2712b4ff842b35384f0e81cab8ad5c3ef60326eaa14d20b3ece685ef2be14467

Analysis

user interaction
yes
max time kernel
161s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Baskl Installer.exe
Size 3.0MB
Sample260825-e4dxsael5x
SHA256 2712b4ff842b35384f0e81cab8ad5c3ef60326eaa14d20b3ece685ef2be14467
MD5 a821666f5616acae3ab48fb195f57653
SHA1 5155cb39023684509cb9810e7416a729c6f7c2f7
SHA512 f3e6ab22ad95c93adddcdd4236133e4651a9a47f07833446db61cbb71f6f3676b846dc8430a7920197516579c9ccce25bddc74aa783bc0151af2d36462633884
SSDEEP 98304:byAo+1bxnlq+8cOmjqUmyps0kTeDauOToR6Xsajw0viCYP69MoT:bimrW
TLSH
T166E58E62A29401F8D0B7C179C9478617D7B1780603629BDF36DC6EA63F636E10F3A792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence ransomware trojan

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
173	raw.githubusercontent.com

Downloads MZ/PE file 1 IoCs

flow	pid	Process
164	6392	Baskl Installer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 5 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5824	tasklist.exe
5148	tasklist.exe
6464	tasklist.exe
6672	tasklist.exe
4644	tasklist.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	81	https://aescripts.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a307dbc9e9c66bbf	5

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\BSKL\AI MACHINE\id.txt	Baskl Installer.exe
File created	C:\Program Files\BSKL\AI MACHINE\id.txt	Baskl Installer.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5152_1782781275\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_667381697\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5152_1782781275\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5152_1378862319\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5152_1378862319\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5152_1782781275\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_667381697\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_723942922\_locales\is\messages.json	msedge.exe

Loads dropped DLL 1 IoCs

pid	Process
6392	Baskl Installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Baskl Installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6632	cmd.exe
6700	cmd.exe
6980	cmd.exe
1648	cmd.exe
1068	cmd.exe
3548	cmd.exe
2036	cmd.exe
6412	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3508	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321057977089678"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{73DBF0C2-9E41-4E5E-AB93-845FB9F94C6C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6424	msedgewebview2.exe
6424	msedgewebview2.exe
5748	msedge.exe
5748	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5152	msedgewebview2.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
5152	msedgewebview2.exe
5152	msedgewebview2.exe
5152	msedgewebview2.exe
5152	msedgewebview2.exe
5152	msedgewebview2.exe
2112	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5824	tasklist.exe
Token: SeDebugPrivilege	5148	tasklist.exe
Token: SeDebugPrivilege	6464	tasklist.exe
Token: SeDebugPrivilege	6672	tasklist.exe
Token: SeDebugPrivilege	4644	tasklist.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6068 wrote to memory of 1648	6068	Baskl Installer.exe	89
PID 6068 wrote to memory of 5152	6068	Baskl Installer.exe	91
PID 5152 wrote to memory of 2052	5152	msedgewebview2.exe	92
PID 5152 wrote to memory of 6004	5152	msedgewebview2.exe	93
PID 5152 wrote to memory of 6004	5152	msedgewebview2.exe	93
PID 5152 wrote to memory of 6004	5152	msedgewebview2.exe	93
PID 5152 wrote to memory of 6004	5152	msedgewebview2.exe	93
PID 5152 wrote to memory of 4100	5152	msedgewebview2.exe	94
PID 5152 wrote to memory of 3512	5152	msedgewebview2.exe	95
PID 5152 wrote to memory of 3512	5152	msedgewebview2.exe	95
PID 5152 wrote to memory of 3512	5152	msedgewebview2.exe	95
PID 5152 wrote to memory of 1252	5152	msedgewebview2.exe	96
PID 5152 wrote to memory of 1252	5152	msedgewebview2.exe	96
PID 5152 wrote to memory of 1252	5152	msedgewebview2.exe	96
PID 5152 wrote to memory of 1252	5152	msedgewebview2.exe	96
PID 5152 wrote to memory of 1252	5152	msedgewebview2.exe	96
PID 6068 wrote to memory of 1068	6068	Baskl Installer.exe	97
PID 1068 wrote to memory of 5824	1068	cmd.exe	99
PID 1068 wrote to memory of 1968	1068	cmd.exe	100
PID 6068 wrote to memory of 3548	6068	Baskl Installer.exe	102
PID 3548 wrote to memory of 5148	3548	cmd.exe	104
PID 3548 wrote to memory of 3440	3548	cmd.exe	105
PID 6068 wrote to memory of 2112	6068	Baskl Installer.exe	106
PID 2112 wrote to memory of 768	2112	msedge.exe	107
PID 2112 wrote to memory of 4892	2112	msedge.exe	108
PID 2112 wrote to memory of 3508	2112	msedge.exe	109
PID 2112 wrote to memory of 4892	2112	msedge.exe	108
PID 2112 wrote to memory of 4892	2112	msedge.exe	108
PID 2112 wrote to memory of 3460	2112	msedge.exe	111
PID 2112 wrote to memory of 3460	2112	msedge.exe	111
PID 2112 wrote to memory of 3484	2112	msedge.exe	131
PID 2112 wrote to memory of 3484	2112	msedge.exe	131
PID 2112 wrote to memory of 3484	2112	msedge.exe	131
PID 2112 wrote to memory of 5408	2112	msedge.exe	113
PID 2112 wrote to memory of 5408	2112	msedge.exe	113
PID 2112 wrote to memory of 5408	2112	msedge.exe	113
PID 2112 wrote to memory of 5812	2112	msedge.exe	114
PID 2112 wrote to memory of 5812	2112	msedge.exe	114
PID 2112 wrote to memory of 5812	2112	msedge.exe	114
PID 2112 wrote to memory of 4724	2112	msedge.exe	115
PID 2112 wrote to memory of 4724	2112	msedge.exe	115
PID 2112 wrote to memory of 4724	2112	msedge.exe	115
PID 2112 wrote to memory of 3024	2112	msedge.exe	117
PID 2112 wrote to memory of 3024	2112	msedge.exe	117
PID 2112 wrote to memory of 4576	2112	msedge.exe	118
PID 2112 wrote to memory of 4576	2112	msedge.exe	118
PID 2112 wrote to memory of 4576	2112	msedge.exe	118
PID 2112 wrote to memory of 2320	2112	msedge.exe	119
PID 2112 wrote to memory of 2320	2112	msedge.exe	119
PID 2112 wrote to memory of 2320	2112	msedge.exe	119
PID 2112 wrote to memory of 1980	2112	msedge.exe	121
PID 2112 wrote to memory of 4116	2112	msedge.exe	120
PID 2112 wrote to memory of 1980	2112	msedge.exe	121
PID 2112 wrote to memory of 4116	2112	msedge.exe	120
PID 2112 wrote to memory of 5404	2112	msedge.exe	122
PID 2112 wrote to memory of 5404	2112	msedge.exe	122
PID 2112 wrote to memory of 5404	2112	msedge.exe	122
PID 2112 wrote to memory of 2532	2112	msedge.exe	124
PID 2112 wrote to memory of 1872	2112	msedge.exe	125
PID 2112 wrote to memory of 1872	2112	msedge.exe	125
PID 2112 wrote to memory of 460	2112	msedge.exe	126
PID 2112 wrote to memory of 460	2112	msedge.exe	126
PID 2112 wrote to memory of 5792	2112	msedge.exe	130
PID 2112 wrote to memory of 5792	2112	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Baskl Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Baskl Installer.exe"
1⤵
- Drops file in Program Files directory
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c nvidia-smi --query-gpu=compute_cap,name --format=csv,noheader
  2⤵
  - Executes a command shell one-liner
  PID:1648
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6068.260.16996896115038421796 /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" /prefetch:4 /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x140,0x7ffa974d5fd8,0x7ffa974d5fe4,0x7ffa974d5ff0
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2464 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3384 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4640 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c /prefetch:1
    3⤵
    PID:6516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4892 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4860 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c /prefetch:1
    3⤵
    PID:6180
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4756 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c /prefetch:1
    3⤵
    PID:6292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4712 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c /prefetch:1
    3⤵
    PID:6324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5056 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c
    3⤵
    PID:7016
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4848 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4984 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --webview-exe-name="Baskl Installer.exe" --webview-exe-version=3.6.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=1796,i,10190445878654785215,195540447307159496,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c
    3⤵
    PID:1392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c tasklist /FI "IMAGENAME eq AfterFX.exe" 2>nul | find /I "AfterFX.exe" >nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq AfterFX.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5824
- - C:\Windows\system32\find.exe
    find /I "AfterFX.exe"
    3⤵
    PID:1968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c tasklist /FI "IMAGENAME eq Adobe Premiere Pro.exe" 2>nul | find /I "Adobe Premiere Pro.exe" >nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Adobe Premiere Pro.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5148
- - C:\Windows\system32\find.exe
    find /I "Adobe Premiere Pro.exe"
    3⤵
    PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://baskl.ai/r/aim-installer
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffa8e10c188,0x7ffa8e10c194,0x7ffa8e10c1a0
    3⤵
    PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,7360642936000048620,6192446266891266658,262144 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,7061401341286689392,17094868483056760708,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,16825925048598376855,1517174164102396488,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,10848174023298001715,18042089012836459066,2097152 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,4197592252123838623,2231660585635932277,2097152 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,4660383065353530352,607784000184414999,2097152 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:9
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,2853172280178456550,10551274217854079522,2097152 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,5609955811345637080,550782241941576414,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3640,i,13742030522329401908,8299142988032037786,2097152 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3932,i,18367934113236291877,10395180707368933342,2097152 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,16858633922676836705,13910257715634966572,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,3871665625318869675,17751611726049250021,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3760,i,2124615297439247454,5804719399060349967,2097152 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,9105328767205612843,15350390588814736283,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,9105328767205612843,15350390588814736283,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,7650625494081026639,15457317878746901744,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,1746641884003230904,4044956478015090444,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,9335106338201087434,2380189605820411104,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,9828077245557489074,15942373021343189183,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:14
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,15449543667354603,10521848427136047705,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5456,i,12814033884840697967,15865444656090714802,2097152 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7300,i,8479854260122401578,4947647881547385195,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,1588740394930168262,3454410573499863124,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
    3⤵
    PID:6652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,13236179401965501483,1207456532153183928,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
    3⤵
    PID:6660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,3742474542206979928,10016352432805727086,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
    3⤵
    PID:6668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3036,i,5591825389125463653,12099789173393639829,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,11364032968172275737,16715956649230625884,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,5132643198551733647,8042459309323482821,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:14
    3⤵
    PID:6244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,15227733223717210070,11452985885266732300,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=908 /prefetch:14
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7960,i,4250490418303770096,11561401598056394394,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:14
    3⤵
    PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2784,i,14983988814393959951,8229082655157572258,262144 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,4361101003295532295,980091092717120189,524288 --field-trial-handle=2340,i,8620557402499168957,1127313670291943004,262144 --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:14
    3⤵
    PID:6256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\f88a7741-078a-4203-b8d3-f6afae93dc47_Baskl.Installer-v1.zip.c47\Windows\Baskl Installer.exe
"C:\Users\Admin\AppData\Local\Temp\f88a7741-078a-4203-b8d3-f6afae93dc47_Baskl.Installer-v1.zip.c47\Windows\Baskl Installer.exe"
1⤵
- Downloads MZ/PE file
- Drops file in Program Files directory
- Loads dropped DLL
PID:6392
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Baskl Installer.exe" --webview-exe-version=4.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6392.6444.3747385049106193770 /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c
  2⤵
  PID:6448
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView" /prefetch:4 /pfhostedapp:822553b4136e5cdf026e9066b4e817c996f9427c --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x19c,0x7ffa974d5fd8,0x7ffa974d5fe4,0x7ffa974d5ff0
    3⤵
    PID:6480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c nvidia-smi --query-gpu=compute_cap,name --format=csv,noheader
  2⤵
  - Executes a command shell one-liner
  PID:2036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c tasklist /FI "IMAGENAME eq AfterFX.exe" 2>nul | find /I "AfterFX.exe" >nul
  2⤵
  - Executes a command shell one-liner
  PID:6412
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq AfterFX.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6464
- - C:\Windows\system32\find.exe
    find /I "AfterFX.exe"
    3⤵
    PID:6468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c tasklist /FI "IMAGENAME eq Adobe Premiere Pro.exe" 2>nul | find /I "Adobe Premiere Pro.exe" >nul
  2⤵
  - Executes a command shell one-liner
  PID:6632
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Adobe Premiere Pro.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6672
- - C:\Windows\system32\find.exe
    find /I "Adobe Premiere Pro.exe"
    3⤵
    PID:6696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c tasklist /FI "IMAGENAME eq Photoshop.exe" 2>nul | find /I "Photoshop.exe" >nul
  2⤵
  - Executes a command shell one-liner
  PID:6700
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Photoshop.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- - C:\Windows\system32\find.exe
    find /I "Photoshop.exe"
    3⤵
    PID:5752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c nvidia-smi --query-gpu=compute_cap,name --format=csv,noheader
  2⤵
  - Executes a command shell one-liner
  PID:6980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer_core.dll

Path C:\Users\Admin\.aim\installer\installer_core.dll
Size 3.0MB
SHA256 c4a6c7ab6243f7d226fd3a05a588feebb71c4b247e2558eb47ae1b2a269f9dc7
MD5 76b5e40eb88abb42052979de53504a9c
SHA1 afe79989af5dc763295422f8a00fc688a0d36709
SHA512 64dd123203d81afc25ca84ae6755b9a1917565d65f1e2d4481abcc572ae3f912ead059223ad884473f87c617e542ca1a5f548110b924c07dca8fa4efcdd34c8f
SSDEEP 24576:UxDqGxigPnigEkNde4l2q7ATuUAs9DNNpMK0WBd3aIeGYF3ddzbV:EpUWigECes2q7+uUAs9DtRFaIeGYF3d/
TLSH
T14FE56C22A6A900BCE173C17C8A575913E7B1B04A0330AADF37DC5A662F177E0577EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3165ddc66f1e38b3837cf3ec726627c285fb9b57316a0cd036a523fbac1a9e44
MD5 b339da22127cb588bf92703f1b43d83e
SHA1 93c92b9c7533c92aa2741c7640e3c30429d807b3
SHA512 2bcf450430da448a5ab6a18eb8241b5db156cd9e90ee68827c54ac05b4d1df99435fed6d9063582e3a63b129a0d244127c64e9677ed55ea58a58bc32c9f64614
TLSH
T1E56194DB032209E1D720967BE0E1245A36F0A4944D7FAE018B7CEE359C4AF18A0F056F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a693b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a693b.TMP
Size 3KB
SHA256 fd76ecbb62010d21efa1b879dce853019b252650cb2829a3f16aaa7c9d2d641f
MD5 2efca8d3736e01f27315923cb78ccb34
SHA1 806841a09532d3a109c6457438ea50576e3f6364
SHA512 6e3d146fd181f51153a6662178293fe36770e87682bdd0fd640927f039f32054ecf2f8d8e912ca21b0e243fc9726fb2dec8c5686ab72cdec89c05ae9bc4fea6c
TLSH
T1F06184DB072209E1D724967BE4F6245A32F0A4994D7F6E018B3CEE745C46F18A1F052F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10802026-acb5-4361-a841-4502ce728174.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\10802026-acb5-4361-a841-4502ce728174.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3d771272d72358a37aede802c8d4c2dfce2e1cbdf3b6b91d69aa58dc94e7c2f5
MD5 2fad78cb6296efaccf679ab704903e24
SHA1 5166fc7218089ca88e15b6326935153ce65e1230
SHA512 d80aad8013059aabe08fafd45e2d023889e6c32fb2597a2ebdedf9ab15425ee070581d7beeb56663f4bdd5806487983b44f4717495af01661ea08cfc260268c4
TLSH
T1FB718FF7C3F4866D991156F0AB14BE2BCE1D0A15832C3C2689D4EF5BA3E3471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b64bb59f8b7e2b7252ffe3ae4d3fbe63b1e0a3e2ad9ce0f54eb38f3e0cf4d6c6
MD5 a2f0d43851f1296241eec6f6bc675de3
SHA1 c720df621055f480442dbc1bf15837ca785a247f
SHA512 a423e4dfe618449c36ed1609ece1a83ddf6c492517fc9669dd65e89f6d521f61ac9703909162697d96849f1860049807eb1dfddc5e85cb15d6e6202cc0981078
SSDEEP 192:sxR+RCTQ/fNsKcyxZUwzoA8pJWH/g6+WNnOa/zOEY23ZG+hIgDY/ngJ:sxR+CQ/fNsxyf6O/5r/xvP
TLSH
T16F42B756AE28A93B4CC7D219FB15BB63D3F95036A1D41F48E6FC8A1C04E76DE220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1c1c225f390973a92b1fd83f9117c009fd7902549237e246f3956c1c293f4e06
MD5 44b5506ff395e7b760ebf866554251be
SHA1 8a137671b6a6767654beb48b782331ca913a063f
SHA512 2875840938720572ebc46b11c4628de780d3fc31e700fb08374f492e805e99fc10d029973517174db6d2bf5f8cd89c81024e891c405df84bf5b4a5c1819b0c62
SSDEEP 192:sxRhRCCQ/fNsayxZUwzoA8pJWH/g6+WNnOa/zOEYa3ZG+hIgV/ngJ:sxRh/Q/fNsayf6O/5r/1vm
TLSH
T1DE42B6566E28A93B4CC7D219FB15BB63D3F95036A1D41F48E6FC8A1C04EB6DE220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 825bf246992383fde92845a684cba3551422d978cebfd902494ba212a820319f
MD5 a092df09cedd3138dc2a83e7c07ecb0c
SHA1 4730fce504e783affe357df3c82354ee12ef345b
SHA512 8d10033b31de4df360796eceb31418db942ce08c5e56885d58ccbd682bf34401c6c4a19fa295ec53b23a0e0c0aa330df60c043ba9ecae0c110903173ae1d2fd8
SSDEEP 192:sxR+RCTQ/fNsKc7xZUwzoA8pJWH/g6+WNnOa/zOEIQ3ZG+hIgD6/ngJ:sxR+CQ/fNsx7f6O/5r/Bv9
TLSH
T1D642C756AA28A93B4CC7D219FB15BF63D3F95036A1D41F48E6FC8A1C04E76DE220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 daa2f4f2748f2345614e9b6647bd657670c49625d7b4e003358a92590cf61023
MD5 c3d7dd0e0ed0802e68ced0ed28c063ef
SHA1 e7733c073203dfb8a14541e58212bac44df063f4
SHA512 511c951d7770310c2fd50dec3ba1c3950fc8da486a585387924bb00fa5f355b7c9fcbd31be59022c4b66d84a749e3797fa9438f4a96ad8064e4718703f88053d
SSDEEP 768:40Dk6DJQD87C7pLuLzn0DbWgQ6DjfsQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVts:40Dk6DJQD87aEzn0DbWgQ6DjfsQDFu1I
TLSH
T1E0D2DA7B640CCB7F4F804ADDAD197A9E6D6802CB56D8C98047FE991C02C7BEB511A0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5aefdf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5aefdf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b7bdd6560d3eb16fb71def23c9df212e946938ce94021053874d2cb0a8dfb849
MD5 b24daed80218bd3e7ca33f94e3c3d5dd
SHA1 ea29256d2b60a734c91b909578da4eda773fd0b1
SHA512 114edb3245e7cbdeb263416a2b467a325ae307e7422cd9d659e3459518b97d74f42167bb136843644c03b7338532d465301a1e8efab6314ec40256af504f7def
SSDEEP 768:1G3dtZDTd+Z5BgeX6+qTko0u229a4vsT9fTi:1G3K7vVTVKa4MfTi
TLSH
T1F6F2BEB1E8659C7348EAD385B20732976FBA10B3CACC1E54D9DDAB1D054716D2B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e422b07c4c1b344bb1532bc0e0680a27dd1dae0eb490a6ea47a2037b0e10c4ca
MD5 a2d2c678f91f2985a038bfef17b44683
SHA1 331d8beeabb73a89037f654c4fc475b19e3c0657
SHA512 2095f733f2c6b6c4cb524f4cfefe35c5d5f40b80be20e83a5533bad5d208c910ecc2e0354e999ff04a6737f93b9c2fc60e0aac9f70ed26e113cc2a89c6b19dd1
SSDEEP 768:prv+4UNbdG3+QXDTd+Z5seX6+qTko0u229a4vsD1eVH1SdW:pbsbU3qVvVTVKa4oEH1h
TLSH
T14503CF32E86589778CE69785B14B75472EB92163CB880B94D8ED6F0D064B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ebdf5b44de9ba135433f2e2c8d0437a68cff25694c2b7f111c82d91c900309e5
MD5 bc7d5fdb242ef184cf444f2d6fedba5f
SHA1 d96451397340b7c1bce8972d2ddfe56ebe82665c
SHA512 6791e663adffed232df00461401afe3a0e05b351a4b30d676a37f90ef95d9ebf583b58d16bcfb0a42c322d78b7a455359dcf6b7e3a4897395ba32ea8c0985267
SSDEEP 768:lFWr34wgMtSnZ5BYeX6+qTko0u229a4vsT9fTi:yr3ybvVTVKa4MfTi
TLSH
T188038CB2E861DD7B9CE6C785B70676479EF510B38ACC9DD4D9CCAE0800871AD1B0BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4fc77d957c3ec7dc60de862efe92fbae665931ce03922ccd6bc80b0122b90396
MD5 f4cd5e310678701c3654f7e813e80380
SHA1 b8ff2bf32e28664d4f992977a0c252965f3ac318
SHA512 933e5e1b21957b2f17fd8cd2724b434984bb665aa5b5793e99af912874277a4deeaf4a1de5f1a04f5bf82b855e4c41eafab7e48c57f9c0e213247db4088d602c
SSDEEP 768:Grv+4UNbdG3yGZDTd+Z5ByeX6+qTko0u229a4vsT9R3vw:GbsbU3StvVTVKa4Mpw
TLSH
T10A03AE71F8699D738CF6D285B10772936FB920B38AC80E54D9DDAA4C054B1AD2B0FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 30fddf58e5235fb0b5654c85022ac04ea940cac231a743c0f37fb6231dbb9d53
MD5 b52f1b245b654ce496292316e3df5d67
SHA1 2f0310a575cf9e17e8c8505d03fc91b1e0a5e6b4
SHA512 91fed5eb6702d31dc750ff21841e3cb502198ae4440e9c7dc9b14ab6f05904fc1e9aa110a0fdbb0af50f225e85f1c0405ebf3e309a99f4285483dc6e698e8a49
SSDEEP 768:aG3ytZDTd+Z5BgeX6+qTko0u229a4vsT9fTi:aG3J7vVTVKa4MfTi
TLSH
T14EF2BEB1E8659C7348EAD385B20732976EBA10B3CAC81E54D9DDAB1D054716D2B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 873f219992e8b86c2011369fe821a98c2900c2694a444c5d75a1cb699f6fb6e3
MD5 611f3f1535645ec16b0094ad4c6e8686
SHA1 b1f75324c4c56df1c0f12ef976920ac3d1678cef
SHA512 5cf1fb348561a16f57d9246635e5b6b975c4c192e4af7d24d4980bfc3141529703629cdb03f27ad14f2c89442aa92401e8c22eefde0a9acdb40e3dee3e2df19c
SSDEEP 768:sG3GtZDTd+Z5BgeX6+qTko0u229a4vsT9fTi:sG3N7vVTVKa4MfTi
TLSH
T1B5F2BFB1E8659C7348EAC385B20732976FBA10B3CACC1E54D9DDAB1D054716D2B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 85bdc9f2a095e25e7030a6bbdac93bffac641bfd4843136cf0547cecb83af2c0
MD5 7d15137a4a17203fdbbfcccd50553abe
SHA1 16da87ae413f43d3894eeecc3db1a2ec1956c3e2
SHA512 a1a827b67d78b94aaa832deb18a2d1e9794e85c36635d6ac2b5aa42959b543bd2a2d17384c0a8ec99db8c5214c1f9d937914f8c49e685ec9d9907ec161b443ab
SSDEEP 768:lrv+4UNbdG3mnzDTd+Z5BEeX6+qTko0u229a4vsS9eVH1SdW:lbsbU3vPvVTVKa4fEH1h
TLSH
T1C803CF31E4699D738CE6D785B14772872FB921B38A880F94D8DDAB4D064B19C270F93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

9130653c-c55d-40bf-b0ba-507f4deef52e.tmp

Path C:\Users\Admin\AppData\Local\Temp\9130653c-c55d-40bf-b0ba-507f4deef52e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2112_1724994511\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 be58e9bfae5c5823491972f2ebb32cbf893daaaa3f02cec1f921f7d67f056546
MD5 9be4f4ed007bd357d005623feec601dc
SHA1 bb71a554c94e1947be17fa030bb238c0b1308beb
SHA512 02d01b454ba68c1da1ce979a35977c1d003406dbebd2c92c599f7ab1123a5dd5537d635f1204ce94634ff2f6002eb86f93e6bca8ca85d08e37fe9800b711e112
TLSH
T139D012223601467CC01230330542614C0400D50B8005C201942DC57D6A080940A02C52
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c2afb6994f58706219ffbe0f2e176b937a419937c8a2a9738bf588bfbd2cf3af
MD5 81c65cc529380019ee190a4a10575bab
SHA1 98a521f0b45e4d1db811e7356f6b1ca6e9e0186c
SHA512 5d0a23205cea54ea9bd758a640df66ebfd356fda1a2934829a1d69ec5477fa546300fbc9a889de80d1b742da3fb3f620339d1b1832e2535d181d7512a1326ebd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1af90215c73dacf08063323b321cc73c8cae74da28a7189011507e8f29effc1c
MD5 27670c3fa069409818afe613a5aa7d4e
SHA1 c622c5264d852ecaba78e15e7e7932173dc9d46e
SHA512 26e1a6712dc686a0ba4936552dd0178773f80d6397fc83595e765594d592981c7d901aeb4d14739d281e367346ab9a0463dd306ccbfc512bbdf02dcc4d301026
TLSH
T170D02B7222150A78C211313345C1E19C1000C51F4006C6005E3AF97C5A440E10DC1D42
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

58269e70-215a-4149-af61-c00dd95c156a.tmp

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\58269e70-215a-4149-af61-c00dd95c156a.tmp
Size 5KB
SHA256 9da09769422d0578a7acc9988c0b7cb420441b3066b7e07335ca9d4d3e337fa0
MD5 35fe554d68fe90a860d75479901f7439
SHA1 a51ff4a4ebbdb464ad5c20d074b357c99ac174c2
SHA512 00894dc67a77f2bb3f94638c2cbee4d5b799f4d357f4e36e632ef5ca517028e339ea1bd8d4e300e5c5d1b907543403b92005754ed0aee7ba57d1e247b8dea821
SSDEEP 96:sti/dD7qWDQb98kAo5h16ZZs7/x+6Mhmuecmje/K+gS528XM1C7K:st6VFN5o+sV+Fij9uG6K
TLSH
T100C195025E28797B8CC6E119FB35BA03E2F9607275D51E58EBF8461C09DB6DD230B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\Extension Scripts\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

374c6c29-1ee2-44b4-80e0-9b8872340581.tmp

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\Network\374c6c29-1ee2-44b4-80e0-9b8872340581.tmp
Size 691B
SHA256 0a3a8846b1b0e330a8c53992ee17d599e1c891cc9695aa8e061a541a2c14b982
MD5 f8cd8b4a6a4100254ce4c01548dc51eb
SHA1 96cc3620349be6675e892f20d7eab02d09a4857a
SHA512 f0b7c0c8362866d4fe184243a8b358f48594a4517d9dbc75fba4a83257b047e8367000837863a1573cab10a58a5411a9e4e59b1d5103c936aa5e086447508b65
TLSH
T15E012BD3D57EA82B10BD5A7B3D40FC06667EA43640917CE8DA92917CE0C45F75E0B523
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5acde0.TMP

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\Network\Network Persistent State~RFe5acde0.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 ccbaa096327db12e28df9bace9b8ae2a1ca07d101dd92517d7512ed30272b93a
MD5 809f08061fdb832d56852dc7ad7e99e6
SHA1 64faae12e679cc5f869f0e39d7d9879a16667463
SHA512 669a54305aa8695b21c1d92240233ac5ea302c8330a046599efefb728165fe2700b754edab4f8948df93300c04611b5bb0d98bdb402823dd0df8a89fc768567d
TLSH
T124E020E3827FB07B10AC19361C40FD025A36A13641D358F8DAC6406CF0409FF5D0B422
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 ded0100e26e5023d946dd7ce84583d380e44b117dbe6ad0538ae1199e99f5396
MD5 9547590d1fb613eae0bd6e54ef4bf4a6
SHA1 4f5cd1ebffd4c03247ac5a5c8bb3a25e07df7d80
SHA512 e898df7f7eb4ce0ff368d54ee90bbade70e2a0dc118ef799b07000452c83b463d1316583179c9ef7a0d75101bf148148605ea028ead0c914cafedca17998e086
TLSH
T162E020D3807EAC3720BC293E3C40FC135B3BE236119058E9DA92456C6080AF76D17533
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a94a0.TMP

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\Network\TransportSecurity~RFe5a94a0.TMP
Size 356B
SHA256 0697d5b848db62ff1fd2aa23a6572fd25981d8239e355f210e4c15d6d0eaee84
MD5 5682c15800249872a7fdbe51ceac9fd1
SHA1 e5b1f889b7b2934a1a55805fff11362fb0ec199a
SHA512 d8b35f3fa8cb215ef557d201a4bc50fc00e32d4c352716ef9c578604903d8a3a9637106aae7a925345f4d5d03d46e4e4f0c32e00535dade83ed6c698d15b9a20
TLSH
T1A9E020D3807FB17F10B91B3A1D48BD125E3AA93745D154F9D992506CA0806FB5D06562
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 a9db0e12baaf6f10a43b0ee1af6ca1e6c86a98c7747dc8fb849b51aa823dfe8e
MD5 e2d0328bf0c3befe690bb296e62d4dec
SHA1 829003c7a9c55092ce2511a02f9ea613cc070191
SHA512 09acf1a343e3bdda2853add732a85ad38573f3182156feff22ecc7ef824962a1ffe3b66e4d8203712192ba4dad37046a2f4871332b9b244a6cef8ae2c58d289c
SSDEEP 96:sti/dGqWDQb98kAo5h16ZZs7/x+6Mhmuecmje/K+gE028XM1C7K:st68FN5o+sV+Fij91G6K
TLSH
T103D195025E28797B8CC6E119FA35BA03E2FA607275D51E58EBF8461C09DB6DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 632a3d6d9222b683719fea67b11369b3a3c42c0f14d2439dd7c017ffa32c9cb0
MD5 74341c33ed864e02041ac40a07149454
SHA1 0d85eced4cd17d3ffffa1f89b51f19b6c417b704
SHA512 6457dc23419d7f6d9a8f98a6cdb7e9dcedbe34a1190a20734b59d0f5b814c2bedf26a044230a2b7af470aa990ff2ac0076b940f525349ca6463cf86ee565485b
SSDEEP 96:sti/dGqtGDQb98kAo5h16ZZs7/x+6Mhmuecmje/K+gE028XM1C7K:st683N5o+sV+Fij91G6K
TLSH
T133D1A5025E24797B8CC6E119FA357A03E2F9607261951E58EBF8461C09DB6DD130790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Local State
Size 16KB
SHA256 f38fcc679b0a3b79f1fa2f161a36d773347c46ac8ee40d147f98e1a30195315a
MD5 1ecd88f8c93545b75b9ab0bb51c50c8d
SHA1 52fb9cce264714bad1a57ac95f2c3320c4439d2d
SHA512 71ab36fe95ebc7aa4d2fc28446150a04ece15b1602525bbaddac2c3ba88ea52dbd82046a8e6048a18689d1cc1b0eae4f83fe543bf4a46281c09b97bef83ea182
SSDEEP 384:r+aQikB+z/xvxjg/qhEUNBSgUOUZIdRLhCYd4HWR9z+:K/UxvxjgC+mwI5CQ4H+F+
TLSH
T1CF729D3AD575BE37A8F7E6407B0A5B8BCBB545A251C16EE88DE91F0C06C339D130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Local State
Size 17KB
SHA256 b80114c227827d77beaeec06c994e77478b4b93049234ad13917bce4efe8ec94
MD5 5231db3f692e516cc36ffa6728377c7a
SHA1 fbda42a433a2985384f3eefcb4ca707161f5ae74
SHA512 5c747f4183cc810f30c80de858d99b7f860e7763342c07e3495f5fba87d7479104e32ea36d56006c0b01b8d5c564ca2fd09bcd09a7a085dac0ee4af4669d98e7
SSDEEP 384:Y+aQikB+z/xvxjg/qhEUNlgUOkZIdRL9CYd4HWR9z+:X/UxvxjgC+VAI1CQ4H+F+
TLSH
T1F7729D3AD475BE27A8F796417B0A5B8BCBB545A251C12EE48DE91F0C06C339D130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Local State
Size 15KB
SHA256 bfed395b6661d77932b2d9b08d2a16fb6b4c93565544a813193cb421f2205d34
MD5 09391e929d1ac0fbc56f00fc2c5a7b9f
SHA1 237c87f6c97854db95b36e3621737eca020b7074
SHA512 798fc837cc9cd87ce728bcc31e00de11f0bed14f514ff4b9258350139d2b5f3a7c4eef012c482567518175bd82ce17a85cbd41f66a72558a4c835201d0adda70
SSDEEP 384:5+aQikB+z/xvxjg/qhE7NBSgUOYjIdb1Yd4HWR9z+:k/UxvxjgC+r+ILQ4H+F+
TLSH
T1C8729E2B95797E3799F7E504BE490B4BCBB998B291C22E784EF95F0C06C33981346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Local State
Size 15KB
SHA256 c37c16a331f67ad35bf34f579c273133c2461c0d6fc64ea91faf20285daae0d3
MD5 6dfbce861d7efe03b238fc6e31b97dff
SHA1 f35c9c1cacc427d4293ce2c92499cd25b48b4631
SHA512 774a77dbbddf57affc8879a83a18fc37d9eed3d42e45671173b339dff97dffc078b0bdf2d6afd38978f2564ef7b05822f080e1369c627c2e623686b05d6f652d
SSDEEP 384:f+aQikB+z/xvxjg/qhE8NBSgUOKjIdb1Yd4HWR9z+:u/UxvxjgC++MILQ4H+F+
TLSH
T103729E2B95797E3799F7E5047A5D0B4BCBB988B291C22E684EF95F0C06C3398134AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Local State
Size 2KB
SHA256 707a4e4981e50fe678598a9e317871ce82d3d2700d0a3f3818160365c1ef388f
MD5 0424a67f20409c5b25337c32120045bf
SHA1 f252219d9121471327527005a0ce11b4aa3368a2
SHA512 96182282c018534f4bcf5be58277c3fc767ec2c1308ef2f6dc1f07b474d8369cc37d5f74766fb379a34e95aaed49a804b9d88e4166cbdd524fd6b8a08eefdcb8
TLSH
T1EB5166737824773BCDB24644BB4A2A23CE3650A596962F51DAEC0B1C01D765D1387C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Local State
Size 3KB
SHA256 a6217770fb5da7c063ca90aec93495460c6e3a39cc40c02a56e3b6e0b550a817
MD5 2b2e88c0075b1b0f44276c2b66f874cf
SHA1 fa809caf00a43cc41a128ca912b5c710a0f8fd66
SHA512 29a9f43b40cd541fe209aaac06d434eaa52649e1c531d1b34ebee066942a5da8e75d53067eb29f5baac33d17f1bbb352bca1d9a8f847a7f74fd740c270f3994a
TLSH
T10A6175776934A93B8DF29A04BA862B17EA655067E5C53F95DAFC0F1C01D738C1382C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59a241.TMP

Path C:\Users\Admin\AppData\Roaming\Baskl Installer.exe\EBWebView\Local State~RFe59a241.TMP
Size 1KB
SHA256 08e0467663ef0e20e47e680b4adaa885b50f3a7f05306c03de94ea2a43b8a513
MD5 f95a02a461222b445a2079da0f7e808c
SHA1 4632792ef037874e6cff91e39f568623eff9c964
SHA512 905cb19a4a5dc365a36fa417f468bb42e9b6dbfadb749c2ddab561e8a47d5ea386561cfa02c6e525ae711346a97012c07b342ac4920e75d0c3b9a2763e6da866
TLSH
T1C72165F3E9302B36DC665246A7162A174E3254BB42954E04E6ED8B2C02E314D55AFC33
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_667381697\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_667381697\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5152_190684121\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/1252-102-0x00007FFAB1B80000-0x00007FFAB1B81000-memory.dmp

Download

memory/6004-174-0x000001EF4BF00000-0x000001EF4BF15000-memory.dmp

Download

memory/6004-172-0x000001EF4BCF0000-0x000001EF4BCF2000-memory.dmp

Download

memory/6004-29-0x00007FFAB1B80000-0x00007FFAB1B81000-memory.dmp

Download

memory/6004-777-0x000001EF4CC50000-0x000001EF4CC7B000-memory.dmp

Download

memory/6004-779-0x000001EF4CA20000-0x000001EF4CA22000-memory.dmp

Download

memory/6004-778-0x000001EF4C350000-0x000001EF4C351000-memory.dmp

Download

memory/6004-776-0x000001EF4CC30000-0x000001EF4CC46000-memory.dmp

Download

memory/6004-773-0x000001EF4C350000-0x000001EF4C351000-memory.dmp

Download

memory/6004-774-0x000001EF4CA10000-0x000001EF4CA12000-memory.dmp

Download

memory/6004-175-0x000001EF4BF20000-0x000001EF4BF4A000-memory.dmp

Download

memory/6004-169-0x000001EF4BCD0000-0x000001EF4BCD1000-memory.dmp

Download

memory/6004-170-0x000001EF4BCE0000-0x000001EF4BCE2000-memory.dmp

Download

memory/6004-171-0x000001EF4BCD0000-0x000001EF4BCD1000-memory.dmp

Download

memory/6424-928-0x0000020448CA0000-0x0000020448CA1000-memory.dmp

Download

memory/6424-936-0x0000020448CA0000-0x0000020448CA1000-memory.dmp

Download

memory/6424-932-0x0000020448CA0000-0x0000020448CA1000-memory.dmp

Download

memory/6424-934-0x0000020448CA0000-0x0000020448CA1000-memory.dmp

Download

memory/6424-935-0x0000020448CA0000-0x0000020448CA1000-memory.dmp

Download

memory/6424-937-0x0000020448CA0000-0x0000020448CA1000-memory.dmp

Download

memory/6424-933-0x0000020448CA0000-0x0000020448CA1000-memory.dmp

Download

memory/6424-926-0x0000020448CA0000-0x0000020448CA1000-memory.dmp

Download

memory/7016-798-0x00007FFAB2020000-0x00007FFAB2021000-memory.dmp

Download

memory/7016-797-0x00007FFAB1F70000-0x00007FFAB1F71000-memory.dmp

Download