lumma | hxxps://nexus-games[.]net/game/chained-together-free-download/

Analysis

max time kernel
790s
max time network
794s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nexus-games.net/game/chained-together-free-download/

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://publicitycharetew.shop/api

https://computerexcudesp.shop/api

https://leafcalfconflcitw.shop/api

https://injurypiggyoewirog.shop/api

https://bargainnygroandjwk.shop/api

https://disappointcredisotw.shop/api

https://doughtdrillyksow.shop/api

https://facilitycoursedw.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Downloads MZ/PE file
Executes dropped EXE 11 IoCs

Processes:

winrar-x64-701.exewinrar-x64-701.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exe

pid process

5116 winrar-x64-701.exe
2824 winrar-x64-701.exe
3328 Setup.exe
5752 Setup.exe
1096 Setup.exe
2228 Setup.exe
3200 Setup.exe
3816 Setup.exe
3432 Setup.exe
2436 Setup.exe
2480 Setup.exe
Loads dropped DLL 9 IoCs

Processes:

Setup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exe

pid process

3328 Setup.exe
5752 Setup.exe
1096 Setup.exe
2228 Setup.exe
3200 Setup.exe
3816 Setup.exe
3432 Setup.exe
2436 Setup.exe
2480 Setup.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

257 dpaste.org
94 discord.com
95 discord.com
255 dpaste.org
256 dpaste.org

pid	process
5116	winrar-x64-701.exe
2824	winrar-x64-701.exe
3328	Setup.exe
5752	Setup.exe
1096	Setup.exe
2228	Setup.exe
3200	Setup.exe
3816	Setup.exe
3432	Setup.exe
2436	Setup.exe
2480	Setup.exe

flow	ioc
257	dpaste.org
94	discord.com
95	discord.com
255	dpaste.org
256	dpaste.org

Drops file in System32 directory 11 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Suspicious use of SetThreadContext 9 IoCs

Processes:

Setup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exe

description	pid	process	target process
PID 3328 set thread context of 4172	3328	Setup.exe	more.com
PID 5752 set thread context of 4840	5752	Setup.exe	more.com
PID 1096 set thread context of 4648	1096	Setup.exe	more.com
PID 2228 set thread context of 3600	2228	Setup.exe	more.com
PID 3200 set thread context of 5356	3200	Setup.exe	more.com
PID 3816 set thread context of 4460	3816	Setup.exe	more.com
PID 3432 set thread context of 2712	3432	Setup.exe	more.com
PID 2436 set thread context of 1704	2436	Setup.exe	more.com
PID 2480 set thread context of 6140	2480	Setup.exe	more.com

Drops file in Windows directory 1 IoCs

Processes:

mspaint.exe

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

PaintStudio.View.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 22 IoCs

Processes:

PaintStudio.View.exeOpenWith.exemspaint.exemsedge.exeOpenWith.exeOpenWith.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\MuiCache	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheVersion = "1"	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3169499791-3545231813-3156325206-1000\{B69CC81B-48BE-4BCB-9FAC-343C7CF3CD84}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheVersion = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheVersion = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 661921.crdownload:SmartScreen msedge.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

PaintStudio.View.exe

pid process

2604 PaintStudio.View.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 661921.crdownload:SmartScreen	msedge.exe

pid	process
2604	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exeSetup.exemore.comSetup.exemore.comSetup.exemore.comSetup.exemore.comSetup.exemore.comSetup.exemore.commspaint.exeSetup.exe

pid	process
100	msedge.exe
100	msedge.exe
3608	msedge.exe
3608	msedge.exe
1376	msedge.exe
1376	msedge.exe
1804	identity_helper.exe
1804	identity_helper.exe
5264	msedge.exe
5264	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
4648	msedge.exe
4648	msedge.exe
2636	msedge.exe
2636	msedge.exe
3328	Setup.exe
3328	Setup.exe
3328	Setup.exe
4172	more.com
4172	more.com
4172	more.com
4172	more.com
5752	Setup.exe
5752	Setup.exe
5752	Setup.exe
4840	more.com
4840	more.com
4840	more.com
4840	more.com
1096	Setup.exe
1096	Setup.exe
1096	Setup.exe
4648	more.com
4648	more.com
4648	more.com
4648	more.com
2228	Setup.exe
2228	Setup.exe
2228	Setup.exe
3600	more.com
3600	more.com
3600	more.com
3600	more.com
3200	Setup.exe
3200	Setup.exe
3200	Setup.exe
5356	more.com
5356	more.com
5356	more.com
5356	more.com
3816	Setup.exe
3816	Setup.exe
3816	Setup.exe
4460	more.com
4460	more.com
4460	more.com
4460	more.com
2956	mspaint.exe
2956	mspaint.exe
3432	Setup.exe
3432	Setup.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exeOpenWith.exe

pid process

5836 OpenWith.exe
5696 OpenWith.exe

pid	process
5836	OpenWith.exe
5696	OpenWith.exe

Suspicious behavior: MapViewOfSection 17 IoCs

Processes:

Setup.exemore.comSetup.exeSetup.exemore.comSetup.exemore.commore.comSetup.exeSetup.exemore.commore.comSetup.exeSetup.exemore.commore.comSetup.exe

pid	process
3328	Setup.exe
4172	more.com
5752	Setup.exe
1096	Setup.exe
4840	more.com
2228	Setup.exe
4648	more.com
3600	more.com
3200	Setup.exe
3816	Setup.exe
5356	more.com
4460	more.com
3432	Setup.exe
2436	Setup.exe
2712	more.com
1704	more.com
2480	Setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

Processes:

msedge.exe

pid	process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

AUDIODG.EXE7zG.exePaintStudio.View.exesvchost.exe

description	pid	process
Token: 33	4476	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4476	AUDIODG.EXE
Token: SeRestorePrivilege	640	7zG.exe
Token: 35	640	7zG.exe
Token: SeSecurityPrivilege	640	7zG.exe
Token: SeSecurityPrivilege	640	7zG.exe
Token: SeDebugPrivilege	2604	PaintStudio.View.exe
Token: SeDebugPrivilege	2604	PaintStudio.View.exe
Token: SeDebugPrivilege	2604	PaintStudio.View.exe
Token: SeTcbPrivilege	860	svchost.exe
Token: SeRestorePrivilege	860	svchost.exe

Suspicious use of FindShellTrayWindow 54 IoCs

Processes:

msedge.exe7zG.exe

pid	process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
640	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

OpenWith.exeOpenWith.exe

pid	process
2468	OpenWith.exe
2468	OpenWith.exe
2468	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe
5836	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3608 wrote to memory of 5044	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 5044	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 2828	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 100	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 100	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1604	3608	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nexus-games.net/game/chained-together-free-download/
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7fffce4746f8,0x7fffce474708,0x7fffce474718
2⤵
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1840 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
2⤵
PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:3724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
2⤵
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
2⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
2⤵
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
2⤵
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
2⤵
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
2⤵
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6504 /prefetch:8
2⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4764 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7244 /prefetch:1
2⤵
PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
2⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1
2⤵
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
2⤵
PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7708 /prefetch:1
2⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7864 /prefetch:8
2⤵
PID:888

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7864 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
2⤵
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
2⤵
PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7248 /prefetch:1
2⤵
PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7276 /prefetch:1
2⤵
PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
2⤵
PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
2⤵
PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
2⤵
PID:5572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
2⤵
PID:5580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5348 /prefetch:8
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
2⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
2⤵
PID:5240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7800 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
2⤵
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
2⤵
PID:5672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1
2⤵
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
2⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
2⤵
PID:5864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
2⤵
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
2⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
2⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
2⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
2⤵
PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
2⤵
PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7740 /prefetch:1
2⤵
PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
2⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
2⤵
PID:6108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7348 /prefetch:8
2⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7564 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2636

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
2⤵
- Executes dropped EXE
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11190915143608918713,6681483772122079330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7588 /prefetch:1
2⤵
PID:3484

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
2⤵
- Executes dropped EXE
PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4764

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x37c 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2468

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_!!FulLSetup_22334_P@ssKey$!!.zip\FullKey.txt
1⤵
PID:4944

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5836

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\166075cefeb64c95a819c29ce66aac05 /t 5836 /p 5116
1⤵
PID:6000

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\5194a0762ecb42459697eaa8134297cd /t 5516 /p 2824
1⤵
PID:3972

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\" -ad -an -ai#7zMap14361:202:7zEvent8101
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:640

C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe
"C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3328

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4172

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:5192

C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe
"C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5752

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4840

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:5516

C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe
"C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1096

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4648

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:5428

C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe
"C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2228

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3600

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:3204

C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe
"C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3200

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5356

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:1116

C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe
"C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3816

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4460

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:512

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\selfrepose.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4620

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5696

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Language\ar.txt
1⤵
PID:2788

C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe
"C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3432

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: MapViewOfSection
PID:2712

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:1832

C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe
"C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2436

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: MapViewOfSection
PID:1704

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:5356

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\selfrepose.jpg" /ForceBootstrapPaint3D
1⤵
PID:5204

C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Windows\system32\dashost.exe
dashost.exe {b322c2c7-85a6-4901-8c6f4dbfc9623302}
2⤵
PID:4556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:2736

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\selfrepose.jpg"
1⤵
- Drops file in Windows directory
PID:1864

C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe
"C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2480

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
PID:6140

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000076
Filesize
23KB

MD5
a4e1fa2a01ba084e60efddec6e4839d5

SHA1
23b4f262b12c80192b450a6c7bf427d30ab08b4e

SHA256
e2d40be84a74632da135d3598ea27f0f66c0f1423cda835a2ee4e5309a2776ef

SHA512
2dde67841512e336cf7f47636f031ab2a3bb40e435743362ab92c908c41c6986432a03a5a66ef183f6ef1c6e7e211db9ad0402d9c573ba342d85c036fea67de7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007c
Filesize
73KB

MD5
f135bb429dab34cd68fe68958d393ca2

SHA1
8447680e78629271836c2447158531f81ab33274

SHA256
0880b68a945efa58aac7f8c35ea6c283c00271a5c9e149753964cb8147f9fa92

SHA512
ba265eb3ce37f7d9bb8544938319a1919df71c6f3b01c89ce306a778c07fcf965d6fd376982f0c0dcfd5cfd6dfe6368a091ec55151c7da5e42779f06fe2c83dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007d
Filesize
85KB

MD5
d7f2644ac3fe5fc4edeb7dadce2be595

SHA1
487fa5ccaec10fba7844b301243500705fa62754

SHA256
2c8ffdfc34d0c8366d4b0caaec1137f3ec6c3d42de637fb4368bdea8591f88f8

SHA512
475c21fc936461bfd12af10ebd8b466180bcfd59a0edab41eb0f0b09a440b729003c18ddcd72d86765c5de8234e68a3ff5a8073d8cdccc27f7290a05f0cc96d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007e
Filesize
85KB

MD5
008d0ae10f41631bb124d78799baf5bb

SHA1
cd5956db2574b3e718d8e87f3e4af79e2a3b5e0b

SHA256
a0aee1664677fce87357ff299c236f12803be313c1838a312d779ccf1ce0e590

SHA512
e4c1c5a8d88b6e0caa60b3c6ce02c05b0b2653c478a788d9d6c330d34439a5f91acecd67dc6baa4f40cf8f4cf21a684a13162562df8e2406cd06ac3145c6216e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007f
Filesize
56KB

MD5
3bfb01f3bad7477df0d588e237a3a9fe

SHA1
39cec61f3a4e0a27ef29125a3765c08c1e60e3b6

SHA256
13d9bfdd9b6da660dab1720627fc7144b3a93239e765a7c54a4fe07aa49638d4

SHA512
5bf096a3a03a2a1b02bf2541c24ceb189375b730cc67162353fae460242dd4cc8089603f4909616dbc2091d55cd13b2e5d469c1b8af6a0119e7b2c98b0b609c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000080
Filesize
73KB

MD5
a767cd88432bc5b454545e53d6c68c84

SHA1
ef2981321a965ef69f9e5e07574e0ef4a42c673c

SHA256
6fa36037f8333d0c40424dc0972413bacfd4d586a9c342e168e78a0dd71ddb0a

SHA512
f995f090ff3f1c1f4fa72d9ba43ea65a9ff953a830f8e7fad17b747bbb2f51d9fbeda3f433d372f8b4b9e8da040ee192abd0efad04ee75e0a558f57d7cb32e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000092
Filesize
18KB

MD5
bad5bd15158ba1ced6487a8255012d6b

SHA1
8c92a9599d1f6fbc3306cdfe80ba88b3083b6fa1

SHA256
ea9e81d280849de15c40cfb76efd2938f00a3d5a96bfdb00b759bc14dca790d6

SHA512
e4ed767faf7fcc3570331c08657d18011d6c1144967d4a448b91e6437d6a1005f4bc9150b48f5452b7e62d5b54eccd91be7c57791f5dea6bf162e4dc5bc29b5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000093
Filesize
77KB

MD5
78cef8b7260192cdbfe97b136f2e00d8

SHA1
2a03423b6a1818b0b6401a94525257fcb5846664

SHA256
03964f14d5ab1a82e1dcbc3b284a5c796a62026ab421384c5d028638b4cc9f6b

SHA512
9f25bb771bc2543259d40c0520e48d695a20d4598fd0a0e0928bb1516fd4088b434958a77c8aa8e1065e7044a0a69a0b1779f4d1e3773b1c74bfd2c5f6733dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000094
Filesize
34KB

MD5
d49200f4073c3d884a59d86dbb3dbca9

SHA1
6fde51b9bac2ad6102a50a2cd560f9b78d938a16

SHA256
443052023e77af7e6369fa554d3770c97f923b13a9044d99bfdbd1302008547e

SHA512
60ea2986e1f0e099d173948e95139e23f5aa884d4fc1b448b01631c44440c55fb0c534d2b891fc94c1ad544661b4af75ac3f3042668134e7449a47cce5ec8008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000095
Filesize
117KB

MD5
c3cfbcc5e547b7e3d3862ee8fe21f83c

SHA1
9bd606f445e7df0eb56b2af832cce133e978c82c

SHA256
a4905796bbfeaea69f9d3bc192c785cc19e2615a9f4c0438a88f9e14d2063a93

SHA512
6e889be02f5c86cf00cd31e99c14448bf1fa03ec4f33eb70232dde2f5df7781d592ec5a283d0629cef518ac54a8e74e054a3287e83476efe88a887071b9431be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000096
Filesize
22KB

MD5
5ead0b3500ba25653236810a7cadb6da

SHA1
dd3055bb25bd9d9bee7d6bbbb383f41ef9876036

SHA256
bacb6f68a4461ee0e92bd53470da8233cec30a664bdb1827dbe9dd8516a621d7

SHA512
ea2a563eb8f959f32202a561d37d317ca73a1942978d59d90d23cbb46469f659c7cfbeb7c6c6a8feb2934fec42eb29e9c14f681da8a26d2835e1922e7a9e7b6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000097
Filesize
110KB

MD5
e680c0ba93ed536db1704742be372695

SHA1
ab5f8aac6c38cb90a23bc0657f56a0bad60f7416

SHA256
fc1b5fb35896300f4bc6af15081c43cd2211f77b65e872e659d10bc8c8f26aa2

SHA512
e3179d8c1833c7643e0d42fa74d9e1ad7168c0de81f14e240fd2aa501ae4f0c485bc57ffd32756b57d434cbdd68164027b66289b08b951b9b2758b7c56011bda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00009a
Filesize
16KB

MD5
87db5b52825a4bdc2c6ff9e7c6b86d50

SHA1
7ec53dedd7e8744102c9d555b399a329223bd0d9

SHA256
2404f02f31d09e507267673623c36c85ebeb818a31bd71c9a9604385c892469d

SHA512
e28ff1d8e8b389545eed2d7b94f54ec1dfa16c520c901a5dd912852bf2bb5d846546b3ec4edbda8c8985d50b9ccbd6dac959bbab1b55c7aac4c7ccdabce6994e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b2
Filesize
122KB

MD5
32ea9ed0bde8770705c006f625400c80

SHA1
6cd6297fa700547846e8296c00f1df025c4c472b

SHA256
d17f87b38b5617348f39b723cf55fec9ed8e62ff0416f431864101f5d1934e8a

SHA512
3451b1cdb58401a21d40b70b4759efc4ee97294dbfc65af2285a97b2112f3ff544dc0e4b1f5fe8f698cc38a471ff6b2eb382211a6704b7ec5b542b9cc75d8fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
27bafb972947da1f4510bbd4117e1de6

SHA1
7368f6cb6890954f1b4b33b17bdaeda8e81089e3

SHA256
62b4f2eee9a95faee614ff7e18fe143b09bb6aed07a5b4ad1aeaa7d032097ec2

SHA512
c40cb56abcd5297da207ef9ef795baee194e1ffada6b616bb8561ea120b43266c1b4cc852a5bb3511346752b0fc6d21d12177116755af0c6f98909bbea703aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
6b237cca93c7f01e57bd5c1ec330e1a4

SHA1
2bc3706d174459b7160f55cfe4dd7f8a440d71a3

SHA256
a4f4d31da851e7a5fa538bb9a390c2a7e7f7e3dca76d182bae5baac4b0a68a4a

SHA512
57fb35b267014ff597c731fc3e4c827c2d440f46e183494b39a4d12f27c20daf0547887cd5568f4144492c6696fa93a37e70b75d250fcacb3ee008a2f1018908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
05447a0058e2a36307749e5044469469

SHA1
73210089e9f2fdfe202bb5375cccdfa814c8842a

SHA256
ddc5241c38bc9694d4680fb4f2bb1461d2d2f3ee6c00a12a1bfe322dd6e66647

SHA512
0d719c0e0de010de20246a57f4f0d06ec41db1bedacb009ecb0d94303d70695a9045111288df6301ddae997bf2031e61a974a4d1c7fd5ccc1de33469c87e0363

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
343356c76a2688a6c8f5ab23f6385ea4

SHA1
5e3940ea7bf8c7caf779161dfa56bcb1ea9c7a56

SHA256
ea7f81d14bf18437a9e2fbfda7b99cb411f275dedb34501d2ae6354590d610fc

SHA512
c07f2e8c0714dcdfd65db074d421b369a889d71dc83c44fcd6993d33df84b39235d9bf71f67ef25f77c6668e084b2a8bd5451138c2d6e21df9c2bc4244ae68c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_best.aliexpress.com_0.indexeddb.leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
02b0ea281ff4ece9f62aadd4bc466d5c

SHA1
5258ebabc1ffe3668f708ca2cff37dab51b97082

SHA256
4fe26a8bcbf5e18addbbed0a286069416bac1c0f2c8f070a31043baaae261e1d

SHA512
6769f0d4f2aeb7defbb9116f3cae19feb67d89f31378bc75e307a6565bc37926c6f6525bdcc42b08d0ca1cf299dcfd8da033bb8b15db0d67c128a67ffbcdfdb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
7976cc4d4f4b21bbf3299fe1e3a83936

SHA1
4295b61b10051fa99e26c9c9477112367abf2c3e

SHA256
1e3430b09a03925d91b0e04966364bb409430bc29dd32baa027fbc111489216e

SHA512
129bf674aa22f79e86b04bff0d30b4ee0e528297100f56a4e15b8d62f9b388d78aaaf343932acd8ac03016b9c087d32b714f80f184b2618438d7987661bb87ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
9cd2a996c4d1d3100a4b7113a2fa1465

SHA1
af8994d8dfb0fa8a81d4dc275eb3d7e5220a0044

SHA256
063d950013a12c8fed8f0814f9bfdb7a9aa8ee72859f9740ad6bde7eaa87ad93

SHA512
19e89bd82fc1f53bcfb28bb6d8182123ed37c17757ae9c4e5b532f10c0f3e516276aa869d7d29fb145d33a26041627c55b325aa137ffd64569a3c68ddf2827dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
d43ec305bca2eed94b6d43d3969211a9

SHA1
0537e096a4f3f2481a882e245cc9db7808987b76

SHA256
a1414bd5f9044ea570b5af536e3b0ff804adbc5f85251db088a82948e6de461e

SHA512
e6e9ccd2d97a47e1bd181ad15368138b1e5770ef81b284e454d99b211a2c85d4bc6ec0553e852ba90342b029ad2ebfb8be53cd013a3eec4f0ca52eea7d64b9a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
10686a6fee4668883818f4249c3fe3f0

SHA1
93f970197b0fb7fc45c3458c1e269193e2cba9eb

SHA256
36c4e165c489a6719e78da38063e063ec2299483ca731e579a9aeb1cbb2d4bee

SHA512
ce3e56818ce3544790277dfbbeb73816bc96b08c6a55aa3311ad7cb321ee1f4cf8a71b99908bb58a5d120ae1abd7ae3c7fff4d7adba7c3f9c01a030bff23d3b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
e856f48fe36600cdb12df89f01cf1645

SHA1
94d185e5d1c95deb0e9d9fb3579ad63d4c83389e

SHA256
602830b8942972ccc7b4a3b786a3b4cc75eb3f4348bc9c31543336b092247285

SHA512
73ec3d448542d1af87940ce6deeb631cd035e759a38ce598c02873a8ad9a0cdf321367622fc263c82a96b7aecfb1fb17b0509c1818e0cad55af1a21b01737307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
ad4ec45c9165c7c20f0c4b000d23e902

SHA1
ebfe0f4ba021eda341614cfdff7ae4ae00bd9452

SHA256
afb462ef225b34defa2128f47355a5f744bcfd2f197b7f695d5fe026c75d1afa

SHA512
52024c6074922f7fceee85bfd71460ce166fd92aa72132d357a5529d17f1392ffde4ea22139e5a64305fa0a3aab58901b5483f133b340db430cc2a7400fc1918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
0fcd2382e1ce8936f64e4c7d13a6ff40

SHA1
8e9ee7361d71dc481aec2a07e2d98f695bb60585

SHA256
f979f0d5de97157dc763e5e5cc4191aff14839b8f9b5e18a3db2db4bd94d39a0

SHA512
898e8527c451ac3a434c4db30ff88c7933852813132342e3db44314046bfe4fabf882b83f5bde0f1fb5b1836363160b16fa01160967711403f8742d4228ede2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
6c27f6073504bb8c95287a9476e7a58a

SHA1
0a2f602dd00595b1a20c500afaf2eac9eb98b277

SHA256
c427fd7ba34ba91703ed2b4fd242bafdd571e68bd4b54bbf4fdf4578444f76ff

SHA512
5f7ac5be114f3d96e0950393345caa089f2cecc228851849bd3906cb7f9b4de3c177e5aaa6c12d8ea5c82d1387b4f772b13771daf2ecd0fce0fd1cf4b44d49b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
0f0cdc88d8dedde9bcb5b23a56997f0f

SHA1
b3e8965dbded091ec2148829f6f37728211ee4a5

SHA256
31c0e9f01bbeb07f5dc53ddf2fec9d83d4b43f2d69c3028f5684fa051bb57d46

SHA512
65d7d22baea8f567e69ce0264ccac8c722c1a35fe4ae2baa9d8e2ced5b157300ca09c9d343a047f97e8ce3b955635d911384274f768f2aea8e198cd06dd4ea27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
14705f56a2c8b50954bb81ef5cf10e1d

SHA1
45d23d7614cd3e993a9d5d1b98eb61c04ab0d8a0

SHA256
39fe40aa76d780962565fdda297bc220c28d972904757dab7b28cbd2db32c27c

SHA512
195516fa893daeb2f9321a7d2737a6e8f98353a796f6c19562b5524ec7ecb4629a4f797e584f968fc875d816da32b10bd632318f6721c72738c0b3a08941d091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
f3f901cb1937b4c07f462f0ddd003f69

SHA1
358b1e8743136a6d0535e5f5b6643446b2dee465

SHA256
d0d9b8bbab3ae14f1b2359a1cfcead75fbc9fa01726b47caf29cd04b6f743ed6

SHA512
e6ef93421f961177be1e176ae733e1869c47356d9ad703d717342a613d6364d28f01570710ec155f3990a6bf2f2dab77de7e40a206dc888279ffc99599cf9dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
26abcf6420f5e095651b869bbb28d913

SHA1
3fa5bfa2aa5934ccb153881697dd6b38cf9b2d7b

SHA256
b9f09028178fba4b4f5937113d88aab9efb4f9085b6f076cfeb95e57d5f9b8d8

SHA512
b7d0857710f1b595db47ce65576c658a15d90d509906e25ec3ac0b4aafa270fe5277b12516127ac7ff0ff7adb7e2a185e6406dd25a8928315940a39ad4e386ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
264B

MD5
d1910a49f3a7442e29cde3432b5cfab5

SHA1
88cb262a4ce15907792abe6302adb9507e7fed17

SHA256
1ecc57017c38a27ef3e9ef72533255f26ec1528951c4be55174f48ba21272c05

SHA512
3899e5d3c937a259a83c14d583cf9c26bc810d542b3ab30cfb208715186cec0c9cb959e6a81b208ec00d47d55e81cb0735456da380dcbe64bf5ad57d9d58b9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
240B

MD5
046319b2717658b94a3ec76ffa48f721

SHA1
cbdfafcdf2625200299cde54474078754c4de82f

SHA256
10cc8da3a73e53f890c4ef98e3be827263a54deceefa3fcc5c1e2b9767fee99a

SHA512
3441254d672e5e36086b0eb52aa1de6dc61b765edc4c6c73cb00a551925cb768110a420e63a7fcf8dc52628021653327a5075f18d01f53b886767643cc69a705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ed0f.TMP
Filesize
48B

MD5
dc3d2e09cb6b9e2d5b21fc7652877472

SHA1
20879d907206a04118aeb6818cfe04b3c0ebc0e3

SHA256
7279a583985f9d2a0e4afcf0580485f6999086167499189b5c6ab8f2ff1d4427

SHA512
46781ae4c1d837f4ca4fff15fc8c8d94d27df3093e01082dea6b32199635f8dfbd994c8929649d8be39df4d88e76ebfddbefae0d27b41cc3fcbdd5ec0da7af93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
81f3745ca45c7374779d24c268974617

SHA1
35ae2b4103c28cbdec559e6f1db5ec95ba7c78fb

SHA256
719fb4dd66524fdb48bbfc6cf95b09de7d77c9fe01cc725ec40a955257bf1f22

SHA512
b1948d4c751e10c222c9405ed14328492ed2ee38dcac6f13d5080269935a0ee8ae243be846fefe943b2fb8fd506605cd3218df980dbe23b7b9f6166eed9ec715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
8962e9ed1baa1c73aeb4870957c33273

SHA1
f185b42e613ed56abeccc65ca41626b142625c0a

SHA256
ef0f93cd719e969666d647f1875e3b97a7144c4092ef5a31caec4808c79d3a40

SHA512
12661bd4ca4490fab87a702deff34b2f8d320aeea08c2adc9e22d736eeb2cbba71b5c094e0353607a86e49fb6c54f6bce28da04ba1ca37b3059f8bbdb6d34dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
57abfa2ec3a2bf043ad694f257ae60ff

SHA1
c83251d46356478908a7ff571db74e32edf54b43

SHA256
d0e5fc734b7718d6da27a24403a17c785469ad1b926ac8539fdab45d253b6680

SHA512
6bf2839f20fb6491326b9514f9eaed21522978ecb865eea515c978dd95589ca90d2102d7a94688e3d3c11ff5299c2495688e46455f15b1a0196f20624162a47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
045cdc6183ede0858231bd4a442aa0be

SHA1
96abeece8761f06db82dca6ea3bf200857ce6875

SHA256
8d7a3534afcd389b2e4b506a628917887826b7add5564e29e317dc95ab3e1b54

SHA512
275680fecbf95edcc164df2327c58a2abfd4a83138f977e86ef571eaf72edf514c477af941085e5f28ae25db65880353e8b755fbd1c0541f0560bfe443f8d696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
e5753600e79b327e4da6346dfc084a21

SHA1
113dafbf7455725e0013361b9b9586de3813e339

SHA256
ab5930eb766c1d93e3c86f26c1641a7ea07f39e90cf1740b31770cb17090d186

SHA512
89c88fbbe871118f7a34cecb890a032f06d1c872cad590e39f83b6a143291f3e5128e0c443b6c4f52c81ccda899520cc13bcb9cf8010de82d47128cdf53bc6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
0673a056b0828dd70ed91e489d24ac1b

SHA1
3161521b003e068fe5744971db7e948e3debdb80

SHA256
d86ade0e16e48dfa3d4a80f7f972407ce629dc0f6000f23b86ec01e8b5efcb03

SHA512
1734785e279facef3603ea634aa4862b92a90c66df8b4d12d7fa2ebc882c03fdb65e22e237d4359f5470135a6ac4292b54e2b197c27ea3a7398193841553719d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
f92435dc4aef71df30c6226ec67208f8

SHA1
d4388c1c76fd628323788b1dd41314d1551c7a60

SHA256
6fc64279d65138523a87cbe8f67911dc4ef7b183d3b8f75380e8ba5e01c12f03

SHA512
31d7a23440124e8bb9c7a62c45294cbe71ae5ad6c63dc33dd659eb2c69e0269160b80c9c3cadfa652939e7aa4c3ce35e75bd2d305d74bc8509505805b11334bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ba76.TMP
Filesize
2KB

MD5
b25855a710664273b872e491fb65e5dd

SHA1
aed0d9a917c8648edde4ec318aaa720919b664d3

SHA256
e9895ddfdafffbca95d707b79781481b8525ed38381a0210d4785f2f5de18cb5

SHA512
4fceb4bdba16902191819c39814e6edd99bc7db892bf71753dda1d94fa72d84924a50ba815486822616e23e7851070b2ed8decc44c40e8cc061bd17ab1763bef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
3345200533307ca9d86d88a949eb1ad9

SHA1
13989db6150882b77beee6526332f0cf22f44d8b

SHA256
a51218e645fe6893ef642a61d984babc66b3462245a252d117a6bf9410fdae29

SHA512
1991d114773f1974b9a39a7e7ff904e70d35c050ce9aaac42fda037457e21a0e2d4a0ae3e30f75c4c5ecc17a0a82802e016928fc4fe27122654a48d823a29074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e48666c053400b1050cd8329c3558d88

SHA1
74d8f69932671a2883440bd14efadc1a6ae30318

SHA256
3cab67e4239fce24696b6bfd525fd903b038a67b2d22de2ffec6ae35312f28c5

SHA512
cd616f6b683b6367bacc19a8639d1eb3619bd8fc854b413336e6c6f02bd39f4a2131e4424fd681b870e4c33cfb627ba28dff300e6a52de7a3bcf172397fa1365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
7f30c33595899290cbccd4c1ef44bf0d

SHA1
38274021424310cf5d2e3995317d2ff05252478d

SHA256
e0503dbecf1bddb3eca81b1c72faf364ab9275064c78790acc6b1b07c301f1c8

SHA512
9445eace553a5b83ce6fe37a33c92e85564c6017e70ef2fa091d3ca7c7b27ea42300ce2081ebe830a59d6c1a590ba9304cf734d7c0973ba896dd7df0cdfe99a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
d049a735d89a6813b20a4cc048e9c75f

SHA1
e025b7fe56ff8c1ea0a7cc2d4ad47d1360127c05

SHA256
26b1cb0e9d6a035849f756f23edf6f4412bc1ca91010b6edbbe0d29d164cbdb3

SHA512
6e9a737c8f86785a716d93aadcc83b7a6e4f537c36a2c875c7b9d87f3f009f5a0bb9ba2966751992e8bb142846903315677c69009affd8cff09df4abed861c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
4e61929b8d68790306e4bef5bd07c058

SHA1
07931d054fef074e27bbbdf22fb34ae5eb9f00e9

SHA256
6eb8189c69fcbb24f961f4100d6bb53cae88f5789e24c196aa1381c88610b98d

SHA512
3d738ed4705c2fdf00e7ba32ba1699035d170bf73c99882c57e3f196fa572956fa0886add270935a62906def6c593022a6e911d19d5573401f096fc3002814b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
a61f625637781e5760ef1cf013811c8f

SHA1
c647ffa528c0ef6f18f438fe466ae6708ec8413f

SHA256
b59edc50a5a11cdd0bb8e7c40197b30ba6a6cc4a54f3f0f7d8bd25b0318f3deb

SHA512
b00dcb6deaa3c12c7c261153a758e349370bee84ba05e8a2633b293f4b0478c80b63a2d9e625828bc4c0b6cbb058798eb1640dff2590045e054b0f23caacdc38

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
Filesize
238B

MD5
7716cbe6c9db44c706e45b14ed7e7588

SHA1
4d9e3be70a241521e371372f305475ea43990e56

SHA256
f1663bd46145c0b41ee9c208ab668644c0187e4f162c97c3ded39473faef88b5

SHA512
10dfa0cbdfb81cc36aa7b234250f937bd840dfa7c4c79dbf12a6065dfbb2ae29501b56597d967609a8ef37c2f0b967d5fc52410d19297487f2f9d7f9345ca337

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json
Filesize
2KB

MD5
f4e4a03ebd0ab3a953c56a300d61d223

SHA1
97a9acf22c3bdd6989d7c120c21077c4d5a9a80e

SHA256
52bfb22aa2d7b0ce083d312fb8fa8dcda3063207186f99fc259aebd9064cbedc

SHA512
12aa71eea45720a4d7d057da0b662635671e4cd165ad2e0d30a3d2a43950b47dd60c26c1bbbe049418f815850e571b8d93e4c8b8cbbd686abc3cf7926ba719c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5773892
Filesize
1011KB

MD5
332bb93d46aeefb65f1525b015243a74

SHA1
df712ba49fce02f00cc717d50cfdede4e0e7cad0

SHA256
74dd451fe484776902e271985fb0464c0c75b42ef09c97ea7acb52539a46003d

SHA512
62b6ee33aee8cc413192905b57ae6774ab8e984098ebe3d53959334bc6b7bba1f286f51d534e96a60156739da9c17b469d97bb8e6197260ccb7c9cfeb9c905a5

Download Submit
C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!.zip
Filesize
13.9MB

MD5
c739ae6a85f68db5d7b5cdb741765f8a

SHA1
ba0f09c685237e898fdff52ebb93025399d9d648

SHA256
633ebc42c069155ba0a6f116ab3a3c12c34de60f44a83e1eb0d40fb97731132b

SHA512
eb019ea6c76219080bc50d4e59bc1312635676cd440b99121c0e44deb885c15e1a3d662e3eea1e840beeaf63b6687fd7cbd3b8dd84793ba90d551b7cc95bef22

Download Submit
C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\MediaInfo_i386.dll
Filesize
6.2MB

MD5
92ca7e5d272e75a260ac9c326184e561

SHA1
9640262e59714e6909edfab5b0f59fb6fc374e4d

SHA256
bb2451d45677197c42655b51fafb95d7be0c2fc3998e4de8bd3a7ee2146de52b

SHA512
eedbb4f66c04c03d2fcc0e8af8648a1986ea77468a5778d6bca6839d9633ea044cba00535c742478684803f8fc6a72366f654be5ac5b45a35798060d84141235

Download Submit
C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\Setup.exe
Filesize
5.5MB

MD5
ae697c5f8ef74fbe8daf09358afd9324

SHA1
8e18a9ee76df13daa5cfaf079872c77a25f15338

SHA256
4fc64e114f80ce755040ac2891bd1fab0492a831177491f3fe1382adf94030f9

SHA512
6f2bdd0c9d746218ab8c215e7d9fe1acaaf39763077eaf1a03754acb4d8ccfd518b052d98675ebf0233bbd3aa87ceffe1ffcdc14219b0a6f308d84a978a5f23a

Download Submit
C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\piton.ai
Filesize
779KB

MD5
59e6d97b789486db3427e689a75fac6e

SHA1
3e00320f4cedbe34f4e22d54c279579255a6738f

SHA256
f2b601613bbb70eeb7557aaabea5bf5fe915e049d2dcdc23ef5ef67b0b3e2ab3

SHA512
607b6a2dc1788ddc96259e18eb96b505cd1ad29258ede5a3e83369ef02aaa27017a89d5402ea08e17c76663435da1c0ee4fa01425265b707835dc0766d6aaafc

Download Submit
C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!\selfrepose.jpg
Filesize
36KB

MD5
643dbb0b31d40d535aa55b408074b669

SHA1
f68dc031ffbfb9d55ff7bbcbc0a7b622b093b0a5

SHA256
a00b85c26bacf364088061eefbc69d5c863777d212b4b63416f492418841b2e2

SHA512
d07aa2db8a0625deeeeacebe10f3160eeeca0d1642d5e1c22ae6c3429c5483af2333a7dd000b8e04a4a954679ce0d7041c4cd7161735ec2d610b5c28336609e4

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe
Filesize
3.7MB

MD5
3a2f16a044d8f6d2f9443dff6bd1c7d4

SHA1
48c6c0450af803b72a0caa7d5e3863c3f0240ef1

SHA256
31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

SHA512
61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

Download Submit
\??\pipe\LOCAL\crashpad_3608_IZJYJUJGWKJDRIRP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1096-1978-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/1096-1979-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/1096-1986-0x0000000000400000-0x000000000099A000-memory.dmp

Filesize
5.6MB

Download
memory/1096-1984-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/1116-2044-0x0000000000B10000-0x0000000000B68000-memory.dmp

Filesize
352KB

Download
memory/1116-2042-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/2228-1992-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/2228-1991-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/2228-1999-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/2228-2001-0x0000000000400000-0x000000000099A000-memory.dmp

Filesize
5.6MB

Download
memory/3200-2008-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/3200-2009-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/3200-2017-0x0000000000400000-0x000000000099A000-memory.dmp

Filesize
5.6MB

Download
memory/3200-2015-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/3204-2033-0x0000000000930000-0x0000000000988000-memory.dmp

Filesize
352KB

Download
memory/3204-2018-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/3204-2025-0x0000000000930000-0x0000000000988000-memory.dmp

Filesize
352KB

Download
memory/3328-1953-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/3328-1957-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/3328-1959-0x0000000000400000-0x000000000099A000-memory.dmp

Filesize
5.6MB

Download
memory/3328-1952-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/3600-2003-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/3816-2020-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/3816-2028-0x0000000000400000-0x000000000099A000-memory.dmp

Filesize
5.6MB

Download
memory/3816-2026-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/3816-2021-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/4172-1961-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/4172-1971-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/4460-2032-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/4620-2046-0x00000173DE360000-0x00000173DE370000-memory.dmp

Filesize
64KB

Download
memory/4620-2050-0x00000173DE3A0000-0x00000173DE3B0000-memory.dmp

Filesize
64KB

Download
memory/4648-1987-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/4840-1977-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/5192-1989-0x0000000000970000-0x00000000009C8000-memory.dmp

Filesize
352KB

Download
memory/5192-1976-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/5192-1983-0x0000000000970000-0x00000000009C8000-memory.dmp

Filesize
352KB

Download
memory/5356-2019-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/5428-2004-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/5428-2014-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5428-2005-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5516-2006-0x0000000000450000-0x00000000004A8000-memory.dmp

Filesize
352KB

Download
memory/5516-1996-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/5516-1998-0x0000000000450000-0x00000000004A8000-memory.dmp

Filesize
352KB

Download
memory/5752-1973-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/5752-1965-0x00007FFFDCDF0000-0x00007FFFDCFE5000-memory.dmp

Filesize
2.0MB

Download
memory/5752-1964-0x0000000073310000-0x000000007348B000-memory.dmp

Filesize
1.5MB

Download
memory/5752-1975-0x0000000000400000-0x000000000099A000-memory.dmp

Filesize
5.6MB

Download