hxxp://google[.]com

Resubmissions

16/08/2026, 12:19

260816-phpghaan6x8

16/08/2026, 12:01

260816-n69lxaxvbv3

Analysis

user interaction
yes
max time kernel
254s
max time network
260s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260816-phpghaan6x

Score

8^/10

discovery execution persistence pyinstaller ransomware

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
233	4788	powershell.exe
234	4788	powershell.exe
235	4788	powershell.exe
236	4788	powershell.exe
237	4788	powershell.exe
241	4788	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5428	powershell.exe
4788	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
187	2900	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
1520	SteaMidra-6.6.4-Setup.exe
2236	SteaMidra-6.6.4-Setup.exe
3640	SteaMidra_GUI.exe

Loads dropped DLL 60 IoCs

pid	Process
1520	SteaMidra-6.6.4-Setup.exe
1520	SteaMidra-6.6.4-Setup.exe
2236	SteaMidra-6.6.4-Setup.exe
2236	SteaMidra-6.6.4-Setup.exe
2236	SteaMidra-6.6.4-Setup.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe
3640	SteaMidra_GUI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0004000000006f2f-5098.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1980	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteaMidra-6.6.4-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteaMidra-6.6.4-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5104	dotnet.EXE
4280	dotnet.EXE
6056	dotnet.exe
2900	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313564149270748"	msedge.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	SteaMidra_GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	SteaMidra_GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff	SteaMidra_GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	SteaMidra_GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5c00310000000000105d07631000535445414d497e310000440009000400efbe105dd562105d07632e000000f96b0000000004000000000000000000000000000000baecd80053007400650061004d006900640072006100000018000000	SteaMidra_GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	SteaMidra_GUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{7B24A57D-055E-4448-BF32-60061CCEEE2E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	SteaMidra_GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	SteaMidra_GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	SteaMidra_GUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	SteaMidra_GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	SteaMidra_GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	SteaMidra_GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	SteaMidra_GUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	SteaMidra_GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	SteaMidra_GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	SteaMidra_GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f44471a0359723fa74489c55595fe6b30ee0000	SteaMidra_GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	SteaMidra_GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c00434653461600310000000000ad5c0492120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbead5c0492105d85622e000000fb05010000000200000000000000000000000000000095a39c004100700070004400610074006100000042000000	SteaMidra_GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	SteaMidra_GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	SteaMidra_GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5000310000000000105dd56210004c6f63616c003c0009000400efbead5c0492105de5622e0000000e0601000000020000000000000000000000000000006ff1e1004c006f00630061006c00000014000000	SteaMidra_GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2"	SteaMidra_GUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	SteaMidra_GUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	SteaMidra_GUI.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3640	SteaMidra_GUI.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5800	msedge.exe
5800	msedge.exe
5428	powershell.exe
5428	powershell.exe
5428	powershell.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeIncreaseQuotaPrivilege	4788	powershell.exe
Token: SeSecurityPrivilege	4788	powershell.exe
Token: SeTakeOwnershipPrivilege	4788	powershell.exe
Token: SeLoadDriverPrivilege	4788	powershell.exe
Token: SeSystemProfilePrivilege	4788	powershell.exe
Token: SeSystemtimePrivilege	4788	powershell.exe
Token: SeProfSingleProcessPrivilege	4788	powershell.exe
Token: SeIncBasePriorityPrivilege	4788	powershell.exe
Token: SeCreatePagefilePrivilege	4788	powershell.exe
Token: SeBackupPrivilege	4788	powershell.exe
Token: SeRestorePrivilege	4788	powershell.exe
Token: SeShutdownPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeSystemEnvironmentPrivilege	4788	powershell.exe
Token: SeRemoteShutdownPrivilege	4788	powershell.exe
Token: SeUndockPrivilege	4788	powershell.exe
Token: SeManageVolumePrivilege	4788	powershell.exe
Token: 33	4788	powershell.exe
Token: 34	4788	powershell.exe
Token: 35	4788	powershell.exe
Token: 36	4788	powershell.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3640	SteaMidra_GUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3184	1548	msedge.exe	84
PID 1548 wrote to memory of 1568	1548	msedge.exe	85
PID 1548 wrote to memory of 2900	1548	msedge.exe	86
PID 1548 wrote to memory of 1568	1548	msedge.exe	85
PID 1548 wrote to memory of 1568	1548	msedge.exe	85
PID 1548 wrote to memory of 3152	1548	msedge.exe	87
PID 1548 wrote to memory of 3152	1548	msedge.exe	87
PID 1548 wrote to memory of 1380	1548	msedge.exe	89
PID 1548 wrote to memory of 1380	1548	msedge.exe	89
PID 1548 wrote to memory of 4988	1548	msedge.exe	90
PID 1548 wrote to memory of 1380	1548	msedge.exe	89
PID 1548 wrote to memory of 4988	1548	msedge.exe	90
PID 1548 wrote to memory of 4988	1548	msedge.exe	90
PID 1548 wrote to memory of 2552	1548	msedge.exe	91
PID 1548 wrote to memory of 2424	1548	msedge.exe	92
PID 1548 wrote to memory of 2552	1548	msedge.exe	91
PID 1548 wrote to memory of 2552	1548	msedge.exe	91
PID 1548 wrote to memory of 2424	1548	msedge.exe	92
PID 1548 wrote to memory of 2424	1548	msedge.exe	92
PID 1548 wrote to memory of 3044	1548	msedge.exe	96
PID 1548 wrote to memory of 3044	1548	msedge.exe	96
PID 1548 wrote to memory of 3044	1548	msedge.exe	96
PID 1548 wrote to memory of 4840	1548	msedge.exe	97
PID 1548 wrote to memory of 760	1548	msedge.exe	98
PID 1548 wrote to memory of 4840	1548	msedge.exe	97
PID 1548 wrote to memory of 760	1548	msedge.exe	98
PID 1548 wrote to memory of 4304	1548	msedge.exe	100
PID 1548 wrote to memory of 4304	1548	msedge.exe	100
PID 1548 wrote to memory of 5076	1548	msedge.exe	102
PID 1548 wrote to memory of 5076	1548	msedge.exe	102
PID 1548 wrote to memory of 5076	1548	msedge.exe	102
PID 1548 wrote to memory of 3496	1548	msedge.exe	103
PID 1548 wrote to memory of 3304	1548	msedge.exe	104
PID 1548 wrote to memory of 3304	1548	msedge.exe	104
PID 1548 wrote to memory of 3304	1548	msedge.exe	104
PID 1548 wrote to memory of 4704	1548	msedge.exe	105
PID 1548 wrote to memory of 4704	1548	msedge.exe	105
PID 1548 wrote to memory of 4704	1548	msedge.exe	105
PID 1548 wrote to memory of 5884	1548	msedge.exe	108
PID 1548 wrote to memory of 5892	1548	msedge.exe	109
PID 1548 wrote to memory of 5900	1548	msedge.exe	110
PID 1548 wrote to memory of 6068	1548	msedge.exe	111
PID 1548 wrote to memory of 6068	1548	msedge.exe	111
PID 1548 wrote to memory of 6068	1548	msedge.exe	111
PID 1548 wrote to memory of 3848	1548	msedge.exe	115
PID 1548 wrote to memory of 3848	1548	msedge.exe	115
PID 1548 wrote to memory of 1788	1548	msedge.exe	116
PID 1548 wrote to memory of 1788	1548	msedge.exe	116
PID 1548 wrote to memory of 1788	1548	msedge.exe	116
PID 1548 wrote to memory of 5356	1548	msedge.exe	120
PID 1548 wrote to memory of 5356	1548	msedge.exe	120
PID 1548 wrote to memory of 5448	1548	msedge.exe	121
PID 1548 wrote to memory of 4348	1548	msedge.exe	122
PID 1548 wrote to memory of 4348	1548	msedge.exe	122
PID 1548 wrote to memory of 5800	1548	msedge.exe	123
PID 1548 wrote to memory of 1520	1548	msedge.exe	124
PID 1548 wrote to memory of 2236	1548	msedge.exe	126
PID 1548 wrote to memory of 4688	1548	msedge.exe	127
PID 1548 wrote to memory of 4688	1548	msedge.exe	127
PID 1548 wrote to memory of 5844	1548	msedge.exe	128
PID 1548 wrote to memory of 5844	1548	msedge.exe	128
PID 1548 wrote to memory of 4992	1548	msedge.exe	129
PID 1548 wrote to memory of 4992	1548	msedge.exe	129
PID 2236 wrote to memory of 5428	2236	SteaMidra-6.6.4-Setup.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff8cb01c188,0x7ff8cb01c194,0x7ff8cb01c1a0
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,8307240357933211170,10872348985818329382,262144 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:2
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,8387970637036024818,11695996877986757566,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,2801275330435170474,13787577290918508744,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,931285041078369141,13560703840215435789,2097152 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,12724760565813736441,15061764466484473366,2097152 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4120,i,1041624571520794692,11886496666392337423,2097152 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:2
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,17508397689421715747,10131295814872443247,2097152 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5104,i,14690433179473432178,6195025531434383832,2097152 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,11303849591043393968,10145313869442276361,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,5526392056454621207,7987222172933500569,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,14012645285791478947,13379398789538351299,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,14231146980243372079,14981148942543596604,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6192,i,10019607405770137174,893741426258058811,2097152 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,14231146980243372079,14981148942543596604,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6596,i,10304692639710514824,11148489005939802698,2097152 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6748,i,17565971939805332503,10692938672921576993,2097152 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,4580959680375594971,11938563998564608557,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,1493092803958507125,9725996552599774344,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,13849855032885067710,14523017721189534856,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=600,i,18400706969267724154,9127694677475600411,2097152 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,2778075564853836855,2503880892502197712,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3612,i,9651836389230786870,7204122809773334642,2097152 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,15534089033693284683,7775964465460621423,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:8
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,4738142358633634330,16285297055333125027,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=776,i,3164108515587796101,10801896730870376160,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6440,i,7278092782069953636,553352221561001058,262144 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5800
- C:\Users\Admin\Downloads\SteaMidra-6.6.4-Setup.exe
  "C:\Users\Admin\Downloads\SteaMidra-6.6.4-Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1520
- C:\Users\Admin\Downloads\SteaMidra-6.6.4-Setup.exe
  "C:\Users\Admin\Downloads\SteaMidra-6.6.4-Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5428
- - C:\Users\Admin\AppData\Local\SteaMidra\SteaMidra_GUI.exe
    "C:\Users\Admin\AppData\Local\SteaMidra\SteaMidra_GUI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:3640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:1980
  - - C:\Program Files\dotnet\dotnet.EXE
      "C:\Program Files\dotnet\dotnet.EXE" --list-runtimes
      4⤵
      System Time Discovery
      PID:5104
  - - C:\Program Files\dotnet\dotnet.EXE
      "C:\Program Files\dotnet\dotnet.EXE" --list-runtimes
      4⤵
      System Time Discovery
      PID:4280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmp_rf3x26p.ps1 -Channel 9.0 -Runtime dotnet -InstallDir C:\Users\Admin\AppData\Local\Microsoft\dotnet
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4788
  - - C:\Users\Admin\AppData\Local\Microsoft\dotnet\dotnet.exe
      C:\Users\Admin\AppData\Local\Microsoft\dotnet\dotnet.exe --list-runtimes
      4⤵
      System Time Discovery
      PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,14606182686099924226,925285551867266374,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,3576436796958016138,5175504201543375479,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,1789280414973047106,75837115011983100,524288 --field-trial-handle=2816,i,14678583864317389999,16058092971223736274,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2292

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x344
1⤵
PID:1728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b272682ea7906ec234a6adc97e866d560199bebccc90035515a0506daa0cbc06
MD5 2087307a98b68b7455e5b6644cd1f9a3
SHA1 5d88b0b7fb83ec055322678c804aba5282ce7133
SHA512 e552a0107a66abdfc9962bce37c7382a3e669bf5b4fc9be6fecd515362f46a954409460e0d29930c8e1cf7c0244a03613787b1a6084a6a6c12161668dbb2f5b8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7b:fwUQC5VwBIiElEd2K57P7b
TLSH
T18EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0382957c99791bbf37f0a292a68a688ba898893f53c7be2d420d0abfa3205949
MD5 80e81afd519a94b0e3f1e843218d3393
SHA1 093d55b2a0251e8969cd893db151c2617d83ebb1
SHA512 192644826f1731a384b4a8a62d6df749510036d4f447f976a99b3b16ab73b188a9f8602e8e5e57f53a4ecc919d28bd8b5b97a0d5dd2b3cfaa58fdd196e2db9a1
TLSH
T148D08033364D6002D7A573B3D447CF45175E557415525601F124D54CD6F50C49397686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eb6e4c3c1ff9ed97bb67aeb0d434ffe02961fef2204006156de0c8016e804f8c
MD5 ad47d0f507ef049d8589a010a5742cb0
SHA1 b6cd0d47a5138ac8c4b9f43cfb419391ca142fa6
SHA512 8347fe69939685ced24d8db2ac65a696d817ae5d3cc9eaadabcc077032027d0ae50a34c8744211ec16388506f4257888fbaa081dbfc2aa366d9e0e40c78e2b89
TLSH
T1ABD08033368D6402DBA573B3D447CF45175E557415529702F124D54CC6F50C49397686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c025ca4a8a54a01ba99823ecfa4b88bf012ba2b8cfc1d42bb63e3ab0170c2984
MD5 8457850c1af2ef9a0e2177f910432099
SHA1 56963a31e124e963046b188feabca3e9eda5419c
SHA512 2ea2cd651e6b6fdf5a870b5f50a8ebdc54b1dc648f6a62a4bdc510805c70bb1df5b938518d72178d0207652c4351808eda83a53b694d22c3b18cc2ededdc27b6
TLSH
T142D02370755D55D2C578227644601E40272D4A7526975382A065540CDBF0040D2FBEDD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 600c23df91832f3466172ddf0671bb63dbeeed07a178b3f94985e1e85b4feb85
MD5 be7331634bd351169e0a23fa540387d1
SHA1 a475356448481b09d67f8a17edd0d769346f0a93
SHA512 3118ca1eae50035f1ac2b67d8d8c3c0c4a056125a3b875027915eac98ff3ae4d2a54bed25837b7e52c764b7bbb0d0f3662bd1b744c5c9f75e03a65f029c24cfa
TLSH
T15AE07DEA14CAC22F9A80E9CB5174630C8A80370EE2CCB9CF7F18848532C1440B7E7591
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 4c9088bfccb35cfea61c4c69b88be4919f835453cb5d303e13c9ea6b733975cf
MD5 7c38979a3aaf5ae6c73087181c443c8c
SHA1 974990cb0ea05bbca556fe80b3fc6e1e1733cc46
SHA512 5f4f3a9a627daa59455c5a671e5f1464b50e24a6a63f9d6de19fb1301a1608dbd0ff1d5a105b1b1e3569ed5bb78bec5a86628e460dd9ea79c2c2e799818f6915
TLSH
T1F5E0DFCB32ECCAA60E469BC7B249BE5E88B07206F69CEEDF3244B1CA644004442464FC
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 d7ec48830964f5cf206465ae72831f5d4a26efd48c9db20a7cf197397330bacd
MD5 3144084790fd15618a39535447e3f3af
SHA1 7d3892bc5598e397cd2624f4c9af09b539ece56e
SHA512 7168e6e0f0b8a6f49772ae87104fb8adabe234a08eb6679f136beca720fdb5a8988dc228e9548fc3d7edfa5bb06705ed943dcd720bf53c70ee8278949b75b14c
SSDEEP 96:BVFB7f1z3cgCA5BF+sZeV56tXAUia/LKh7bFTIzf+RK1Pc77/O:3FB5zMgTPRo6twUnKp2f+ROc7C
TLSH
T183F1B0A4C06B50ECEB12E3B31EC2007431B2547EB0039F46A3E8ED737929BBC675A610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e068.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e068.TMP
Size 3KB
SHA256 126a691ce7db9a8542736606d715879609c6dbb8d0a5645de918c9e4eed7a63e
MD5 1c7fab32998ea95f6493da2a7c2ce11d
SHA1 4528b02cad6061c8e08c11227b3f15412333e7c5
SHA512 1fbe41227d7370cf879911c31123d0293052521d49d92ca706662b533fc138562055c3d8732be4592d29dd045a49a446c38deac9037d644d29e81f791fa5b552
TLSH
T1BB714CF4C56200E4E312C1B2A7C3427835F196BAF913EE86E1ACC9B13D70B71B150758
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 49417fae81b007a7de2e1c41e2c49f8e63d5059ba47ca5dc12a30d878d837065
MD5 d5a4e330acff7ef5cf48e87893a88e9d
SHA1 e8a3f2201cdedf449972584f9e50e2e26ec85e00
SHA512 398e7348910fc93acd471812e26800dbe5907b915741fb93d1b9e5b7d019c7173e788ad551c3281f3acca931db8d5ac92c8a404519ec8c65763ff89edf6e9ee3
SSDEEP 3:MsEllllkEthXllkl2zE1lnAclt:/M/xT02zbc
TLSH
T10544040C7FC1050DC5111430D455C37007F0DCD40575575374710C13DCC55400D400C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 70bd963e7a46da60301a0b42134b4dfdea71d2121cc58ea4f825a39cb1eb912f
MD5 7eebbd01eaffd9fa9a2ee857125102ec
SHA1 88f6ca53df18778192597ef4a2206679283410b8
SHA512 785a8bd5bccac91da9b480a5647149b473fc94940ea993d280d0d1cac61e2e51f834029e577baae789398ce000a5e63bab64008335434e7ddc57cc480ed6f3c8
SSDEEP 192:DD1mQN/Hv242m8MbXBZ/AJy/U9vIgqmrmBmVGmt0kmgme:DD1mQN/Hv242m8MbXBZ/AJy/U9vIgqmB
TLSH
T123E199FBC7E5822DC91256F0AB18AF1ECE1D0618831C3C6AC9D4AE5BD3E2471E151B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ea7bff9a725473d4345a173e3eef37aee6f18aa7f04f27608972568350a1f3a1
MD5 555512b8bd0a392983cd9fd56bdc3140
SHA1 e1688c635da8b8c7a6b0a1ea847bfb5a6cd437ab
SHA512 d01bd9ba0731f4be51ed71205debe145c73940094f57be008d5c1512c7abece18e68f1d46d5fb231fe37dbdbccc63c222a80797c3c57a2d729fb0cf55308253d
TLSH
T1A0D023931B0030B95D7E7D91507FBC4FC327206D4581DDD411D0D868053145C4507185
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe588c4d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe588c4d.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 e8f6b85cedc3ea076aa0a6c50f8182daeb9bcc3b39b0361f832c0af3036e7b34
MD5 18a41495b197bdbe5b83c01dca7923c1
SHA1 1876641f24537e0a7c2796043735e0baae35ad7d
SHA512 539515a6b9bebebe84a3f0b499890afa0a1086a8542a06c9124fcb4a497724e39d526af3214725cc15fc794ae3edcd0cb2b582338c7e3fecfc546f257e995b6c
SSDEEP 384:sxZftiqom4VW/flsToTa8xEvxHbncs/MiO9Fw:s3ttom4M/f+saDHbJMxbw
TLSH
T14582E792692499B7CDCBE209F971BF53D7F5146299900E48ADFCDA1C00E6AFD2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3d81fa48b1942a4c76f9ccb5a5ffd07c12afe454a954ab68010cc2b9a116998b
MD5 e00b9eed2bb45e7522ae6d3e5ad9d305
SHA1 38b83e425e59f09d84ee0e8849dd1d01b32f959e
SHA512 9c1cadf3062035d4600fb6ffd48e2925967562fd48acb5d2de8fb03c5ab78353b30c9986b6756dc3fbf2f38a24360b2f31fbc2ce90ba2a8e6ec62b4fa602ad19
SSDEEP 384:sxZztism1VW/flsVo9l8xRvxHbTs/yiH9Fw:sLtTm1M/f4SlgHbyyGbw
TLSH
T13372C6926A34D977CDCAD209B931BF53D7F5046299910E48A9FCD91C04EAAFD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2ab6f2f46b08360c144dcfbc49f96897711ecc396c5ad0f3157408f611808869
MD5 c7ef2c30921fc9eebd820200d853f58b
SHA1 f90930250425c7266931dd02c5f8f10991d9a779
SHA512 f1cd5235bf924855d3c1a1392dcc69971c5e840234d750e1402acb9a7e0a86c5114e8fa2ec182731956948d8aafd77f2872c8c28b4ada34cb95a7505b4a5b984
SSDEEP 384:sxZftism1VW/flsTo9a8xSvxHbTs/yio9Fw:s3tTm1M/f+SaVHbyyzbw
TLSH
T11272E6926A2499B7CDCAD209B971BF53D7F5046299910E4CADFCD91C00EAAFD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 e68cf33bf1ce858dca50eb654fca5ab299e705efd24aaba5b07b3d6f9d00cecd
MD5 2ee86042a0b339d4dac6f59a9b73eddc
SHA1 71dacab83089c841e1810af25d6977083a816cac
SHA512 442a36f495fa0834a24aa0f5d77003848d3f6cec2143733f1602a7c489d4357c0514b5f430218cbc4676763cfd91d95e7ae3d9e3da55c61e8cac4244de811362
SSDEEP 384:sxZftiqKm4VW/flsIWvpoTi8xEvxHbaP6cs/RuM9Fw:s3ttKm4M/fhYpsiDHbTRbbw
TLSH
T10692E692693499B7CDD6E209F971BF62D7F5146299900E48ADFCDA1C00E67FD2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 868599196fcd558814428595205f22e84eafb24fd641629cf5a48453baac0f77
MD5 61baee6af943eb776979cb40b989bc55
SHA1 09668abb4565f44775d3a249062940d752625d9e
SHA512 a0be92d9c4b15e4a036cf78812f995b0fecca2b9f904f2199f894d3f32090b15f3fc38197602af8f2042c3ffcb57023c58bdf76e63cdb2ccfb719b7e4d4d8917
SSDEEP 384:sxZftism4VW/flsToTa8xSvxHbncs/riO9Fw:s3tTm4M/f+saVHbJrxbw
TLSH
T11B82F792692499B7CDCBE209B931BF53D7F50462D9910E48AEFCDA1C00E66FD2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0169ab8461d54c675171d670f8218b2a79feb2d17cdfaad3e474192824f2e933
MD5 6e3f6a6d85f8c7415f8272745932c0de
SHA1 e7131b91edc9ff5411eca13767a5fc0824251398
SHA512 a6c35c2b2a7a62428909fa9cfd410418b378cf8a74c12966a8144045b4cf8a0f859e84cd54ee444f649899b6f02ab73098a38cf00ea638d606d1497f8be0131f
SSDEEP 768:PQEPO/KWvWeI58F1+UoAYDCx9Tuqh0VfUC9xbog/OVKqLlBHu1AroAvGSN:PQEPO/KWvWeI5u1jafqLXO1LfSN
TLSH
T198D20B3B680CCB7E4F840E9DEC26AF966ED801CB67984D5447FA884C03C77EB511699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b585c20ab83ce8d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\5b585c20ab83ce8d_0
Size 191KB
SHA256 fb6fb3dfba75a9a35f6a3c94c170faca419d8e06d505cdcdc2c053831b6849c6
MD5 d7138752702053e356cc017b02c3ce19
SHA1 710ff976476a863dd669eb8f31720b7972c2651b
SHA512 dbea8a9e650eb35b98afb93a5e3d6cb38a3ae4573c6d5645ce679a5ea873011c20ae975d0c67d88251aba0790e99580ecd642758a0d2131f0dcfc09fcee08f91
SSDEEP 1536:xo/ANGJTtVk4iGmUBDznBChn/jSIClB/wCULnq2W3670mRovNarJUuB6sIncU8XO:CSXUVzB2SICY10HobVIP8XrjvyPP5
TLSH
T169146B755200F47BB913DE60A27E7F4E3C39A16BDD0686FCA5D4E870AAD2DF20521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a644fc213e1f55be6877733fc7930acae906728cb6ca4e5d3ee7f4d810a40046
MD5 1d9533e4a3b28800c7c610f57c8cbd3f
SHA1 a98e939bdad7d32ee08d950cca33ac8328927785
SHA512 2514e180fb8a8aba16de28da5e9ca5d5ff60573bca23eea26a960de02a59ff4c7d9d705e121e93c5909c058c3acdad37fca5d9ed13dc2daf96e28c415e2ee9cd
TLSH
T102A0022413C14A47EC40467050C56780635589600729DA1788D00C59CCB33418951934
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ef4e3493827e5ded852d1a4dcb70b848c80b3e8ecf5896180adbb4519cb1ba1a
MD5 0e68e289f0681537bef4b771c2d17d29
SHA1 ddc2e0091448bfa9249abbeb820c2afb42117536
SHA512 2950211c67e23f9b6baf031157e4332b3663d1881e35bd9fbedc22a3367a115695e16dae11222e4a0f71afba373c321259b0a2b36d64288ed059da0add3f5431
SSDEEP 24:KdD6fDtD2DnaD8dDQDsDo4DYDE+D7IjDSDoKiDrhaDEDo1EDyD4SmDGMDv8DaDlv:KAfI5KIYM/yVlIFKOQQ/yFzIZKI4Mg4
TLSH
T1B591E443703A124228BE244C92678B375D473377746AE7AE375608751D2BE222EFDACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14fb8a05-9a13-43fc-bdd1-37dc25b103a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\14fb8a05-9a13-43fc-bdd1-37dc25b103a2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f6b18d36acd99f74a1ff3d285d438b59af4a5bf86afdba80783fbfaaed04a223
MD5 eb53ce1d04a90f7ee9826c6529392c09
SHA1 24fc15a1b475d9c4c9c16f077cb372c1890850c3
SHA512 9e2d46d1d33a0b74bfe698a0f0e1abcc690964414287a4aee36e9031f1236d7c4e93082d9e9fa2c1c792c39bf3cd29cfe0db7c61582a268dcc21cb4963737966
SSDEEP 384:nZcIhsNYUkd3r+vT92VXq6sOx+SYiyOOPrXLpe8C/StU:Ph69E6Oxf5yOi9PztU
TLSH
T176927EB1AD786C677DF6B645F44636078FF8502BF3C46B9495ECAB0C05DA16C030AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c856f476e3f4cb005a898e19cbed0f3fb1c511f93cf15d48b816c6ae89491189
MD5 f65ce428bff2405a2a09e36e57465f42
SHA1 5a0366deceb76cbe3dfc64b3ba706bb40214158e
SHA512 8c1a29e8e9c0ebf7d6d45d46e92b6013a03ceb40dd433473c7b067d3f2a2aeee517980768644d495a2e5a9e8f7bf07cfd5d468afff58f7e8ddddda25fc7aa350
SSDEEP 384:7iFiZcIIsNZ8TUNTUlIlks3r+vY92VXq6sOx+SYbyOOPrXLpe8C/StU:WFQI4wg59E6OxfqyOi9PztU
TLSH
T18CD219F258D79836EDADAB47A77D2E028EBCD027F1846694B398960CCC9617FC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7b56cb37603c33c827ee5d28e03c83880fb73dfbd511cc6571c197f40df51137
MD5 7c327413d7563fb139b5b3441c958ea9
SHA1 9351affabadff1d74f40a783fc9734d1608b43e6
SHA512 f23e4f0465e76a2c2a63dcced899d10d4a179fe71c41d26c9ffd44cd5d0a55eaa90e2e11d6042b9174e0ce60074210616f2502c955825d20b6cfba8d419cee4e
SSDEEP 384:7iFYZcIasNi8TUNTUlIlAs3c+vY92VXq6sOx+SYNyOOPrXLpe8C/StU:WFmahwgO9E6OxfqyOi9PztU
TLSH
T12BD219F258D79436EDADAB47A77D2D028EBCD067F1846690B398960CCC9617FC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 98298a9f60cfa23b849f8e7dc2c23199bf4ef4ac544a1b5b289e67effa2c164d
MD5 e15a7918c394b12a41f27cdcda238e9d
SHA1 43d60d522808fea48182c27cf6ca8e31632b83e7
SHA512 6d0698aff0b73cb5c9f499c0a102127e9cda0beca8b2855848f6277f64c53b482f29ecfd48453cfcb974dd8f268a7780e6485481e68b598e485c090a3d9ae9a0
SSDEEP 192:mONI6rvoQmiUyAKODrKhD4XqMB/1jmOBr+ZEx2oU6:mONI6cN+6Xq6sOx+yrU6
TLSH
T1E402D735796D6C779EE66E49F0873B135FA4203BE6816B84DAE81B1C00DB25C2306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d26d7e8ef64d4d2390049d971f87bb566188a3115c13bb96f1ad9b4127a037d5
MD5 a0f3252d547a56337c272a0e59323c32
SHA1 8241fa2f07eb15f94af0321028c86f2e74ab3c05
SHA512 f1cfde9e1b69c518b1efc1554c410e1d0f7518668bdad7450d71d72a0934c6a82a4b049731875f34b0bd43e24aef3c7b1f2335f6329a90c12cd71cadd16bfe46
SSDEEP 384:SZcIhsNYUks3r+vT92VXq6sOx+SYiyOOPrXLpe8C/StU:gh99E6Oxf5yOi9PztU
TLSH
T12E927DB1AD786C277DF6BA45F44636078FF8502BF3842B9495ECAB0D05DA26C030AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 92bd02c2f1d45328a449286365d10fc6d19908e5019c14673ba29341b4a9a49d
MD5 a69123ada2cd970f64fc54864b60143a
SHA1 89fabb601fe9e9fe3f4df1e56ab4abf4ba1a1295
SHA512 6d8e44c8917fd59ea456d3325921a52e900821da8a2842b921d1810da329a7848c277c004ab3460c93dbdc3575d76d85bf8a1056cfc3c972d47eb4e85bce9b6b
SSDEEP 384:7iFDZcI4sNX8TUNTUlIRAsc1+vY92VXq6sOx+SYByOOPrXLpe8C/StU:WFb4iwgo9E6Oxf+yOi9PztU
TLSH
T12AD219F258DB9836EDAE6B47A77D2D028EBCD027F1846690B398960CCC9617FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1fa5a06167cfbed85b2ab506773feac0e7c0a4c40ee9e320a2d8d4c6965a3a0f
MD5 5b5ebe9d06e2cbcddf63884b09fe459c
SHA1 ccf9bddcc848fd67077a3b20e976f20512574cef
SHA512 0f810b3fe2ffbbc8b171af2ab2287cfb5b94980d5bb123bf624c5c6c48d88ed014ac211e3d389fd40a0182da484b846751a458d58bf6aee2a654c2ec7b222d56
SSDEEP 192:EONa6rvUQmiUymOD8hD4XqMB/1jmOBr+ScFJICYq4FU6:EONa64u86Xq6sOx+SYtyU6
TLSH
T1EB12F9726968AC376EE27645F08735135FA4512BEA857F80D5EC2A1C01EF66C130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7beaae682b6c20414cf02de6990c04052c191be91f70680cd69d3039d73e23a7
MD5 f6abd977425a2237e2f38cc33c63cc06
SHA1 3d4c0f077b426bd4baaad63fec14357942164eab
SHA512 61a4fbce8670308417ad72dd9b99691fbc316b81346749ab05c8cfde2980e82a679baba934f283294de9d2a9cdb64567772ba8caad6087094b665fda6bd8d93d
SSDEEP 384:7iFoZcIIsND8TUNTUlIRAsck+v692VXq6sOx+SY4dkoMmpzu9vfMY4OOPrXLpe8u:WFWIywgP9E6OxfrrMN9naOi9PztU
TLSH
T1D7F25BF99CD6483AD9AEAB07A73D2D164ABCC13BF1A05458F394470CCC6607FE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 04dc4ac3babdfa74e7088d06c8adc3412d8d41647d09a55e1fddb35ef2d2e8fc
MD5 b4e059b32c2d9395edaf42fba3a7b76c
SHA1 063960c6c21b1ce8edc400dc1f768af3ef0734ef
SHA512 757e25321d3b021d1ea6ac0f53beb3ff0c2b36d983101bcf1601e90155bf1aefab1ccbe53ee4974802c6bdb73a14c0319dcb0e90c9dd5a55184abeab449c6584
TLSH
T128E004D5D1004175CC1C473054C3155517D0400007F30145551141753C133001530F4C
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5874dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5874dd.TMP
Size 392B
SHA256 a474a7ee63ebfaf26976c01f89fb2b30f657f3cf24273acf5488ddb7451003e7
MD5 4a5e80d2818871589506994fb2668329
SHA1 6b2f54c20357015ad39f32e38b59e674198f7515
SHA512 7e414b482161889dbf072cade9a9450cfcf9df9e9c487bb1883bd19c1ad1b3aa8407efe9b51c92135e0c44639575d467117fb1172e72c63bdace669166ce9483
MD5 SHA1 SHA512

Submit Download

430c0d62-2a82-4b3d-b5d3-98a3479916e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\430c0d62-2a82-4b3d-b5d3-98a3479916e8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 55fbde7743a2927af3047c7c69981920f19249718d2bb96f705ffc71398c8bad
MD5 903b9b2d80e9fa05cc527d38bef15110
SHA1 974846a10306640771e99ac629df29740c688b4e
SHA512 e28c7f7b53f22e983982928b367082378a924479949c15baadcfe152a1d84e7bfb2e9cb9b5cda6c21fc305c2bcd7c5a21a2bb47b81851e885d50c167d7daee8b
TLSH
T19F412659B6ED0108B3B33F599FF6A96E587EB9772F06D45E10110E4F0A63A40C9A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

SteaMidra_GUI.exe

Path C:\Users\Admin\AppData\Local\SteaMidra\SteaMidra_GUI.exe
Size 16.4MB
SHA256 4e4ee640db6cd60ae8ac6f74c15b03f1b562430b221ba313d6e8576156bcd2e0
MD5 d7a30ee7524b33e04823beb72d7134a9
SHA1 1c6022a7adb3b4abff68462ba0a85b256d3ab5e5
SHA512 353c86d40a106e4358609fd7d718d7d45b88c657b543b24b5bf61b92509f9c3aba9066c7258e2726a12e67c5eb5f67a267bb9021c04b8aaa060260dafbd622e4
SSDEEP 393216:dxyveFRNyqt0xioj6c3d0eo3gBZfVxp5aS2HXytssKDv:dPCiC6c3XoQBFLlwyttKT
TLSH
T1CD073344D6D614A3E6FA003FDC6FD569A272EC800722C8DF0B40BB7C6967EA41539E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quicktooling.qmltypes

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\PyQt6\Qt6\qml\QtQuick\tooling\quicktooling.qmltypes
Size 215B
SHA256 a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
MD5 2006d4b7d0da455aa4c7414653c0018a
SHA1 6685b8360b97799aa4d6b18789bf84a343e9e891
SHA512 703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84
TLSH
T18ED02352CEECF6A313451C16C44C47E72E53D1544731AD10F05401ED714771C36ABBC5
MD5 SHA1 SHA512 TLSH

Submit Download

qtlocation_en.qm

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\PyQt6\Qt6\translations\qtlocation_en.qm
Size 33B
SHA256 494ac9a2b2cb2fdeced353f4a9f898ed8dcf616e9bc667438c62681e3f7f79cf
MD5 aaea7ba475c961f941d0a23488457beb
SHA1 2bf0054002c8f7d85dd080df332553bf9b3a8e26
SHA512 5b408c36c8f93f71e73e3d3b1c0c2ad699e92a6088604b8adf8e588e8a75fc3fc92828199b7f00f5b05b224ae819220d07e56d610a76a267594870bec77172be
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\_bz2.pyd
Size 84KB
SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 2be172c3086efe56c7e1d3279142295a
SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
TLSH
T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\_ctypes.pyd
Size 124KB
SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
MD5 9314ab9707985aaf6e234b5c1fc3c3c6
SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
TLSH
T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\_lzma.pyd
Size 157KB
SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 7c25a079b992919cc97221955dac050c
SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
TLSH
T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
MD5 9f746f4f7d845f063fea3c37dcebc27c
SHA1 24d00523770127a5705fcc2a165731723df36312
SHA512 306952418b095e5cf139372a7e684062d05b2209e41d74798a20d7819efeb41d9a53dc864cb62cc927a98df45f7365f32b72ec9b17ba1aee63e2bf4e1d61a6e4
SSDEEP 192:xt/cOTWthWfWJWadJCsVWQ4OWKNVAv+cQ0GX01k9z3A1tUXj:xpcgWthW2CsjNbZR9zOtUX
TLSH
T137A219D38EAC8546F8AB9D7046E8DA437C3E6BC71950615525F8F55C2CA33C1EB20B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
MD5 8f8eb9cb9e78e3a611bc8acaec4399cb
SHA1 237eee6e6e0705c4be7b0ef716b6a4136bf4e8a8
SHA512 5b10404cdc29e9fc612a0111b0b22f41d78e9a694631f48f186bdde940c477c88f202377e887b05d914108b9be531e6790f8f56e6f03273ab964209d83a60596
SSDEEP 192:xVIWthWWWEXCVWQ4OWGwvNVAv+cQ0GX01k9z3A1tUG71A5q:xVIWthWJoNbZR9zOtUG7mq
TLSH
T1A4A218938AAC8143FCEA2D7012E8DE83BD3D63D71A40916616E4F4582D937C1EB20B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
MD5 226a5983ae2cbbf0c1bda85d65948abc
SHA1 d0f131dcba0f0717c5dea4a9ca7f2e2ecf0ad1c3
SHA512 a1e6671091bd5b2f83bfaa8fcf47093026e354563f84559bd2b57d6e9fa1671eea27b4ed8493e9fdf4bde814074dc669de047b4272b2d14b4f928d25c4be819d
SSDEEP 192:xqWthW8WEXCVWQ4iWUAURDoSJj+iX01k9z3A0FCH1Whf:xqWthWH/DX+iR9zHFCMf
TLSH
T194A23BD68BBCC142F9DBAEB0529CDA437C3C57C71A10D16646A5F19828D33C4EF20A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
MD5 c2f8c03ecce9941492bfbe4b82f7d2d5
SHA1 909c66c6dfea5e0c74d3892d980918251bb08632
SHA512 7c6c85e390bbe903265574e0e7a074da2ce30d9376d7a91a121a3e0b1a8b0fffd5579f404d91836525d4400d2760cb74c9cb448f8c5ae9713385329612b074cf
SSDEEP 192:x3XmxD3TsWthWBWJWadJCsVWQ4iWozCCtvpGX01k9z3AtYF2LkQ9:x3X0sWthWgCsJZpGR9zMlkE
TLSH
T111A229D686BC8143F9AA6DB042D9DD433C3D6BC65E5150260AE9F1581C973C1EE24F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\api-ms-win-core-fibers-l1-1-0.dll
Size 21KB
SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
MD5 b5e2760c5a46dbeb8ae18c75f335707e
SHA1 e71db44fc0e0c125de90a9a87ccb1461e72a9030
SHA512 c3400772d501c5356f873d96b95dc33428a34b6fcaad83234b6782b5f4bf087121e4fd84885b1abab202066da98eb424f93dd2eed19a0e2a9f6ff4a5cfd1e4f3
SSDEEP 192:xLWthW6WJWadJCsVWQ4KWeeLrp0KBQfX01k9z3A3WXa0Sr0:xLWthW3CsneRxB+R9zcWXJB
TLSH
T1B5A21A815A7C8187FDAB6D7042E9EA973C3D67C72E5090AA45D4F5582CD33C4AF20E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\api-ms-win-core-fibers-l1-1-1.dll
Size 21KB
SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
MD5 050a30a687e7a2fa6f086a0db89aa131
SHA1 1484322caaf0d71cbb873a2b87bdd8d456da1a3b
SHA512 07a15aa3b0830f857b9b9ffeb57b6593ae40847a146c5041d38be9ce3410f58caa091a7d5671cc1bc7285b51d4547e3004cf0e634ae51fe3da0051e54d8759e1
SSDEEP 192:x8sWthWXWJWadJCsVWQ4KWqSY00pyEuX01k9z3AxzIsZ:xLWthWOCs4EpcR9zwpZ
TLSH
T130A23B829EBC4143FDABAE7043E5DA873C3D67C71D90A0A61594F59C1C973C4AB20A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
MD5 9f45a47ebfd9d0629f4935764243dd5a
SHA1 86a4a0ea205e31fb73f3bfcce24945bd6bea06c7
SHA512 8c1cdcad557bff1685a633d181fcf14ec512d322caeaeb9c937da8794c74694fe93528fc9578cb75098f50a2489ed4a5dedf8c8c2ac93eeb9c8f50e3dd690d5f
SSDEEP 192:xWwhDPvVr8rFTsvWthWoWEXCVWQ4KW7OcADB6ZX01k9z3A5tUQv/zf:x7JPvVrhWthWjncTR9z8SQv/zf
TLSH
T10EC22A93D9A4E24BFCCF9E7161A6D9836C3453C7041480CA57D8A75C3DE3386E3A8999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d
MD5 cc228ff8d86b608e73026b1e9960b2f8
SHA1 cef0705aee1e8702589524879a49e859505d6fe0
SHA512 17abd9e0ec20b7eb686e3c0f41b043d0742ab7f9501a423b2d2922d44af660379792d1cc6221effbd7e856575d5babf72657ae9127c87cc5cf678bd2ceb1228f
SSDEEP 192:xPEkMRmKjoRWthW5WEXCVWQ4OWiGfmKDUX01k9z3Alh1EwsPRj:xMKRWthW2XWmpR9zqgt
TLSH
T1FAA21A928A6C8143F9EB6D7052B8EE837C3C77C7195090665AE8F5981C833C5EF24B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\api-ms-win-core-file-l2-1-0.dll
Size 21KB
SHA256 93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989
MD5 e368a236f5676a3da44e76870cd691c9
SHA1 e4f1d2c6f714a47f0dc29021855c632ef98b0a74
SHA512 f5126498a8b65ab20afaaf6b0f179ab5286810384d44638c35f3779f37e288a51c28bed3c3f8125d51feb2a0909329f3b21273cb33b3c30728b87318480a9ef8
SSDEEP 192:x+SWthWjWJWadJCsVWQ4iWKjTnKIjwX01k9z3A24haD:x+SWthW6CsVjTKHR9zp4haD
TLSH
T1BFA22C86DEAC9103FDAABD7042E9D9473C3E67C72940806717A9F45C1C973C5EB20A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\base_library.zip
Size 1.3MB
SHA256 4842158ae3b3254b8d54347a91751452ec2dfd0aa0dec8e21296b5ae0a81b004
MD5 d266ffc78610acb785b0f924b25fad79
SHA1 f63c759413197a445da8cf6f9dad46c2dd7de040
SHA512 2eb01c75f7e8479c0163405ff18e1d73feb160beb7d47851955d41d62db41cf266889129abad0e627100654333b138743a4462dcc7cb2c0f77f8e61a5ccb36ca
SSDEEP 12288:eD8lJGUmmRMnVTVihlyixmpvQXMHYZNxrmn9z9WT/sFw2/H/HbP1dmk3en:q8lJGUpih869z9M52/HvbP1dmTn
TLSH
T1A755D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\gevent-25.9.1.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

osconfig.v2beta.json

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\googleapiclient\discovery_cache\documents\osconfig.v2beta.json
Size 95KB
SHA256 504d4c0cd614814370f6e2bf0f3bff844fbc40de5682afe309854e0308ea6191
MD5 5b7a22ff8e4702a421f97c796bacf304
SHA1 e6efcd23abca12b3940867a1f71b5653787f0d76
SHA512 759fda7b2833b909ab4a7893ea91648f892b3afe76ec309f3ce88431e38f247ef9200e1481f97e5444ad5b22a6f8703658071551b39ceae0068a24cff7d741d8
SSDEEP 1536:PbRiclrzy84T+qSk+Ng6kqTqS+SS1UjfXz+gCX2Hin5kb:PbRiclrzy84T+nex1UjfigCX358
TLSH
T1B593A5839D4AC3330AFB968AAF787286EB30929CF35058B98CDC521C51D97B652733D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\python3.dll
Size 68KB
SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
MD5 962428e9e68d43ecc16f3e33f2ea8667
SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
TLSH
T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

account_avatar.jpg

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\third_party\gbe_fork\steam_settings\account_avatar.jpg
Size 3KB
SHA256 58f08592a940bcd85a9620b52c262b6ce1cd7a4b6cb6a3b6494028614794d2b2
MD5 fafa340202b7f16015984c90062f7b2a
SHA1 1408fed0c29ecac789028f2e12ca81d15a4bfe92
SHA512 e1fdde11fa7f03690655acde81d9d621e1ee3e08c4af7527057caef04b38dbcc60f9acec47161d6c6127faceca49b59bb9bd51fb3801a1545c80de59e318df53
TLSH
T1F961A3137CC1CEB50D36C7397C07172EBB8828294E14E79E54222DA9B8F8AE08D4CD0E
MD5 SHA1 SHA512 TLSH

Submit Download

trigger_l_click.png

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\third_party\gbe_fork\steam_settings\controller.EXAMPLE\glyphs\trigger_l_click.png
Size 1KB
SHA256 f6f9b7869c0835ad1de706e51d1f4da474eb1d646301f6e920d3bcdc3284252a
MD5 404786bf294387522822db6c1621f20e
SHA1 ff70f8e505936549f1949d11e31c4f2e4df8b2f8
SHA512 f83a26e6b9f551ae92d152dc4a87a2b5096beb5212331472dbbeb74ada8d2c2c910e71d6b495d1d10ef5399f2e9d87854a1fab516fbdbfba587ef8ccee934071
TLSH
T1DF312BC573AECDDC4EC26227EC17D081BBF23B891E1999C804F20B0B4279637E105B95
MD5 SHA1 SHA512 TLSH

Submit Download

trigger_r_click.png

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\third_party\gbe_fork\steam_settings\controller.EXAMPLE\glyphs\trigger_r_click.png
Size 2KB
SHA256 66184fa95f5a564410e943011ae913d5f169e511dadec02b6a1e35583702fa82
MD5 25080b78852bc865c04f195d8423a82a
SHA1 459a49ea04541238038ff8910069b4840e018490
SHA512 54e6f7e9f2865ec6205d0cbeb7dc1468c9622f6975bcfa7d153d77e39fe521548b299c2019516779c0d503d60108b09cb9f6dbea1581bdc9d785f0f6bd7b26b8
TLSH
T1E0411BDCC091563864DF332428516E91F493E59DDE020A3A3C35C4DE3D526CA93574CE
MD5 SHA1 SHA512 TLSH

Submit Download

overlay_achievement_notification.wav

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\third_party\gbe_fork\steam_settings\sounds.EXAMPLE\overlay_achievement_notification.wav
Size 295KB
SHA256 7db2e0a85e47c75f7b64a4b89040f2a3129e2b5e2d03200d9aebea71d6b6572b
MD5 4ebb633927148696d8cdc4228171c05e
SHA1 cba7f456781e49c47d200948aa19dcb290790deb
SHA512 991dd3e7431c7f15a87ac0b0cbab32fb6e81b7ff196367e7600886d217afdb079fd7e966375c35c66883449eb817b2084e3fa314e1e15f27ede65e0966832a8c
SSDEEP 6144:twx+WxZa1uL3tgJTKI8mO1cLITL+wqH3s6Yvmv8Q:G/xZPjtg1imLIWwTPOv8Q
TLSH
T141544CCC98AB7A64D8B50F99E8D3560F15C838904B81DD6122F5CE9A2603938FDF1E5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\third_party\gbe_fork_tools\generate_emu_config\_internal\zope_event-6.1.dist-info\INSTALLER
Size 5B
SHA256 0b77bdb04e0461147a7c783c200bc11a6591886e59e2509f5d7f6cb7179d01ab
MD5 00305bc1fb89e33403a168e6e3e2ec08
SHA1 a39ca102f6b0e1129e63235bcb0ad802a5572195
SHA512 db43b091f60de7f8c983f5fc4009db89673215ccd20fd8b2ced4983365a74b36ac371e2e85397cac915c021377e26f2c4290915ea96f9e522e341e512c0fc169
MD5 SHA1 SHA512

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\SteaMidra\_internal\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_axzxtiyh.20d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_axzxtiyh.20d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh5F69.tmp\System.dll
Size 29KB
SHA256 014321cd51d3ad1f8f149619d6c7e01451e967b475f2db9bfffbaf182c1b836f
MD5 9d6d0eef8bfe8e43ade97ac84f0b0dd5
SHA1 631672bfb249b47ae7eba767e309c30e60550196
SHA512 e090d07278a0e0f04ec839fc614f84feb8c7684c74b991260c252c34ba91701aade10403964be88375ba67e55771871d5fb9a70f15446a43afabf303437b50f0
SSDEEP 384:Hchls/EvE2XYBVtQQA+S4n+7g6ZxlU7RfYkvIZMIwwHnY9pyDediASIo:HmHckOVih+S/Fxq7v4HnYLoASIo
TLSH
T133D22829FF0BC8B2D1B655F049DFFB77482A790547225E6BEE168D08BC33A139A19107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh5F69.tmp\nsDialogs.dll
Size 14KB
SHA256 e524aba3715ee2b5821b2bf0498f3f8d02e6755f30d0b2b5653abe564733a391
MD5 6ae5288cd54dda370dc2456511a09e8f
SHA1 e9782c69797cf7bbd17f7f26713266588f4f0ea4
SHA512 5bdb59501ff6330f7c628f325b5a0c3b391836082042a2b77601970eb418795d0c259b756909bd6d688f06aba547d6d81114c1a06862dcafea86bf2134e64d90
SSDEEP 384:4qWL5JCYXh2OPxv9OIR6oYkvLlwgS+VX9jN:4qXG2cLR9v6gJNjN
TLSH
T1CD52B50DFB1B14FAC572D974958BFB3F8A9DA415C66B4E06EF160B0CB9922B1680E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nso711C.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nso711C.tmp\nsExec.dll
Size 11KB
SHA256 55462fa0cd823424711eaca2fdb1d721f271e4406008b24ee9ba854143720219
MD5 f72e9d90a44e39700cae7b4720f54777
SHA1 040d5b1a07b778962d077a1be5a898a45c7a4e1f
SHA512 5221b5d63c36874f61429f1b35ec4c301703e5c92b202ea39c628cc0d350bdf838c8298446843ba39aee84dc5f0532180d5d4ad6efd9a736349dffe750892a7e
SSDEEP 192:AQux93kCB6nGYq1f9ymY1aulOaBETAJYkvQhvLrq5o25JF/:ALx937B6GY48HQulOGETAJYkvGLrgoSD
TLSH
T13932B5C8FA0278B4D457A978B28BF02F49A93831DE178C0BF98956357C6B6E5570CF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-756-0x0000000073BC0000-0x0000000073BCC000-memory.dmp

Download

memory/1520-755-0x0000000074170000-0x000000007417F000-memory.dmp

Download

memory/1520-754-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2236-5151-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2236-1013-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2236-3835-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2236-5107-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2236-3425-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2236-5011-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2236-5109-0x0000000073B00000-0x0000000073B0C000-memory.dmp

Download

memory/2236-2431-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2236-1086-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2236-1009-0x0000000073B00000-0x0000000073B0C000-memory.dmp

Download

memory/2236-1007-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2236-1008-0x0000000073B10000-0x0000000073B1F000-memory.dmp

Download

memory/3640-5152-0x00007FF8C57F0000-0x00007FF8C5A7D000-memory.dmp

Download

memory/3640-5153-0x00007FF8C4BE0000-0x00007FF8C4E14000-memory.dmp

Download

memory/4788-5161-0x000001C0CADF0000-0x000001C0CAE12000-memory.dmp

Download

memory/4788-5189-0x000001C0E3430000-0x000001C0E343A000-memory.dmp

Download

memory/4788-5169-0x000001C0E3430000-0x000001C0E345A000-memory.dmp

Download

memory/4788-5190-0x000001C0E3460000-0x000001C0E3472000-memory.dmp

Download

memory/4788-5170-0x000001C0E3430000-0x000001C0E3454000-memory.dmp

Download

memory/5428-5087-0x0000000005AB0000-0x0000000005E07000-memory.dmp

Download

memory/5428-5079-0x0000000005940000-0x00000000059A6000-memory.dmp

Download

memory/5428-5088-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

Download

memory/5428-5078-0x0000000005150000-0x00000000051B6000-memory.dmp

Download

memory/5428-5089-0x0000000005F10000-0x0000000005F5C000-memory.dmp

Download

memory/5428-5090-0x0000000007720000-0x0000000007D9A000-memory.dmp

Download

memory/5428-5077-0x0000000004FB0000-0x0000000004FD2000-memory.dmp

Download

memory/5428-5076-0x0000000005200000-0x00000000058CA000-memory.dmp

Download

memory/5428-5075-0x0000000002850000-0x0000000002886000-memory.dmp

Download

memory/5428-5091-0x0000000006430000-0x000000000644A000-memory.dmp

Download