OpenLauncher.exe
6900	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 4332	2668	OpenLauncher.exe	89
PID 4332 wrote to memory of 5488	4332	OpenLauncher.exe	93
PID 4332 wrote to memory of 5428	4332	OpenLauncher.exe	95
PID 4332 wrote to memory of 4468	4332	OpenLauncher.exe	97
PID 4332 wrote to memory of 2432	4332	OpenLauncher.exe	99
PID 4332 wrote to memory of 2220	4332	OpenLauncher.exe	101
PID 2220 wrote to memory of 3376	2220	msedge.exe	102
PID 2220 wrote to memory of 4032	2220	msedge.exe	104
PID 2220 wrote to memory of 856	2220	msedge.exe	105
PID 2220 wrote to memory of 4032	2220	msedge.exe	104
PID 2220 wrote to memory of 4032	2220	msedge.exe	104
PID 2220 wrote to memory of 2996	2220	msedge.exe	106
PID 2220 wrote to memory of 2996	2220	msedge.exe	106
PID 2220 wrote to memory of 3024	2220	msedge.exe	107
PID 2220 wrote to memory of 2492	2220	msedge.exe	108
PID 2220 wrote to memory of 3024	2220	msedge.exe	107
PID 2220 wrote to memory of 3024	2220	msedge.exe	107
PID 2220 wrote to memory of 2492	2220	msedge.exe	108
PID 2220 wrote to memory of 2492	2220	msedge.exe	108
PID 2220 wrote to memory of 1332	2220	msedge.exe	110
PID 2220 wrote to memory of 1332	2220	msedge.exe	110
PID 2220 wrote to memory of 1332	2220	msedge.exe	110
PID 2220 wrote to memory of 2692	2220	msedge.exe	109
PID 2220 wrote to memory of 2692	2220	msedge.exe	109
PID 2220 wrote to memory of 2692	2220	msedge.exe	109
PID 2220 wrote to memory of 2712	2220	msedge.exe	111
PID 2220 wrote to memory of 2712	2220	msedge.exe	111
PID 2220 wrote to memory of 2024	2220	msedge.exe	113
PID 2220 wrote to memory of 1556	2220	msedge.exe	114
PID 2220 wrote to memory of 2024	2220	msedge.exe	113
PID 2220 wrote to memory of 1556	2220	msedge.exe	114
PID 2220 wrote to memory of 1404	2220	msedge.exe	116
PID 2220 wrote to memory of 5920	2220	msedge.exe	117
PID 2220 wrote to memory of 5920	2220	msedge.exe	117
PID 2220 wrote to memory of 2560	2220	msedge.exe	120
PID 2220 wrote to memory of 2560	2220	msedge.exe	120
PID 2220 wrote to memory of 4292	2220	msedge.exe	122
PID 2220 wrote to memory of 4292	2220	msedge.exe	122
PID 2220 wrote to memory of 4292	2220	msedge.exe	122
PID 2220 wrote to memory of 3404	2220	msedge.exe	123
PID 2220 wrote to memory of 3404	2220	msedge.exe	123
PID 2220 wrote to memory of 3928	2220	msedge.exe	124
PID 2220 wrote to memory of 3928	2220	msedge.exe	124
PID 2220 wrote to memory of 3928	2220	msedge.exe	124
PID 2220 wrote to memory of 428	2220	msedge.exe	125
PID 2220 wrote to memory of 3380	2220	msedge.exe	126
PID 2220 wrote to memory of 4712	2220	msedge.exe	127
PID 2220 wrote to memory of 5468	2220	msedge.exe	128
PID 2220 wrote to memory of 2908	2220	msedge.exe	130
PID 2220 wrote to memory of 2056	2220	msedge.exe	131
PID 2220 wrote to memory of 2056	2220	msedge.exe	131
PID 2220 wrote to memory of 2056	2220	msedge.exe	131
PID 2220 wrote to memory of 4860	2220	msedge.exe	132
PID 2220 wrote to memory of 3712	2220	msedge.exe	136
PID 2220 wrote to memory of 3712	2220	msedge.exe	136
PID 2220 wrote to memory of 2564	2220	msedge.exe	140
PID 2564 wrote to memory of 1872	2564	msedge.exe	141
PID 2564 wrote to memory of 1532	2564	msedge.exe	142
PID 2564 wrote to memory of 1736	2564	msedge.exe	144
PID 2564 wrote to memory of 1736	2564	msedge.exe	144
PID 2564 wrote to memory of 4068	2564	msedge.exe	143
PID 2564 wrote to memory of 4068	2564	msedge.exe	143
PID 2564 wrote to memory of 4068	2564	msedge.exe	143
PID 2564 wrote to memory of 5764	2564	msedge.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\OpenLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\OpenLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\OpenLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\OpenLauncher.exe"
  2⤵
  - Loads dropped DLL
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files\Java\jdk-1.8\bin\java.exe
    "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
    3⤵
    PID:5488
- - C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
    "C:\Program Files\Java\jdk-1.8\jre\bin\java.exe" -version
    3⤵
    PID:5428
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
    3⤵
    PID:4468
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://adoptium.net/temurin/releases/?version=21
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x310,0x7ff89d0ac188,0x7ff89d0ac194,0x7ff89d0ac1a0
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,18356992218261012316,4527351733722092563,262144 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:2
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,13006812520351468551,11317599384526761282,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:11
      4⤵
      System Time Discovery
      PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,18156515975515241277,14154052310886800049,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,16785264523347250485,5963231646620937861,2097152 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,4366086740021798440,11196019488763840219,2097152 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3456,i,13510579729223231638,16237322756476213746,2097152 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3448,i,14720051924606928693,2602639048839680034,2097152 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,7068901462887069655,3380488041477219741,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,16997285879509136082,16354385610664842779,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,4675684231551677173,13855339238462428691,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,18053264533184906851,6584786995875692234,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,18053264533184906851,6584786995875692234,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,2175333727644226491,16616960621132938304,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,9262400327026711393,12938789237050322739,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6696,i,2569378513753168288,9908006159150357063,2097152 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,7133589857354694618,8637244983910694251,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5144,i,15207572599321896622,15451579965822116914,2097152 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,5262186482391795564,6389861531567570981,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
      4⤵
      PID:428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,6328225015578878679,6571263491243663494,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,4898381904273973522,3210878505835917092,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,3254290790274405519,6426263891461938084,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,12050991444655583715,15917354045362384703,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,12050991444655583715,15917354045362384703,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=2644,i,17241397044368414358,4287706847680342704,2097152 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
      4⤵
      PID:2056
  - - C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\OpenJDK21U-jdk_x64_windows_hotspot_21.0.11_10.msi"
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,11742805732170109896,6244616759642114564,524288 --field-trial-handle=3028,i,13934880103399884505,10835341304698348282,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7ff89d0ac188,0x7ff89d0ac194,0x7ff89d0ac1a0
        5⤵
        
        PID:1872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,13285652498886416517,11681013279394307512,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,7759930195537145615,566063620704392180,262144 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:2
        5⤵
        
        PID:4068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,2001274919133499826,14851282225345519281,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:13
        5⤵
        
        PID:1736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,223557217268182185,3254299518411366896,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
        5⤵
        
        PID:2344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,223557217268182185,3254299518411366896,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
        5⤵
        
        PID:5764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,12375782638734994348,3814851532823070522,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:14
        5⤵
        
        PID:6088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,5224932200595946708,14489581951869051807,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
        5⤵
        
        PID:5316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,15051633052784538613,13488593031040065411,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
        5⤵
        
        PID:3392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,7174457467971745268,15157191114969994810,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
        5⤵
        
        PID:3448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=808,i,985754225161608317,2165927639155217642,262144 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:10
        5⤵
        
        PID:4720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,10237881716168484500,14487698673581574091,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
        5⤵
        
        PID:5552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,13187426232510086046,17534219999280443431,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
        5⤵
        
        PID:5692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,13811793975172781473,8089184121018667365,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
        5⤵
        
        PID:6708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,18208506191432062294,11172429121747260939,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
        5⤵
        
        PID:2712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17136409005327545817,16010749870667644114,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:14
        5⤵
        
        PID:5152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,17966159937350168522,1289366244443478370,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
        5⤵
        
        PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3132,i,12439939814866500761,13506534149344750708,524288 --field-trial-handle=2552,i,2739171146468849425,8970802026873800887,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
        5⤵
        
        PID:240
- - C:\Program Files\Java\jdk-1.8\bin\java.exe
    "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
    3⤵
    PID:4136
- - C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
    "C:\Program Files\Java\jdk-1.8\jre\bin\java.exe" -version
    3⤵
    PID:3788
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
    3⤵
    PID:2928
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
    3⤵
    PID:5600
- - C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe
    "C:\Users\Admin\AppData\Local\Programs/Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe" -version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:5376
- - C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe
    "C:\Users\Admin\AppData\Local\Programs/Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe" -version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:3868
- - C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe
    "C:\Users\Admin\AppData\Local\Programs/Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe" -Djava.library.path=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -Djna.tmpdir=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -Dio.netty.native.workdir=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -Dminecraft.launcher.brand=OpenLauncher -Dminecraft.launcher.version=1.0 -cp ${classpath} -Dorg.lwjgl.system.jemalloc.disable=true -Djava.library.path=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -Dorg.lwjgl.librarypath=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -cp @C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\classpath.txt net.minecraft.client.main.Main --username OfflinePlayer --version 1.21.11 --gameDir C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11 --assetsDir C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\assets --assetIndex 29 --uuid 00000000-0000-0000-0000-000000000000 --accessToken offline --clientId 00000000-0000-0000-0000-000000000000 --xuid 0000000000000000 --versionType release
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:6864
- - C:\Program Files\Java\jdk-1.8\bin\java.exe
    "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
    3⤵
    PID:3452
- - C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
    "C:\Program Files\Java\jdk-1.8\jre\bin\java.exe" -version
    3⤵
    PID:2832
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
    3⤵
    PID:6212
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
    3⤵
    PID:6760
- - C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe
    "C:\Users\Admin\AppData\Local\Programs/Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe" -version
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:5732
- - C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe
    "C:\Users\Admin\AppData\Local\Programs/Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe" -version
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:2348
- - C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe
    "C:\Users\Admin\AppData\Local\Programs/Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe" -Djava.library.path=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -Djna.tmpdir=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -Dio.netty.native.workdir=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -Dminecraft.launcher.brand=OpenLauncher -Dminecraft.launcher.version=1.0 -cp ${classpath} -Dorg.lwjgl.system.jemalloc.disable=true -Djava.library.path=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -Dorg.lwjgl.librarypath=C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives -cp @C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\classpath.txt net.minecraft.client.main.Main --username OfflinePlayer --version 1.21.11 --gameDir C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11 --assetsDir C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\assets --assetIndex 29 --uuid 00000000-0000-0000-0000-000000000000 --accessToken offline --clientId 00000000-0000-0000-0000-000000000000 --xuid 0000000000000000 --versionType release
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:6900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3156

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2788
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:964
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 38EE6C193E3931130423E336BDF59707
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4260

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b15b8.rbs

Path C:\Config.Msi\e5b15b8.rbs
Size 127KB
SHA256 c35b864b0482c0f54bd811a0f960f040b41758f2df6635781488dfd2c3e28769
MD5 f84a056269388cde7ec6f881c8fccaf5
SHA1 827a7715c5c0e11b991e1017de4e80fdc3c3f251
SHA512 00b042990cc6a0fa9f424584c8b3dcd4d2d7c4c870d9036b36d1eeae8a1944b4262fd0ab34940ac8527fe92f5236879f73cee428627c53ae661477bbff63e35a
SSDEEP 1536:oNLuDQh7URkzqma82DqsuhFs4C+SqmPPcQm1ZR/z/e2jE09mTjf0H76GUZSEyrle:mMiKduJzRq
TLSH
T1D9D31F69E971C9EDD4C345EA17BAC25CD2E06C6C3B4A660F7349E72D8D639EBD4AC000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c417ca1ee0d7e06f59674d5b3584579b4ba1e6e7b50ee722bbc77f9dbf4be1d4
MD5 6532c221d2f8475abde52ef927eefb21
SHA1 bbfba0aa32dcb2a2f79ea184058747436c8ceace
SHA512 5ee0bfa5597931b4d330d5fd4adaed9327243bdeae3090aaf4953519b4242dd0b88c1904c1986a8e03708fc4f1e951f6fbd1b8e932d648492bed3456b4aa4bb4
TLSH
T17FD02330373CBAD6C63C357080204B0071254452722183003990450CCEFC0C10FC27C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 547009a68c94bac01f52abb5f66b0adcaba66378787043f6e787e5c78bdceac6
MD5 ce16d1f42ca37b74e038d131af7ae73d
SHA1 b1675592495b5148dff4c90b88c12554168859c4
SHA512 c754f9ed3111911b906b2028789260581fb4fc017090ead10fbc37872f95685c12b9fb14f56471d3c8005e224d0138439e97631ab2aa9c20a1372fceffdf8f6f
TLSH
T177D02334777CBE16CB1F39706411C75273525550B515D36165B1410CDDF95D50B8E186
MD5 SHA1 SHA512 TLSH

Submit Download

3cc01b0a-d84c-46d8-a892-f89ad6da15bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3cc01b0a-d84c-46d8-a892-f89ad6da15bc.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8833184c-dc78-4b55-9b85-30e87ed0e868.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8833184c-dc78-4b55-9b85-30e87ed0e868.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 42148dc17d434a9e7cbbf9686cd89006d2f507cacd761c294dfd0811b4cf0242
MD5 28ca1713976f00f8997df54acf75b53b
SHA1 e53c97923c21f944a64d4dcccf9d8187bc98d3d9
SHA512 5ef54108c3bffefc4610cf32f6177ba17decafabe2e085b48db48be0eee8b3afe6bff20d8749a7e9fa4ab37de4377f20583684f39914c4be3bb3f36315493292
TLSH
T1B78173E563592F92DF205E72CDE23E0C35FB8754190BAAB184001D360A6EFA954E1EE3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a78fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a78fa.TMP
Size 3KB
SHA256 cae5099cbf69311b98aeddb4e27309d384964c82437c56b2265130e545a54401
MD5 378fdcae2ed442fe2f2778f954140e6c
SHA1 481e9981ab338e00fab05476cdf92d38359df402
SHA512 c190cf2baad0e258fc235dd8ea1dbf2d3197acac911560977c2686d063d717e55af127e7123a810cac4cdcbe35602f770f8ba48fd10f464cc7322c5e4b5c4494
TLSH
T1D26150D5271A6B92EF208EB1DDE2764D35F3CB55090BAAB048006D360B2EF1954D2DE3
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b124c6744d55b5a54a583f72991025c1416f53931e17acc2afb795a315b0efe2
MD5 9f41c7e563e4eb1c504776473a43c059
SHA1 c1304a51ed1eb73f093c7f46779c198b31ee27fa
SHA512 b972908153361b6c1c875ac7431ac49fbc7b0b8504a14fd7cc9cd7695306c7df4cd078daded3e4f27d90b3d48d8659b8e142dd02960efad46e7ab8572e7027de
SSDEEP 3:MsEllllkEthXllkl2zE/lg7qefll/l:/M/xT02zRtXl
TLSH
T1814404177FC10C07CD0011304151C7503374DC100F37574334710C335CD57540C00011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bc06e134df5987f311e379e68c6fa0a10500bc0dc5083f2908595624bd0eeddc
MD5 58831ba47ba2648450a94d6d049c95cd
SHA1 9763e4bc8a7d18d328d6ffaba45fa28ff23f5b2f
SHA512 6a2dd67b0429c37264134ec776d58eba959475510fa76cab2243412bcafba5ff53e3dfdaf770e56575537227a8eb2fcea0b5ebf93a6975d0a94245e03f7e24fe
TLSH
T15281ACF7C3E8866DCD1255F1AA18AE1BCE1D0914532C3C6AC8F4AE5B97E2871E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 13f8b85b99180243501ba4178f4a76f6ae1a3b47dc23da20d243757572ce42be
MD5 d71e49ece8cad223441f32377bbe6509
SHA1 0f8f319e6d55380ae445de1ce626db1f301641c2
SHA512 c4f20f89ffef7e7f67e15391663afe8be4a1c960d9f761291074108880024173ed09df04d5ffdc5420211a7de10df4f69e4316eceb7a6e1d1e9f27a5ab9bd3b0
TLSH
T18B81ACF7C3E8866DCD1255F1AA18AE1BCE1D0914532C3C6AC8F4AE5B97E2871E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b3799c1be7a95c9c9e1f068aa13a4df9cce6f2297548010cdeba9ac0b539af4b
MD5 67daef855edcbcbafed15cf85ce56959
SHA1 c5df858dee8e5d062e6948e7ad256c1a9c025107
SHA512 f7ed2983bfe86052e89e7c2d08ac110ecfbd9446da08e2671c1ce915d16e21e955c134cf296334be0d32639868b31c3425b4bc451eafb28a1275d521d53868f4
SSDEEP 192:sxRCRYCU/fFs7phcjoZq2OzoA8pYB9/g6+WN4cd/YD986SeG5hIgtJ:sxRC1U/fFs7pCjWq2zy/5B/ASN3
TLSH
T18C42B6166928797B9CC7D259FB55BF93E6F95032A1901E48A7FC870C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 caf2fd2b2ed552d42ca82320f8767c3dff6d1e6aac4f558ca68d2cfd8fe12990
MD5 f304e7424378a08f0fa767a247ecc0f9
SHA1 2ad313ce0365dab9aad669c90abb88082a8074af
SHA512 12fba82b202a30538f1d031cf0a784c5c96ea9a20c73189be75157cad8fd15e8dbdd7bebd9fe0cbfded1b47635a894e86cc24e6cef060c1af7417382fd6bf367
SSDEEP 192:sxR9Rm4U/fFs2yWpVephcsoZq2BzoA8pWB9/g6+WNAn4vZYD9h6Sag5hIgD4J:sxR9ZU/fFs2yWvepCsWq284/5LZRS/A
TLSH
T14352B5166928697B9CC7D21DFB56BF93E6F91022A1D11E48EBFC8A1C04E67DD230340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 797743fe501e2e09a4513add1566c3f3908f83f90b6c5f9b56a841e17d8d5feb
MD5 23050ba69224e39470493cb4144f57aa
SHA1 8bcb7aca6f43134085e0c85d77c8be9a32ffae9b
SHA512 9732b62e3cdf26e9e3b30095607943859e57f13b72605d4a2a3e1692e16e9a0380b6f723bb7943125dc7a58b58089be9c45bf39def97d23b3790f34a5bfd1e6d
SSDEEP 384:sxR9ZU/fFs2vWvKCkWq2ZPhW4/5LZRSYA:sJZU/fBvYKCkr2hhf/59RSX
TLSH
T19862B6166928687B9CC7D21DFB56BF93D6F95022A5905E48EBFC8A1C04E77DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 96c48e62ab1e812df94c7adaf00665bcdf97dc511d759c4639d57cc2c263ea9e
MD5 94d071c641ea0b881ae36755b3940ef8
SHA1 50d5dadab64bcd3c537d440556c54bbbd030f9d1
SHA512 9f9b5f987123e6d723e6fdbd2bef00169d2f40e6c5008ad003e186f86920118abd83fe268150331e566033a3432cfcd61870b839bec9d5e21b570006af4079ac
SSDEEP 192:sxR9RYTU/fFs22phcjoZq2OzoA8pYB9/g6+WN4KYXYD9q6SeG5hIgDpJ:sxR94U/fFs22pCjWq2zy/5uXySNf
TLSH
T16442A6166A28797B9CC7D219FB56BF93E6F91032A1901E58A7FC970C04E67DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ace434830b6f00da6c98e1bf38b2e8c591244932d43dc780dd0e7daded2c61f2
MD5 4e68e10d8c4a860f9c0e92b953158e45
SHA1 3faa10f7ce2cd7b51adaa0977b2a5c1e1894cf67
SHA512 ba51dd5c1d068d746ea36125ec99864e28cc23f286f838fe6517f477b4832cfee55f93acb70ae48cf1c45426784f4a73085d380ede37ba36193c0a249a11fa55
SSDEEP 192:sxR9RY4U/fFs22phcsoZq2OzoA8pYB9/g6+WN4KYXYD9W6SeG5hIgD4J:sxR9HU/fFs22pCsWq2zy/5uXQSNA
TLSH
T1C942B6166D28697B9CC7E219BB56BF93E2F95022A1D01E48EBFC871C04E66DD630340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 4b40675edf688c9dd7c96c578c882ce8fb8ed43c91b2dfe8e97b2fe6b5876340
MD5 65550971a469c05438c7fa57d6ddec7b
SHA1 df7b5ba4032e378fc5c288bd33713cd955c4142b
SHA512 030f72138263e48a05b78a9ea6a9f33061541c29cd13126d94adea896da675754b7ab78328c067cb77801d5364781cecfe6ab5ea0a03ca62853521c763f802e1
SSDEEP 768:azfW/L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVf9Yc16Qropi5hh:azfW/dE7J0Wg/XfHfu1jac9Yy67pi5
TLSH
T180D2DA7B640CCB7F4F800A9DAD1A7EDF6DA802CB9698CD5047FD941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c111e02d8ced8f53abe6fc4d818358d57d473dad48d91525a44609c71c149197
MD5 d3b22af2fbcb41fb5c2c3672d917e850
SHA1 0e0cff55dff952a1bff1955c4aa80eb99e93e088
SHA512 7035c553f032103d5f9c8672293b4a328cca28bed3713378bc7ec4e74d0ec52f355cb5bb044eca6da2c3f8ba63e15688309fa8b3137dd9244f8566df5fdbd12c
SSDEEP 96:KRE/iE/nE/OE/iE/UE/0E/kE/iWE/sE/5E/RgE/SE/iK4E/HgE/IE/icE/yE/6Ef:CE/iE/nE/OE/iE/UE/0E/kE/dE/sE/5p
TLSH
T115910442753A0240387E664CC6A48D2BE2C1B4733019A96A7BF5516A4F6FE139CFD8DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e08aab09-c36a-4a19-8ed7-73fd33737168.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e08aab09-c36a-4a19-8ed7-73fd33737168.tmp
Size 414B
SHA256 8cc7f2d847be29166b00844f4d25ae347b1104a020045ada5dcb97e0ca8fa858
MD5 e25e00c2e7126c19af917ca4f95fa66b
SHA1 279ccaba6e507d294a5b13d30bd5775848183665
SHA512 569c46aa542acfa79dec7a9766f2e5b14fa66f24baf6bc32a9dc58d842eb752f9616e45ba563b20fafecde68560f39e1c571ccd96a59e4172a225273c9744f4e
TLSH
T142E02BBED961AC3728F9175850D4474AE750034A2750898F3B3C8109CFF0276458AC5D
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ae1c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ae1c6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 6365843b5c5674ed9ab47e1b86a8e72c5c5e1e8d3f8a98f8d86f8f8f0291d2ca
MD5 891c6876f80b2a731d9c7d7a227ed9e8
SHA1 cf0a3394bd8a14c38afa74f4697fc04c0e18c2e5
SHA512 37b42eb27099ee8b2ff1c61c3d7726b0a93a8439dfc1c9add182a5ab35a6ea18f038d3487637039885f8f4b920db2c115e38238aaba88f8cdcb0442db7f2cc21
SSDEEP 384:nYiFrtNn/s3n9S638NP8TUNTUlIlcuR01Ku4HfcYZ2rEoajo4cdR8eHhVODjYPNH:jFrj+9N3owggb9rEnjN3Gac1Wl9Mj
TLSH
T1F0F28E36ACA5DEB79CE797C5B7467A82EEE012A785C94DD4DAD8AD0C10C36EC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aefc2323177224e12ecf371e6284f9bb8d5e3fedcfbc87b931421688823a1628
MD5 0c183bb3d660b56609c61bb5a4cb9ac5
SHA1 1134d4de02a40ee1db846e612c22cc512c153ef0
SHA512 2af3c32a388f770150b8a6e05b7d4db33a013b64f729a6392de0cd1211e537ce39ff78b7f7ebc6d7f58aa5d1f2d9680e1e2d9296eeee6269559113fed9bfc4ce
SSDEEP 768:rrv+4UNbdS3ymi0QyrEnjN3Gac1ZweVH1SCz:rbsbg3p7QnjMarEH1V
TLSH
T1CC03CF3269A89AB38CE7E385758776037EF4525385D40BE0CACD2B0D02DB5EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8004d6a9aeb3c0eeeacf92140a5eac23562468d025752ac302dd0022559ccae2
MD5 0c9f3c079a328fd4424b820ff789c07c
SHA1 8187a13e8c83413bc72c2c585ac27671cd6977ae
SHA512 d0cbaf4300cc47d83bb7f4678dd7347e81b3490081c1b4c7a3f9d30b459ded54a7d989fccde116e114c97bf26cf705341c3ff1f9ce65135cb2cee75cb4a0de8b
SSDEEP 384:nQtNn/s3n9SX38NCbuREPKuWZlf8hyEG6f77h7F+Ky2rEoajo4cdR8eHhVODjYP+:Qj+9M3l8i0QWqrEnjN3Gac1FGvb9MC
TLSH
T1FDF2AE346C659DB38CEBD785B6473B92AEE0177385C50E94EAC9BB0D05C36AC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 ac1e991b5e16281aa9f22f558e5f5bb66d9ee49494bc4faf7761b2dee26237ce
MD5 da7a8612398dbc5f7dfc111570bb96f8
SHA1 0fea6dda7fe87e1d4fdcf4ac17a38659cfad1234
SHA512 98fe8e8d21943b42041176eab06e2b8c500446184ac7bc112bf1355e82aee300b1bcd96fea04627365f4f282dd3759a7f2f432bac27c43dd30b5d4d90652d7d0
SSDEEP 768:LFrj+9N35wgBbsQWArEnjN3Gac1FWLMbUFjheb9MC:A9N3iXAQnjMaXLeUFNeb+C
TLSH
T1A5135B3D9C659ABF88EEBB85760E7A569ED00277C1B908E4DBC85F0C90B359CE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c40cc7c8e12ec75432e2793445273aa1c242b57d1c36da7a54e290da14288f0d
MD5 20706965c8daea0d8ea397bbeffb5255
SHA1 f02fc9383044f98c91696b49a4cb9856673afade
SHA512 d279e15ab4d0702133840362a730294504b583cb585f332bad49bd57a7f32ec6c73e459f9c59a1fd46688af2699a59cb2ebeacba62ffd5b5846f9e48d33059c6
SSDEEP 384:n9tNn/s3n9S538NCcuRztKuWZlf8hyEG6f77h7F+Ly2rEoajo4cdR8eHhVODjYP+:9j+9+3f8i0QWtrEnjN3Gac1FGvb9MC
TLSH
T19DF2BF346C659DB38CEBD785B6473B93AEE0176385C50E94DAD9BB0C09C36AC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9a694ee7e6de4c181c08d0acb3f38cc49efa7bfdbee377ff8e59a19d2fd4ad1b
MD5 ec19bf028bf1c2d5b15d90d6c9b769f9
SHA1 a5d7726651d0d0a9427cdf43f9311282fc479ed4
SHA512 fd4da48f68a286861f3de139196c4b87064afddeada9bffe2a6e33cf300274527c35bb9bad3c6b8586b362d3cc40713d433831e60950ff66fcd255572bd8646f
SSDEEP 384:nktNn/s3n9S238NCQuRItKuWZlf8hyEG6f77h7F+0y2rEoajo4cdR8eHhVODjYP+:kj+9J3s8i0QWwrEnjN3Gac1FGvb9MC
TLSH
T1B4F2BE346C659DB38CEBD785B6473B93AEE0176385C50E94DAD9BB0C09C36AC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4a55d2c980e9d65a2be6a352a2bb93b5bcf45a79bd03d49dec05b3e67669db18
MD5 55938a9f435367b5ab04213263ee95e8
SHA1 8f03d357f8a24920f54ea947375974397b9dea1b
SHA512 cb9536a4073868a15bca9cb8c5e2e8e0cf4d8f9700d1ca173e5f0dbffcc12dbdf781d3512b92b16317a856121343ef92118b4a06295c0edf28b8eedba253730c
SSDEEP 768:LFxj+9N35wggbsQWFrEnjN3Gac1FGvb9MC:O9N35XFQnjMadb+C
TLSH
T1D1038E35AC65DEB79CE797C5B7467A96DEE002A385C94DD4DAC8AE0C00C36EC170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

22e0644b-be83-4bd0-b721-59c2689e929b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\22e0644b-be83-4bd0-b721-59c2689e929b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.11.10-hotspot\bin\java.exe
Size 49KB
SHA256 5e0fab9f07952ceb6e71eb9fd33e1ed69959904ca00cf70869b7baf516a98016
MD5 9bc5db1678fa72165bf83632f4dd1ef7
SHA1 6ccf5443563e74477b2b801e9b8b8424ed2e654c
SHA512 9a3573b44069ef70bf3070bbc46bed2333d4cc3e921e5af79e6ad175bac202cab4437e8d0e947225dfdeee1bcf09b72089a7cce08857f579048bc94599012899
SSDEEP 768:UNpXFeM5R2TyJ5R3s8D/bkt5Ruz3Vb3OW5IYiDLk5kIvNCNMaj:mwM5RdJ5R3sozkt5RA3OW5I7VIv4
TLSH
T1EA336C47AA082C81F42F84F158A7752751B4BD032BD173EBBDC6B21E0971391A9276EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.11.10-hotspot\legal\java.logging\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.11.10-hotspot\legal\java.logging\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.11.10-hotspot\legal\java.logging\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
Size 211KB
SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
MD5 2ff9d894ba5e8f7880f0031866203995
SHA1 dd594003fb744f4b2b944e1b10b78a7026e72104
SHA512 461ad7a749cc6131a77883de4108f20922d85618030f5f640da22e95df7db61fe358790e955204bd71efc873b726c130d71f9fb5193e91ec82718d8d19b43a1b
SSDEEP 6144:B8O7Q321soEr5HXN1GY8DNExkP8VXaVHaT8fyFmiGJZMzIfAf1+mrlpL:BT7Q3ZH98LnYlpL
TLSH
T15324173951580061ECB74275CD67E453EAB2F222473192CF09E0CA761F2B7E5BE79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_hashlib.pyd
Size 67KB
SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
MD5 ff7c390260b2c94396abcc5323db052e
SHA1 adc7babe127c3586c81f321ad20ff87785945795
SHA512 0c99f558cbbc21ae59932fb7eae56dc956e282609da9fa4715e28eb885bb228772496dd2d08d95ee6e37743c6b908e6190da4680935b557a01e2c0261189e855
SSDEEP 1536:1PooOWZsPAJWv52zRUQIjDItFyYiS9vUfIkb2L:5xY4JWv52ziQIjDIfdJL
TLSH
T192636C86A6984056DA1382B5C4E38F43FAB0F2522B1197DF6279C1CD2F233C3577A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_queue.pyd
Size 35KB
SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
MD5 8ac260b670f58c4d08ba0a7e5512133d
SHA1 3ac300d794c60ac58c68961ebd10c7fed8585fda
SHA512 a523efb322f7863033f7bb8101134a9ce6a137979665ed0daf2072eebf016a3b89bf0c386f4c3b84c3b2455814bc482581cf07a6606cdcef7df22b96e6a4fa2e
SSDEEP 768:mJe4W6rB0Bwh6EIjRUYSyYTegc2Ip4NMTxf1mlIJxp1:EhSBwcEIjRUYSyYiS9NgfIkxz
TLSH
T1A9F28DC6A65C4097E663C970C1A2DF92F975FBD39B0146DF2178C1890E237C2A73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_socket.pyd
Size 85KB
SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
MD5 893ee6bcfa6b5a527b61eceb80257871
SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
TLSH
T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_ssl.pyd
Size 180KB
SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
MD5 b9acce051643c39e5ac4c36110388724
SHA1 69f9743a13c57f699ce68270d915159aa812103b
SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
TLSH
T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_tcl_data\auto.tcl
Size 21KB
SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
MD5 97efa9ebe840ea051f9706504c8bd783
SHA1 287dea14d47977dcd8edc525fe750c836264db5c
SHA512 ab9fc210f3bfd181cc2b93dd348415f67f763b2c7961179a88eba3f7f87e44b21a66ea4ea53715fb88784288c75b8270640f3bc6beafb0e8cc21966068a79bf2
SSDEEP 384:UqT9XC9VZvWQjCTzsCTV7672ORgS0myvxFRTX7Xvt3wBTnbXhCUquyvz:LT9XC9VZvhjCPsCp7JlmyvTxvt3gTnbW
TLSH
T1EFA2B7635F9542A630B1C22B553DB9A4EF2F81B70675801D38F8912C37F1815C6BEAEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_tcl_data\init.tcl
Size 25KB
SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
MD5 ffe4e47b5f4f96ec33fb31d52ef0b636
SHA1 3a625e493f8778277f65ffef1e0879fbec0e4d0d
SHA512 dbbfd92ab6d95672f7882f3affb75f31749281c7450c29fcef58b5bdfd4f42b6d1d9f3a50ae0d3aa27e95d48918ed55cde5149751f892538bdd2dc39c618927e
SSDEEP 768:+XrgPHudKlE7BG6Xg3tMo846ofRRECL9QDjr5v7hzx/i:igGdKlK4Ao846offLmNhNi
TLSH
T104C2A8112388917932B3533686B5E598EE7EC1F706A941BCBCCC825C777150A4AFDBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_tcl_data\tclIndex
Size 7KB
SHA256 577f042bbe640e2739606a1f76098abdb8bd1d1f31526402fb82b21091644f65
MD5 42ec37eee38d6dd33a9fdecd7f1cd0aa
SHA1 6c8c93e5e5350d93f63f3f99d587ab8fb5aa496b
SHA512 37d61f27da79c494d225543828c9a29f1397c57506d609481036bfa2a336ec3110e6d10670edcf211a5714629eeb7e16dbf04a8388bc6bb420584edc06dc534d
SSDEEP 192:eeV1ffxNFxI5XgipSSMw+5p3fphBr2tm87RtmAjm2G03BgPlKif8Qyly5mg2lkYf:eeV1ffxNFxI5XgipSSMw+5p3fphBr2t/
TLSH
T1C8E12C1AE354C51883E485174959DE983AFEE298D32CCC7EDAB491ED10B20176FEE4F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tm.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_tcl_data\tm.tcl
Size 11KB
SHA256 f0cc13daca21fee538cca757aa09e88a969a85174eda26e61e573dda6c7ba413
MD5 5746f2c35a7c434a78cc127f8d522e8c
SHA1 0b438de8ddc24b2d805a5db2c8c9432a52c6e53a
SHA512 0a9038474b7bdb9469b7684b5b3867982a29bebbdf017d2dd21edcdd79dd3f67f4d99cdc0a11b3aa7b170b25644ead896489edb9a9a692ca654c0e7bed95ff42
SSDEEP 192:55CjnlRfMf8aOH5bEcKBNkkrgpCmqkkuoBoh9PTYMsvSO+Hy1h/1uKisM68E:5q3MfmH5bEHBNkkrgomq/u5PTYMC+S1Z
TLSH
T15F42B512B3CA536A62B313155EBAF294DB2DD1FE17E5506C744D81A837208280B7F7CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_tk_data\tk.tcl
Size 23KB
SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
MD5 7e46d32c3e70dbf17663f57e17d18dfe
SHA1 394dd3cde6a7e41855917060f4388478a0a84668
SHA512 6125e9b6c213e48e4a7a47acc0be3b930ddd9aca2132817f1906a2453e0d0b8292e7b2090bab8712856d12d2cf4d119238f16fae0fb57dd66da4db8fb3d92b0d
SSDEEP 384:Nbyxt+WaB9USY15gSgC3DbTbXLXKr3aIIXyDAbK2LMGgtewT+3oFQRyH5bAy59HU:NbItNe9USZbeXysm7GgteoFQRYMESL
TLSH
T11DB2D5195DC062B3513BC12F53BB2A00D87558FB2B76A84978DC48B93F6483B06FE9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_tkinter.pyd
Size 67KB
SHA256 14f0b750f800ed529a06052369428f75f204005be1633400c9fe0ca544d82f85
MD5 8f88a89243cd2cd254a31c2001accb3e
SHA1 bf73246b339970ccc9162719c3dc9c24746a8bd8
SHA512 dfb2230504bec8717cffb08ee4029c144addda6a87adaf2948fe1d7dc10e08a2b581489dccff60c26854e5728ed687df231bbfa42a78a3ac312b3a89601c12ca
SSDEEP 1536:MoTKqNDDa/Tf3gOrlU9oo6ptbQIjDStcyYiS95fIbH0ns2L:MoOjllPo6ptbQIjDStFTQ
TLSH
T1C0637D9AA764008ADE67D578C5B79F13E679F9520910534F00A4D38E1F333F2ABBA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_uuid.pyd
Size 27KB
SHA256 635d6c46bbf6b86dd30a802bd1c6e214dabccb44d1452c52f0b557ae5bcc6f68
MD5 ba74524f8ff1494fa556dbdaa23f2f80
SHA1 173ae2ea0790d959b89d5ced201c6656ed5df3f6
SHA512 3c4b5621c97549b9df454970199b14948b4354fb934b5a0ee85d2d475eaece03c575c13548fca052e3b1cfad7c95e4cb8d4cacbf9d7fd09c64e0a3fa6f420c19
SSDEEP 768:vfi15c4IjIwyyYTegc2Ip4dftTxf1ml6Z+7EWNg7c:ni15c4IjIwyyYiS9NHfILlj
TLSH
T148D25C869A788047FA5396B0D1F2DE83F939BBD35A11875B2179C2850E533C1B32B36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_wmi.pyd
Size 39KB
SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
MD5 bca71458b37ab9784290593636006405
SHA1 4a7effcc12a283b9c65a06b6af62c1cc44820861
SHA512 fd7e5e40a9cde0253684cf0ff6f343c60c597087eda27cfa3726ec2d870b4dea1e7140c55e0de7eca0f5ee36eae32fa0092cd88be4e9969c91cdb94ac923ab7c
SSDEEP 768:y2/EEqrVmjsJuMOQMV4Ij3iYyYTegc2Ip4K4Txf1ml9dHx7Lsc:XE9BE3MOQMV4Ij3iYyYiS9JfIbHxnsc
TLSH
T14B037D85E6644052FA67C571C0A6CE93F971BB935B11878F32A582990F333D1E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\base_library.zip
Size 1.3MB
SHA256 ddcabaa0d6f3091519b4f81815027b04eb07696889a17726db118009cfa9ee50
MD5 0b1f35b511137281e19fd4ff06b6ac69
SHA1 90fd022853ff006a2b4b03454d3a5b41dfdc1ec4
SHA512 32704673b412b5169645f5e00fc3417a7b21f56baf2e7e422f36dbb4df81326feea3b406b91f9d94a846fe9fed292940253ba4a7934ec7424f87b7a4341d2029
SSDEEP 24576:AdVNQeOdP2m2dfhrJsuUF0Lllbs3rQRpA9:AdL/JquUFB3MRq
TLSH
T11B552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\charset_normalizer\cd.cp314-win_amd64.pyd
Size 10KB
SHA256 da3ce780d6d58ae8c6920b99f806f64d58a1b33f4a01382861b01b50549199f8
MD5 d22406cd44bf4cc0de40f2975eb9cfb7
SHA1 672fae4c492c41a11b82b71ddf6956e25bdf74d9
SHA512 cb8c9f0eb6688412394669d3f1d799e3a89aba0c6c3c3aec67f70cf636df7fa34e29ded3e830a532334f468d55754da3d2d8b7c7954f5ead6a5af2812efe64b9
SSDEEP 192:h7JGrmoX+sMl/++Ch9p85BgQ9NgeAwJz6:hJ4m446OR9DAe
TLSH
T1D122F85CFE6458AAD9158138C6374E4BB132BB22170273CF8370A06A1FA37E66534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blue.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\customtkinter\assets\themes\blue.json
Size 4KB
SHA256 a9c10c997a2281b57b60ff9325c9c0b2dbebe498722f3fbc7c585ec9fe1aa352
MD5 2f2838507c1b8e31c204ded1f52f48d4
SHA1 b6c74141987f6ca4a45050de12dd1514ac1ae4bd
SHA512 3e6e567541bf2db30350d5f84a9f637112d7b6a42752548cef2e4b4025111cb2db654e858a58591f0b5b7d715dcb29854cc77aaa0067ac065b65a16ed3afbef2
SSDEEP 96:KupscLUBH2cEiGzmGvtu/BCNgdacgWu/Bwg+Y51hlk2cEdVJFvLpwZdIunacEkGN:KupNUtMpdQ/VIRp/v+Y51hT/vlggh+4
TLSH
T1FF912914D5280EA723FBAB2A1607EA043C9C95D36FA8BE54385881DD0F4F43DC6B5BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dark-blue.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\customtkinter\assets\themes\dark-blue.json
Size 4KB
SHA256 a4e3b7155bf29c5fd62a13a4d13b4ae5aa74d3f09fd9295656cedfab63804ffb
MD5 e5f416ea9d892111045734e34d348156
SHA1 d186fad5499b32292e0e490ed74a5643f22a722a
SHA512 3df7c6faa7ad119bb22b62703b7b5d0e6c6efc7ab2b8015ea15266e7a15adedb4dd53386570a57d83167210934a714f47a52e9eae7718f57aa59f044be0656e8
SSDEEP 96:Kg6L6Xv7LI2cEigmUtFxCdVWFCa19XcEdVfvLpwCunacELTaUb4:K5uXIMZVTIn2Ca199XvlJ604
TLSH
T180913914D5280E9723FB9B2A570BDB043C9C95D36F64BE54349882CD0F4F43DC6B5AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\libcrypto-3.dll
Size 5.0MB
SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
MD5 9751638ed5684f53f07ef6b4c7e8a786
SHA1 896a535cb1e49daa88e9aea693f52926c7e6f1a4
SHA512 b461c99c6115be95baac937f07038decd5ab2917aaaf12df8d1a44b1bc4ab28cde5ef748d1575d33b18d5e46d67f4ebc9c30333f3974c349c6f8a3c4edd86472
SSDEEP 98304:1H+q/MS7XFmXiTpdFGUPB1CPwDvt3uFlDC5g:J9/7XFmXwpdFGU51CPwDvt3uFlDCS
TLSH
T145367B6AA7A80189E4BAC13CC9534613D2B1F85A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\libssl-3.dll
Size 776KB
SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
MD5 a643b4a012da0d4b5653a01a458cabb7
SHA1 4e788bee34f620e671f426cc356e846c5ef51db8
SHA512 d8ac85fbf3dccb071d6fa4349d9af08116e1057da127016fcda45c9b643e4e1ef4166e0b6ef3d64f2e4d6e9a6f06122f2f8aec7fe2d5916e820b079148ff533f
SSDEEP 12288:ORPyn2nh9MXVkVJ1Ylrl3cfXJaizeTWMldFe9XbBR:wPXnh9MX2V3Ylp3cfXJaizCFe9XbBR
TLSH
T1BAF45CADB37805DCD8B6C17986934623E3B6F4562330EBEB0651C6790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\python3.DLL
Size 72KB
SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
MD5 303f286d14b7db861ad96314bd8bf3f7
SHA1 2745bd50e91648968888ad495ebf4f66d10e4533
SHA512 4beb99ecd472df29d099c179f0a1c8809f741594d81704cc1d8194169c0826273cb9cfcfe2b7fc4b98fc07742c55fcafa9257c8a67450000dbdec3971acf13c5
SSDEEP 768:WQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIk:DbTrnXngXMFEIjG0xyYiS9yfILB8
TLSH
T13A735D5E6B54F8A2D6B629FC78D199CE242B12FC9F2584DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\select.pyd
Size 32KB
SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
MD5 9e31eff5c36a868a6010be873e0f58b5
SHA1 9cdc5190fd0d821b5b22f53c8a86c62b7e64642e
SHA512 b5cee6769f229874e5905d80699975fcf9472dfa2d09f01c38d2d41872885a3e6853cf6599ec214c66e9431e6ccde95e7324f1eba860f68fe849f75497447ea4
SSDEEP 768:rB7YKHfIaqFEIjRGOyYTegc2Ip42Txf1ml9dHb7Ls/HV:rB73/IaqFEIjRGOyYiS92fIbHbns/1
TLSH
T189E27DCA6B345047E6A3C57185A2DE83FA39F7A39A11869F31B6918D0E137C1B337358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\tcl86t.dll
Size 1.8MB
SHA256 77c41c2d5850224b21d1f35d29cff87ac4d5d847e3694c52f5f63f5eaac7d1f2
MD5 b99a3b97e090cf78a5063ad64af0411a
SHA1 62bbd39f6305497b98fae0795c1d35d908483c14
SHA512 889986f553d934d0b99ffa18d74f8ca9e035a3018a58ea409065ef584008f3ec879f09ebc4d0a7bdc4a69ffef4cc7250296cd2b6a2ed4c18f60f55dbd2d2f2b2
SSDEEP 49152:C0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGB:LBUqMR7i6x9T+B
TLSH
T1E7859E1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msgcat-1.6.1.tm

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\tcl8\8.5\msgcat-1.6.1.tm
Size 34KB
SHA256 adca186be560f2236265f538d4cb6df1171bed91192118796988bb9c08a4bc7c
MD5 e102bf017d302c494c1dbd449b040053
SHA1 58b16b222f881271e09f7775c46817bbc4bed81e
SHA512 7001af784de0663bbf634842c12d833e447221a0fef05723373db3281d5bb9545c3c12103413137451730fba6207a1dc318b662aa4da6a72fe6944577c199da2
SSDEEP 768:m3SQ0CzasW/rHPG2yfkZ0Kbh91iQQLnq5MIVYB8mbgijsPIAtw4qvUm:4SQ0CzasWDHPG2yW0kJQ2imXmUij6njG
TLSH
T10EF2D614334741AB36B2526799F9A2A4CE3CE23F10AB959EB89A801C7731F5D43F74D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\tk86t.dll
Size 1.5MB
SHA256 c85f46920f82c05ac7eb6ea27dcf85d716377edaede778bcd2c40d991e341f22
MD5 c3c9096242b05677a0d1064badcb8c7b
SHA1 31b602aa7f9508d7ffc928814929bce5e263b86a
SHA512 152a49dae30eff7827bd3ed7016f9b021350c05462ead8c3846b8bc6834ff1586c53d2a004c6268eff1523f18acfbd82e85f89fd8b3259c0663041059967171c
SSDEEP 49152:076DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezfzt:ZQchLNqaJvARxr9DrTwylL1y5BEq8JT+
TLSH
T1AF754A06B261C198C66FA134C91796BAE7F17C05931057DB72A0BE697F33BE2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\ucrtbase.dll
Size 986KB
SHA256 ace7a1a8dc840c1d082e955f48b63fa29cfa30f7920b7df8d5dad05280d433a5
MD5 14f3d657b29c0de2f9f91a563cb0e4d7
SHA1 f7cea78693c4189e2d353cf3bc2c70fb4699575d
SHA512 dd7e447d9e1624ac0e6b8d835a6b026c6fabf5b5e05f653bc3bf31d1b4de8232c87cf84f052fe3048f3360fd101c2fd3ab7157e1def81789e6067e5a71dd9ecc
SSDEEP 24576:WkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkO:TmZFHhp9v1Io3h0TN3pvk
TLSH
T11925AE68F76C0AA9D07BE17CC91B150EE9B23406477096DB03E64BB93E2B7D5163B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\unicodedata.pyd
Size 740KB
SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
MD5 624ffa84aa15efced4c1fd8e5ccf0b95
SHA1 2c08e87703b662828be085b4fe07e5b28b723e8a
SHA512 8f531ade03ad048c5f9d1de307e45960822e2dfd50bb27a71173a7ccb90f1a49028b70848046d34b81f130341cae4d7853db171f3167554e8c0c5a2cad40cc61
SSDEEP 12288:xPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNh+:xPY05ZmDPqO54lDJPTMNh+
TLSH
T1D3F4F5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26682\zlib1.dll
Size 144KB
SHA256 4f4168a375d3628f96846f5a9319f55521a501e30d9b7e91c384e64fb3245d4c
MD5 71700382fc3394b7adf0e570b19d1a2d
SHA1 ecee1af12c57270269949e6fed4b33551ac1a2c4
SHA512 c10a6ddf4869d5de91c22a8c824801d3dcebbbbfd534b9752e29bb0c4f15a64185801f87861ca78fe58125da0b6e99598cb37b6438f09df45b3babbda7e8f23f
SSDEEP 3072:EvEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCGJa:EsVD+RrFgvi7JM
TLSH
T12CE37D9BB6A255BDC677817042E6C7B2F932B8214B309DEF5088D7741A12F806B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna17716611801077338279.dll

Path C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives\jna17716611801077338279.dll
Size 267KB
SHA256 5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
MD5 2d2475f1f026dd54e9f3e787ae4f81da
SHA1 27ff882ac271db547aee520b38e3ba9aa91e136c
SHA512 07ef110d202d51f096a8b474d25c66b93b16af8b2ecdbf3ab23138273a0771c94dda6426fb644d43dd26cf53924f37821dca4c539d889d435185fff2198b3e76
SSDEEP 6144:cZkI0LRMj+xkFxdHuGL0x65sz7QZBx4Cp+slm/mgye4:cZX095x65sz7iP42
TLSH
T1BC441917A7B648E5E9B7C03D44236A16F6B178294320EBEB47844A531F73BE09B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjnidispatch.so

Path C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives\libjnidispatch.so
Size 120KB
SHA256 d0eda029037f25c4b3d63923a3875345ecd1922de1e6e5df4162cc5631dc0deb
MD5 3b401759cc9fa1e7841dd6f0191c7055
SHA1 1d14c80575d252111f6b227666f4a1d7a9b9cccb
SHA512 e2ea22afe6bc6d2f60f55a49284fa0c82b46abd10e0c9a3136cf845c74d9f43a363a3d9e8e4e1b5d4d51ce2b017b80e5f8cdcc86163a1cbcb0c7c24847acedde
SSDEEP 3072:GM4CJ1cjSjksLMeeREZ+7BQEdl6ICLgltF7U2:GM4oXQeeC2/dl6ICLgl7T
TLSH
T1A9C32B6726B4CAF7D458827409EF52A4C299F5154132B68DB7C4DF303F8B83E4B2E992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblz4-java.so

Path C:\Users\Admin\AppData\Local\Temp\minecraft_offline\instances\1.21.11\natives\liblz4-java.so
Size 508KB
SHA256 885eca7cafb15f380271af76bd69f9fc2899b356ac2943894ccaad6eb729b391
MD5 967b286de75a9bb5f985f99909f1bbd6
SHA1 165e4baaf0dfb5cc583295fda8bb93002207462c
SHA512 ad5d92f617dd341bcfa5401f28917aad6a844188cf0e957fedfdf7ec9d84b3d44039fcb8de4977e136c13ae1c8233ec1acbd668ac98aa3092142ce756c7828f8
SSDEEP 6144:EYNLwWQOJ1/JFYTfV+6RvZ/t7tb/yoBt5DSbBVE/JhNrVCxppUdE79LNSVcxxxN1:/3/MbhZ/tZtdWEx30TUUJ64peUAXd4
TLSH
T1CEB46D41E182FDF8C8969FB862E2531693B7B0449729F63FAB54FF380429E54E435B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2220_284922531\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2432-1137-0x0000022C9A300000-0x0000022C9A301000-memory.dmp

Download

memory/2832-7905-0x0000017854B50000-0x0000017854B51000-memory.dmp

Download

memory/2928-2307-0x0000023016C50000-0x0000023016C51000-memory.dmp

Download

memory/3184-6669-0x000001EBF1B10000-0x000001EBF1B11000-memory.dmp

Download

memory/3184-6668-0x000001EBF1B10000-0x000001EBF1B11000-memory.dmp

Download

memory/3184-6670-0x000001EBF1B10000-0x000001EBF1B11000-memory.dmp

Download

memory/3184-6599-0x000001EBF1B10000-0x000001EBF1B11000-memory.dmp

Download

memory/3184-6597-0x000001EBF1B10000-0x000001EBF1B11000-memory.dmp

Download

memory/3184-6666-0x000001EBF1B10000-0x000001EBF1B11000-memory.dmp

Download

memory/3184-6667-0x000001EBF1B10000-0x000001EBF1B11000-memory.dmp

Download

memory/3184-6665-0x000001EBF1B10000-0x000001EBF1B11000-memory.dmp

Download

memory/3452-7893-0x000002913E2A0000-0x000002913E2A1000-memory.dmp

Download

memory/3788-2294-0x000002F27B4F0000-0x000002F27B4F1000-memory.dmp

Download

memory/4136-2282-0x000002C51CDA0000-0x000002C51CDA1000-memory.dmp

Download

memory/4332-1083-0x00007FF8AD550000-0x00007FF8AD579000-memory.dmp

Download

memory/4468-1124-0x0000020A23580000-0x0000020A23581000-memory.dmp

Download

memory/5428-1112-0x000001AA11F40000-0x000001AA11F41000-memory.dmp

Download

memory/5488-1099-0x0000020838890000-0x0000020838891000-memory.dmp

Download

memory/5488-1100-0x000002083A230000-0x000002083A4A0000-memory.dmp

Download

memory/5488-1089-0x000002083A230000-0x000002083A4A0000-memory.dmp

Download

memory/5600-2319-0x00000150380D0000-0x00000150380D1000-memory.dmp

Download

memory/6212-7917-0x000001D159E80000-0x000001D159E81000-memory.dmp

Download

memory/6760-7929-0x0000025BB0E60000-0x0000025BB0E61000-memory.dmp

Download