phemedrone | hxxps://google[.]com

max time kernel
277s
max time network
298s
platform
windows10-1703_x64
resource
win10-20230915-ja
resource tags

arch:x64arch:x86image:win10-20230915-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
22-09-2023 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com

Score

10^/10

phemedrone evasion persistence spyware stealer trojan

Malware Config

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Downloads MZ/PE file

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Control Panel\International\Geo\Nation	package.exe

Executes dropped EXE 4 IoCs

pid	Process
5388	lic.exe
5252	package.exe
4768	UQGOSTIDVY.exe
4300	DUFIXDUWFS.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lic.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	package.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
533	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4300 set thread context of 792	4300	DUFIXDUWFS.exe	155
PID 4768 set thread context of 3688	4768	UQGOSTIDVY.exe	168

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\4032412167\2900507189.pri	explorer.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\2717123927\3950266016.pri	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
372	4300	WerFault.exe	153
4196	4768	WerFault.exe	151

Checks SCSI registry key(s) 3 TTPs 29 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133398483071339697"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e70709004100720067006a006200650078002000200033000a00a430f330bf30fc30cd30c330c8302000a230af30bb30b93000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c00000000000000000000000084c1311b37edd90100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e70709004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000b8301d1a37edd90100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e70709004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc7600000000000000000000000053c57653b9e7d90100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e7070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e7070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
3788	chrome.exe
3788	chrome.exe
5676	chrome.exe
5676	chrome.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe
792	AppLaunch.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1920	explorer.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3132	MicrosoftEdgeCP.exe
3132	MicrosoftEdgeCP.exe
3132	MicrosoftEdgeCP.exe
3132	MicrosoftEdgeCP.exe
2916	MicrosoftEdgeCP.exe
2916	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1324	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1324	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1324	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2428	MicrosoftEdge.exe
Token: SeDebugPrivilege	2428	MicrosoftEdge.exe
Token: SeDebugPrivilege	4768	taskmgr.exe
Token: SeSystemProfilePrivilege	4768	taskmgr.exe
Token: SeCreateGlobalPrivilege	4768	taskmgr.exe
Token: 33	4768	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4768	taskmgr.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe
Token: SeCreatePagefilePrivilege	3788	chrome.exe
Token: SeShutdownPrivilege	3788	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
3788	chrome.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2428	MicrosoftEdge.exe
3132	MicrosoftEdgeCP.exe
1324	MicrosoftEdgeCP.exe
3132	MicrosoftEdgeCP.exe
5388	lic.exe
5252	package.exe
3784	SearchUI.exe
5132	MicrosoftEdge.exe
2916	MicrosoftEdgeCP.exe
2916	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 788	3132	MicrosoftEdgeCP.exe	74
PID 3132 wrote to memory of 788	3132	MicrosoftEdgeCP.exe	74
PID 3132 wrote to memory of 788	3132	MicrosoftEdgeCP.exe	74
PID 3132 wrote to memory of 788	3132	MicrosoftEdgeCP.exe	74
PID 3132 wrote to memory of 788	3132	MicrosoftEdgeCP.exe	74
PID 3132 wrote to memory of 788	3132	MicrosoftEdgeCP.exe	74
PID 3132 wrote to memory of 788	3132	MicrosoftEdgeCP.exe	74
PID 3132 wrote to memory of 788	3132	MicrosoftEdgeCP.exe	74
PID 3132 wrote to memory of 788	3132	MicrosoftEdgeCP.exe	74
PID 3132 wrote to memory of 788	3132	MicrosoftEdgeCP.exe	74
PID 3788 wrote to memory of 812	3788	chrome.exe	78
PID 3788 wrote to memory of 812	3788	chrome.exe	78
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 4124	3788	chrome.exe	80
PID 3788 wrote to memory of 2296	3788	chrome.exe	84
PID 3788 wrote to memory of 2296	3788	chrome.exe	84
PID 3788 wrote to memory of 2688	3788	chrome.exe	81
PID 3788 wrote to memory of 2688	3788	chrome.exe	81
PID 3788 wrote to memory of 2688	3788	chrome.exe	81
PID 3788 wrote to memory of 2688	3788	chrome.exe	81
PID 3788 wrote to memory of 2688	3788	chrome.exe	81
PID 3788 wrote to memory of 2688	3788	chrome.exe	81
PID 3788 wrote to memory of 2688	3788	chrome.exe	81
PID 3788 wrote to memory of 2688	3788	chrome.exe	81
PID 3788 wrote to memory of 2688	3788	chrome.exe	81
PID 3788 wrote to memory of 2688	3788	chrome.exe	81
PID 3788 wrote to memory of 2688	3788	chrome.exe	81
PID 3788 wrote to memory of 2688	3788	chrome.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://google.com"
1⤵
PID:4780

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2428

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1324

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:788

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff906e39758,0x7ff906e39768,0x7ff906e39778
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1916 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3736 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4772 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4864 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5040 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1620 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5504 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5864 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5996 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5988 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5436 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5420 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3748 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4720 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5840 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=4784 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6404 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6028 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=3488 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5272 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5340 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=3096 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=6764 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7048 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=5500 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=7336 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6756 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=7648 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=7080 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=7276 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=7264 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=8132 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=8260 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7940 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7224 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=8612 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=8640 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=8608 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=8520 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=6972 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=8328 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=8248 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=7140 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=7096 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=8620 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=7180 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=8584 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=8784 --field-trial-handle=1968,i,3884667857358449726,8513940399849027689,131072 /prefetch:1
  2⤵
  PID:4804

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2068

C:\Windows\System32\IME\SHARED\imebroker.exe
C:\Windows\System32\IME\SHARED\imebroker.exe -Embedding
1⤵
PID:1460

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x42c
1⤵
PID:3768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5496

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap10378:92:7zEvent7956
1⤵
PID:6056

C:\Users\Admin\Desktop\licencu\application package\lic.exe
"C:\Users\Admin\Desktop\licencu\application package\lic.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:5388

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\licencu\application package\Settings.vbs"
1⤵
PID:2100
- C:\Program Files\Windows Defender\MSASCui.exe
  "C:\Program Files\Windows Defender\MSASCui.exe"
  2⤵
  PID:1856

C:\Users\Admin\Desktop\licencu\application package\package.exe
"C:\Users\Admin\Desktop\licencu\application package\package.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:5252
- C:\INSTALLER\UQGOSTIDVY.exe
  C:\INSTALLER\UQGOSTIDVY.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4768
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 140
    3⤵
    - Program crash
    PID:4196
- C:\INSTALLER\DUFIXDUWFS.exe
  C:\INSTALLER\DUFIXDUWFS.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4300
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 132
    3⤵
    - Program crash
    PID:372

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:1920
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  PID:5328

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3784

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5132

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5052

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2916

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\326b4bfc-5e3f-452a-8d75-16ba3f43cb37.tmp

Filesize
7KB

MD5
b4c1d405bd7508236c79df5874aa6c2f

SHA1
a34aceb95d1c9df5c5f89d2eda9502c41ef46128

SHA256
4c0723726e9cd55ac0bc4791e7663274fa2ed3ff10d6d56f54ce57b60de1f51c

SHA512
3c44af3a681a02e0afc2ae2eb8b53bb4e5a162cbb24d819eeab03dc97f01d9bb172b2a3825981c511effc306abcc564583a0df074f0f0e278e6572fe01bddcfc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6a9d0bea90651f0b47edce9ba9544139

SHA1
b1052fd30ec36c2f8427a83c3cbef98314a74671

SHA256
3b929b713a41b87c36fe06884af467169f6d48e280cda7fc010d0daa43af40f4

SHA512
1b095083a3c6f2be6549f3022e8c7b6742afdb06539ea419e6e2995a229491cf80195064076decbe46bd82077518aea916539278028dbd640d69b934f9b65946

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a2a8da61d28f2949be930775fea3bba6

SHA1
12c52eca2f0b58c6d812f73debc3dfcfc2a4eea7

SHA256
91735f363ca634b349bb95542c6fd9980f86cebeeb9e9bde9b3d64a549e3445e

SHA512
d0b112c3d7a459b09ebab6a48b62f593a2d81d84cca17537a676c867cab94f10c54177896b79e497280252161ab7d649dde0f0a2b2e18a40ef9d03f26dae433b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
22a5e7aad563e0d0a10ce5853eb96b86

SHA1
b6171ca0d4556dd9e8f8b8963bfa7a2861347531

SHA256
652957f91e76fb8039687b45ea0b3f9a38e6752d027c34998a06c5578673bc49

SHA512
6881604adb8349573a228c55e56ea26f790c398aaba0548e51bfcc98174d92d94ad5862c335a17acdecd76aa9f4e825dff19ecddcd94a854bf8b69528388a66d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
14KB

MD5
ce16f59ff11eecc77baef1ed704822f3

SHA1
183b2fc73495362d35897bf48387ff99e13e2efb

SHA256
2632d4dffdc18eabe8c5b31758c23a4e00c82c5f8cb7836e7bd23b4d20fe3856

SHA512
68fb343c454becd52ef8d4642b64d776e20cbc60f1d234c0035f1cec1965bfb54129af3fdddcacf70695cc0bd440912db96ce610bce4dffde158deccfb8f518a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
870B

MD5
862a69580a770f251065a659a8d13b14

SHA1
04f3802d817054d135b7ba296c4a5fc4ed12d608

SHA256
3e0f99162016140612a2b63e2868902735b9768faf587bb12cd490c504251176

SHA512
17d597a3968b3854dd49365d5fb9a5d8705c0ed1425291bf39ed2aa152ebed6666b2d616b4e69e429a502dd4da9e9135f5961aa34412733a1f45b8a13c397351

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
866B

MD5
7adfb02a89fcd3ccac93a1447d1edd0a

SHA1
5b69981ba1bb31c50c5cefab0f104dd767e3b14b

SHA256
883aa9e05ba6f74d04d4337737047094137db01bce07682c22a548e39d255087

SHA512
774c5cdc37de170554420fd47d48bad80a31f7c3c1fb06b7c7a961129773913d4db692a26b554d7211229ea7e7f602eaae72b2c3da943ec01f480bb60b25f38e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
870B

MD5
1a4d6f7268041b6bcc7519bf82d716d3

SHA1
221bd6d28fc01ed71568e678fca627565ea78866

SHA256
1b97a7001984c71d1d3b6cde172d809cf2e790c2094e1d4acbd79cb58a26eef5

SHA512
a60b7e224cb11970574dc1c17c248ed1686fc0e101f9337acc5abdfd398b8cf62d225b4f30449dc395abf02c316a5b51c49ba4c6ef833bd0e3d2af98aa324c34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
aeb32a5a1072cf86fd3e38935d3004b5

SHA1
2b2b5fe4919154748b78a42b84fbc13e20207111

SHA256
b4a644a81baf3b66157c22e8131260f243238bae55dd34c00e81005cdbcde83d

SHA512
8148ccc2cc896691957be6a30f8d00656c85785b71091f089611a4c02e1aa87f470bd1aaecb1c48d576aca2beb76288d8b0466a4d5a6c3b22abe8a39ebe8327a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
c0604ddd4a497b655d8e3020a73288a6

SHA1
483427671de0026013e2d8cbe2b5f2975c2f003e

SHA256
60f7f7ff829e141d6edde06ad32c760c763e9ee90b83f54385fff6f2d06c04b4

SHA512
3f7f5fcb11843c7201d50422a60dbfabc113115a78a2ca740083ea43f37491078ddf87f45cd7f7a83bd946018a95fba02270c6b6188231b7ceba14ccfbc88e3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
8fd20bbff2aa34334fa97d371a82daae

SHA1
4eea310695483cb10cd1ae78afc2c6f42f249513

SHA256
101beb489f9a2dbaf8b1d1575786ba1e0b40ceceff285c0025f3408df0aacf40

SHA512
785eabaf3a3c6725bf3add19d4b0a8e5757888fb11fd7183dcac72dea8dc34b3181e35dd1e9554544ea48b9d8db2eb7054dfa82f2ddc59a95c8828fc6d673ee9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
3a11e6b3f76d5ac7835968c07138f598

SHA1
8200c04dac7140d8cfe4dbaadae29895e4b846b4

SHA256
43a58358d009689f0ef76e6e3fe6324b8588a6b7e63a0209baf435b4fb913707

SHA512
b932555f8b54ca82e8094c1dccb8809c1548ceb70619d6809b2496785758777a37ef78db823c129c7da1dba1a0c0acd32c17133d12c778cb6a350a3fba5a2ca9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a2e2a258-2b68-43c9-934f-10bb256b4551.tmp

Filesize
4KB

MD5
3f932fe8f5ab196555505c283ebeac89

SHA1
eebe2e58ef80001bd54e17e2adb17e8c39aa1dff

SHA256
7b51042ff1d051a23ba7faf07d8aa4857974fbc9ee482d8ee38028ec7007846b

SHA512
6df2c2f2de35371a082568ea8b157dd7a093aa4b3fb6435ea827f7c385c2c0061fba0aaeb8c9056efd4a505d783615ba537e97d3f1f845f5b8fbaa5ac9087952

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
60519d05b06db702d5df76ad04b36522

SHA1
f4d64b4070e19d377700cc53dae465f7df6536f3

SHA256
e79fb0d5e518120423dc10fb1570c6b338a4fe97c3debfb2ac2d2f6aec6824ed

SHA512
a7fb0cde5fb887bfa0c30052e737e5b6a81d7d7e573e2851fdb36d8d0ba13ae22e11c13c6d2d161cd7a581c9667de47be58fabe6780560c9fc41f7fb86d05b78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
037be050309574e21ddd17cb4792c384

SHA1
5735f6c465f77ff60ba03416358d5ac64f0aba0b

SHA256
8c2c2c93e58b641af367614306b5cbe7a6f293c4b97e8569665e917dc652c95b

SHA512
2a89cf0a674350e506cafdacde9e980912d03a2ada7b81985c0813f357c3f0d7e38b975dc0763ee6387d213cbdf607afa3715a1cc3ffb9142dc5c2fa9b69239f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
033320329701297cf0faeab45cb3108d

SHA1
a547020ed70469ee543d33050458349f480b85b7

SHA256
7e291834b28c23417e598cb5213e4a87d19cbb17a19feeb9ddca3164a8f3a8e1

SHA512
1f73597e1f91024a02ed50c11a72fc37d97c49c61b51597a7dff0d82ac2796756e3da728351e29397e96a141834b2a153cdf47679f62af3f5dbf34c45072fcfc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
55a0e61c297eb7333acc61d3a5025e96

SHA1
191dfe5597bcfd541ef380c414a99e7334d9237d

SHA256
f81fadf4507135b6914bc110f5437ac0651809f99eae9caead48e3241a975362

SHA512
6dc90c01f797891ff8ab4b2ab260a7caaff04766816a55b1e39a9659031d1d034859d953a0772ea10d0fec65946afaa56d24ea13732c32d03ceded625975f3ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
88fd77504541ca3c19d81ef8a17267b8

SHA1
af6bf8e479828a68d3f6ad7a6b1d2e3f3511405b

SHA256
ab93e92adadce56b8e4ad69ea5a36ab4691a77b68dc7fcd66ded01908db9bec3

SHA512
8030ef3663799d81fb66dc9f4c43a4f8c64b38b08e2a6b3b26a26c196b7804f6fa45cd311795c8caba5802ae9c4f0b0d0f94b501fbb6c31b01e1eb3a39b0b8bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
c58349940e050ddf4a19b91c33082250

SHA1
7dbed59ed29e1948992865871f34fbf38a55b640

SHA256
40d5279278c8c99287e2254bc716cc3da0406231daeb9d46cffc2bbfc79f9e4d

SHA512
f3aadc8ee1f7a581fbf22626f15835bc751cdadfacc4e9623618826b86b98c4b2ea5ea829c688faae590beb812f53136a2ab1edbce53cf815375437d9093ff2a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3ee13c72-f041-4387-903a-981aef17c62a\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4b988370-e7d8-487b-b8b9-0d4d40cce904\7c249cee10a42897_0

Filesize
2KB

MD5
7bf245232c8df261c5413756c682f529

SHA1
7c2fcf59a987ffa5a7d2d73ffbcc449afdf146eb

SHA256
30d3ae749b9fe51b94252ef9f0bcf1253af22dc8f9a1b39f950d06bf1e38261a

SHA512
c9f502282671c89ac9192585a468d8c8cee49a835783c04ebc591c310195a7b7f42c4ca07a7f3c0f5ea697035608e965d706b50601412d5915b9d2c4fec6860f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4b988370-e7d8-487b-b8b9-0d4d40cce904\index-dir\the-real-index

Filesize
624B

MD5
a599fc8da1a069199f30712b50a96f4d

SHA1
cb3a50d2d8fabb5595298ad33da3d822c92456f4

SHA256
6b4a7c084e5cfce9d07d1f874004a9a52dd1f6a4b38bd2ec9da6a43560347289

SHA512
a60906aabcb3ece80b7b028808976a23f71d2ebfa02cb4e623651efefca00a6e3973ef4336bd6faa736a7845342086469b3b62f8018c4613855d0796a159b0e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4b988370-e7d8-487b-b8b9-0d4d40cce904\index-dir\the-real-index~RFe594e36.TMP

Filesize
48B

MD5
a866bcb4089cdd019a3563a3b07b4d31

SHA1
fb3e5bd53d7e08b121f2d13215d9014cf429c06b

SHA256
18ba782b7b05d6a646b1df69a3ec9647a2f17846ce86830d85e5c2ef19751e09

SHA512
5a9cfa11bc8939549d2004cd0bb7d9602b6776a6c83f92dc9172885b584603a191051a401fb0d141b4d73ece2afc2667d83726ad85af2046001447fc14c4e8fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b5c024ed-4733-4a11-b00e-18e3f351e455\index-dir\the-real-index

Filesize
2KB

MD5
34b3973dc31ff0e5fe8e35729d6b33ae

SHA1
1e009aa463b4865834bf4b816013f6c38c228e02

SHA256
7608dd96eb0578f0d23429bd221f3facb54f42a839df45d628f1203372819081

SHA512
dffef1e3a2b2ec84bf9134c6a1c24776b799f49d1275a2a038cb33b98d313fb7f6b838cec4e939705a7f0027fbbbc0b783c8d4060ef4144db2e7c5be3b1ffb38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b5c024ed-4733-4a11-b00e-18e3f351e455\index-dir\the-real-index~RFe59baf9.TMP

Filesize
48B

MD5
f2c5ef3b1a942e6f0534b30cfa7d359f

SHA1
cdf053fe9aa0469abdc264674a9fddac71cb669f

SHA256
6879d28013bf197c3ff4dece66020d46696d16640fa29a2457ad3bf1d92f09fb

SHA512
22e345b4ccc836f7e02c2f4018f57646d5ff1d4e6ff3e1d701dd6a0147bd5d6349aa65bdedd5f296c1b6dd0996be1e76dd067349469ed99df6362b230ccb92d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
176B

MD5
082009c3683912fb8a9cbc0186caba0a

SHA1
63dd74bc5036dbc2476b49f4ae2f5e5719690a9d

SHA256
ec9efc105900f571e97116f87aef02b7e0462f24152d465a956c33bd0c1264e4

SHA512
b473f0d5ce32ed0e809cdda1a82b0cceeb670e27fceeed46278b677c05c20a0327c65d1af6e52d3839fe2f96d9c9924f3a9183cddb9d1d8bd2c31d7f68f18d72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
112B

MD5
5a6e1517283726a36687e70b0e7a6e50

SHA1
0e9241c4033b36214e27fa7afcb0976fe7cdbc5b

SHA256
5b03765d96a2f892ec5377abd759596f97498fe1d647b1cdf397cff083c0938c

SHA512
d54ad4e9505a42ba7cd0c51ec48786eb786df4908dfa2abbfa30c561f943d61c919cf45b81eb67e4cc394dc517cdd22001b0211194aaee61cbbd50124fd57521

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
183B

MD5
59d509cc09f884821febae5fe0148fb0

SHA1
2d8329d2ff3e94e4fc9147dbd0f54891c5657787

SHA256
53ef86a989237d3fee466883b14b22b53165ebf54f2749a53efb99d4f4077008

SHA512
4a98f0f560848731ca59ee2f0fdfba88fdd76f1a9b307366c4f3c7446fa0e4434350f86ed2084f41c0845082ff9d4bde2f0c267889dee354a55dd5c79b97803f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
185B

MD5
c2b8458477f2254449d1ae7a12f8492a

SHA1
e624d2701ab58cdecb1384c6fabb07947ad60190

SHA256
5be29ad9bccdb55518dcb46edec1495cbd69c2ba539ffa4b9963077b3c8aed9c

SHA512
68d2ba6ba8e5fbfd7ee013530d6aae7fe1d82f2e77c6b40f92b0a10e3b80b4768449cf88d56b70a322aaef1f5cd0092badf143dc01ef392d989910fe5d03ff0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
247B

MD5
7472ef7b9a801c7c814a74a2563aeb5e

SHA1
f3b25a6953ea7d7747111b6ef53166e2ed484ada

SHA256
bee1e1447a71d1f18888bc6845eddc6c2ba11cb9eb2964f5e02d3ff36b12c279

SHA512
55d310a0dc5f9bdc636677c547e4c2bd41916e0569086b64d207ad8772904b49559b9a81fd6ad71c5226036c5261da290e7d9d452f2b8a2bf49747f208e14688

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
183B

MD5
6ef889187ca21c346a19289b43f93e7d

SHA1
717a84694bd6d809e8a1bbc1f8b4d2cf2200cc34

SHA256
cb7cf8cb50efed41e2d4afdbe66536441b6d674ae28af58664ea30814019eb83

SHA512
c4ac01ffc55a422980ec4578fb8c1c310faeda326772085ef0654d6c1aaf7479ac5c54d06c3c2380a82cb4c13aac13383b68b58800966ee8d209e15a7fe04492

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58ea7a.TMP

Filesize
119B

MD5
f90470b733625fec6a49e75e928db5ab

SHA1
e17ad5cb9d9aabf594e6077c2d55c158a0afaad7

SHA256
fc12f507690f1313b10aa5fb5c2f134bcbd50894a7ee9c1419abc620acb190e1

SHA512
e8116866b3bba837b402e51880b416f769e51bc02651ea9952d46d55710ddcc562aa30988b3e6b5e63ee5c867e2e86f40cfe4400a42b79d24621bc3606cf6649

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
9832f24920869cbe61349b0b99e2a28d

SHA1
8764459ef0ae116d6588cc60ab872a5bcfe223cf

SHA256
2de9799212882bd5026607d881b6b1b5a1628ac367cd7af01bdedd029d13e3f8

SHA512
77dc194b01779b20279869fe0e48e0da90be093f88fcd7daa7de1836ddf89a5d6589faac7062559fbfb38901e5a1094bda0b9d504e661bb54c429d66180761ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593c73.TMP

Filesize
48B

MD5
7f2b1898fa5b006d980e8e046b98c044

SHA1
b185e7b8893a7d036c7ac4ae50f6c9c78896b9d5

SHA256
be3d8619c3c5d91a8d009c36ee7149666cb3a8f89b181298afaa299b521fb43d

SHA512
7c375d8de427a5e628c88a11024c5cf83ce0d0f6ecc867c94f349dae8ac4ae40822141de3ee68529dd059a7ad1131d3b1ef9f7e1c6c524c745c3e006b3eb33d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome\16.png

Filesize
216B

MD5
a4fd4f5953721f7f3a5b4bfd58922efe

SHA1
f3abed41d764efbd26bacf84c42bd8098a14c5cb

SHA256
c659d57841bb33d63f7b1334200548f207340d95e8e2ae25aac7a798a08071a3

SHA512
7fcc1ca4d6d97335e76faa65b7cfb381fb722210041bdcd3b31b0f94e15dc226eec4639547af86ae71f311f52a956dc83294c2d23f345e63b5e45e25956b2691

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
74afe5171061fc372d5a6397e9ec399b

SHA1
da36029f5d05fef40c387ceb37ea3174e5639871

SHA256
8dc3bb858cd174bd0e4680ced437abc0bf55f29a17ca854e269a2a685c1e7063

SHA512
a1ab8b29c4a271d18ee971f0758b28260958daa6122637fbeba949863bad7893b21b9961743962809b8e7dd5c6a88e1326f19eba0caafa5b48b7f06def14136c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
b6b2b4a448366f4f2b426c94c4f10938

SHA1
951d4b5b27a54a0fde75a7a5da1043b429930c69

SHA256
134e22a86d6b5b9aa58b7049b0911625c1a67a7dc97f3f06613331f0fc6d544e

SHA512
8b770d76ce13e18d51c0260fcb801b73f2b17d2ea4e2740042cbf2a833067977eb4551f2b60dc44d4b2e15f83081365be15722fcb3ca31c896d8bdae697787ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
5556a5b3db4347ef6ce63601f8630b1b

SHA1
4cd2c21fdd2449f1bb3d3608140a5f10c34edf53

SHA256
1cbcdd2a98a2aed066901798c83d7992dc1bb891b93f153db2d77153c5880080

SHA512
79d3e2c38feccfb9afc61068a276fe14edcb664f5db9c2a513916cd300da0917c42545747d0643d57b3bbd73b9e9646a35ecf6ffd7e833e03f8fe88dedd6374c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
102KB

MD5
e1ae9be4ca18f75a0c1f1f0f86310f89

SHA1
9a5de218103f734e6bed96a35d62c24b5fdd23e3

SHA256
a56a2138fce9a40a713eb83a061396d2b060986c5b93950b6e3725a238c2573e

SHA512
fe0e5fb9a94007c62d27d4770e3eb156c12ad261113fbbe14a061c2ac5fdad4e3ddcc0286eaf288e19315aedbff4dda9bc4f985b1160e3ca351fa55fe13068d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
e64319b58a4ece89873f43faad9340dc

SHA1
b9960518871919f80eafec53fb3545f8326d23b3

SHA256
87b9d251162835a7d2667cd54830378f1f908f9ef7888dfae600bed1f8828b20

SHA512
0f7003565709bc4dbf07811e3d17ea29162028d4479e6c8b4c7909e2b9fbd88529fba993351eaaabb8b8d788aff163adfb03962b2217eb92282352664c7f3662

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
115KB

MD5
3b20d7a93576a61a7173465492898ea9

SHA1
2332bfdd5ec93261178b44c0bc85372abfeeab42

SHA256
5733cb2df23ad79a48b30bab3487e160bcd3681d7af5c92b2ec94015a6e6ab93

SHA512
c99e83057c2f126fca77186218f7a770df5438f1589fdea8f37bebe7201d0753dd1625f7a94626b59846567e52bcc395b3b168b7b5d2b072cafa6cfd358ce651

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5904c9.TMP

Filesize
100KB

MD5
2ce45f5d66dd5782adf7643cab8e41a2

SHA1
6e3864004cb9156d0e33c4c109b297003de6cb48

SHA256
94d331e48f80c849196c8bd3801ca7001fc53fe13521c79e354f02a64f134b2d

SHA512
9eb948c3d55bdc15ce95e31c1cf22ea2abea6abc65ead64d0d6adfd7fa332d56678b42b36c9daeff4f0f2868d3c3cf853ab9d7a096e7fa32f1cf8652fa3f877f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\X6YHHZZX\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log

Filesize
512KB

MD5
5ea66a05cbebf6ee0f3fd39dba7760a2

SHA1
e57a753ff1c65bd445d1f1fc23bad9b5cdcb2dd4

SHA256
0ea11ee03ef0f312d354536efd491e19c9a19e1cf88239465d18eac29e368f4d

SHA512
dba103df25d95fff2e8077ee8345518624d55411359bc709be01ef9be941de3cb0d31b23bd4d0640a3de927b8e808b59a1ee607cf4e1d812cb38bd3b4ebdae3c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFAB8A678FFC8FBF4C.TMP

Filesize
16KB

MD5
55695964bc01dee0ec1df517e3a1d891

SHA1
4c4013834b88f06a9f2d6f338f5d7ad68e9bc6d1

SHA256
d0a7dd9645f736119e42bcd03be05321e34728d8c0c1577e37f455c298e6ec79

SHA512
6427030c64cdbba41b4dd49a48dbc7cb099cff61626b491a1f802352194783c55d2f9f165a6e84b82b8f51cb296749b58cf706f68b93d083a20952dca9c9ca46

Download Submit
C:\Users\Admin\Desktop\licencu\application package\Settings.vbs

Filesize
311B

MD5
5b0bc179a07cdbe95ad6d65b9bfc9ac9

SHA1
681502f8ab169b4c9a88d3ccebe6fad16f59eb1e

SHA256
595b2c9b286f795ffe4324abf9d0cb58592455359e09144ae39d9dc38e793455

SHA512
adb7a06cc2a5a6a6689bb6723edf04ea2b8842e8f20965142a74eebc91cac87004639e9157f051873ce49066d316d371d7fac02b6ca5f1355bd51280ea7c4c25

Download Submit
C:\Users\Admin\Desktop\licencu\application package\data\data.dat

Filesize
34KB

MD5
482fea846f4b85e7b7c575db91d0936e

SHA1
2d678fecc205a839a948c5815137193cfc902008

SHA256
af56f40979021e8c91fda864382434d99f45d83800a623bf0d6c9cd205e37969

SHA512
578bd6b87b6849cd258b495ed064e38fc26c8f886446f40c52743df03cf0267a91780edfe0586541895d32cc9798245709abf8ec6b599b111b32f1ee08a18e1a

Download Submit
C:\Users\Admin\Desktop\licencu\application package\data\program.PNG

Filesize
18KB

MD5
e43f83995aa2eed038d815e473ffd40d

SHA1
eef70c930818ea7ff5a81ce36e64864032e790b7

SHA256
8fd2301e45e5bae7ecce9a9dcc916324638ac7c972f0bd568f8ae55e71cd3e6f

SHA512
1ec42fb060a77d4779ea6db66cc3cf58c5d16ab975b3669bdc48c57eb7946535dbd0553e02bd2264f5d4bb1f799a3098afa41371f291eca8f0ffd83e5d8e1387

Download Submit
C:\Users\Admin\Desktop\licencu\application package\lic.exe

Filesize
3.9MB

MD5
1e2d2f3f618279ed722045f6342793f6

SHA1
4b80a65885b4eb69fd6e240db592a8da8d7ad334

SHA256
400a80b5166f7ad96f834fecea54ba07244ef90a40a9878ecf843c3e140f304c

SHA512
dcec0fc10ba64fa47ea005fd9edc4b0396d613daba5723054e960766a3fa87b4dab06c522b200ab13dc135006f3f7adbb44c43c93fa9f0b2564c6d034dd41143

Download Submit
C:\Users\Admin\Desktop\licencu\application package\lic.exe

Filesize
3.9MB

MD5
1e2d2f3f618279ed722045f6342793f6

SHA1
4b80a65885b4eb69fd6e240db592a8da8d7ad334

SHA256
400a80b5166f7ad96f834fecea54ba07244ef90a40a9878ecf843c3e140f304c

SHA512
dcec0fc10ba64fa47ea005fd9edc4b0396d613daba5723054e960766a3fa87b4dab06c522b200ab13dc135006f3f7adbb44c43c93fa9f0b2564c6d034dd41143

Download Submit
C:\Users\Admin\Desktop\licencu\application package\package.exe

Filesize
22.1MB

MD5
de704eab92359c98fdf6d286d4b13804

SHA1
31ba3454d90e0979885f054a3c4d23afea8f2370

SHA256
7c8e051e90fa67e6e19cd1dd725c8b182b00ec8bd5752bc145ad5dcd98ad625e

SHA512
920412f57af802cc8bb748c42305d269522fc3b0a40c9ce6df7d16532ca698e6fe74491e1aacd91bc5fbeb9efd29bda72d53c83abeb999826d04b200e740fcd7

Download Submit
C:\Users\Admin\Desktop\package pswr 2023.rar

Filesize
28.2MB

MD5
b15481522c3c9c81872a40d9f6d2a269

SHA1
34cc312859220e5f1e362a4293c7cdab26b7a695

SHA256
c86e7707c377202ce1d7c362a87df5a394b6ed166bd5198cde76d86b0bf809d6

SHA512
43443b3798921de20a5dc0deae09009c4956746d553c0f86272be3b7eeaf2e26449502b2bcf459b7ff2fcf57a224ed8c4d9788ea39774e4428796c4ad0f7c767

Download Submit
memory/788-127-0x000001FE7BDA0000-0x000001FE7BDA2000-memory.dmp

Filesize
8KB

Download
memory/788-129-0x000001FE7BDD0000-0x000001FE7BDD2000-memory.dmp

Filesize
8KB

Download
memory/788-124-0x000001FE7BD60000-0x000001FE7BD62000-memory.dmp

Filesize
8KB

Download
memory/788-120-0x000001FE7BD40000-0x000001FE7BD42000-memory.dmp

Filesize
8KB

Download
memory/788-115-0x000001FE7BD10000-0x000001FE7BD12000-memory.dmp

Filesize
8KB

Download
memory/788-110-0x000001FE7BCF0000-0x000001FE7BCF2000-memory.dmp

Filesize
8KB

Download
memory/788-105-0x000001FE7BCD0000-0x000001FE7BCD2000-memory.dmp

Filesize
8KB

Download
memory/788-98-0x000001FE7BC30000-0x000001FE7BC32000-memory.dmp

Filesize
8KB

Download
memory/788-94-0x000001FE7BC20000-0x000001FE7BC22000-memory.dmp

Filesize
8KB

Download
memory/788-91-0x000001FE7BBE0000-0x000001FE7BBE2000-memory.dmp

Filesize
8KB

Download
memory/788-163-0x000001FE7B100000-0x000001FE7B200000-memory.dmp

Filesize
1024KB

Download
memory/788-76-0x000001FE7C160000-0x000001FE7C180000-memory.dmp

Filesize
128KB

Download
memory/788-168-0x000001FE7B100000-0x000001FE7B200000-memory.dmp

Filesize
1024KB

Download
memory/792-1506-0x0000000009380000-0x00000000093E6000-memory.dmp

Filesize
408KB

Download
memory/792-1501-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/792-1604-0x0000000071B50000-0x000000007223E000-memory.dmp

Filesize
6.9MB

Download
memory/792-1552-0x000000000A100000-0x000000000A192000-memory.dmp

Filesize
584KB

Download
memory/792-1507-0x0000000009DF0000-0x0000000009EFE000-memory.dmp

Filesize
1.1MB

Download
memory/792-1505-0x0000000071B50000-0x000000007223E000-memory.dmp

Filesize
6.9MB

Download
memory/1920-1554-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/2428-0-0x0000023143320000-0x0000023143330000-memory.dmp

Filesize
64KB

Download
memory/2428-266-0x0000023143700000-0x0000023143702000-memory.dmp

Filesize
8KB

Download
memory/2428-269-0x00000231434E0000-0x00000231434E1000-memory.dmp

Filesize
4KB

Download
memory/2428-273-0x0000023143E30000-0x0000023143E31000-memory.dmp

Filesize
4KB

Download
memory/2428-16-0x0000023143B40000-0x0000023143B50000-memory.dmp

Filesize
64KB

Download
memory/2428-182-0x000002314A8E0000-0x000002314A8E1000-memory.dmp

Filesize
4KB

Download
memory/2428-180-0x000002314A8D0000-0x000002314A8D1000-memory.dmp

Filesize
4KB

Download
memory/2428-35-0x0000023143ED0000-0x0000023143ED2000-memory.dmp

Filesize
8KB

Download
memory/3688-1621-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3688-1615-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3688-1610-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-1560-0x000001DF28EF0000-0x000001DF28F10000-memory.dmp

Filesize
128KB

Download
memory/3784-1565-0x000001DF291A0000-0x000001DF291C0000-memory.dmp

Filesize
128KB

Download
memory/5252-1473-0x0000000003890000-0x0000000003891000-memory.dmp

Filesize
4KB

Download
memory/5252-1605-0x0000000000400000-0x0000000001A26000-memory.dmp

Filesize
22.1MB

Download
memory/5252-1547-0x0000000000400000-0x0000000001A26000-memory.dmp

Filesize
22.1MB

Download
memory/5252-1495-0x0000000003890000-0x0000000003891000-memory.dmp

Filesize
4KB

Download
memory/5252-1494-0x0000000000400000-0x0000000001A26000-memory.dmp

Filesize
22.1MB

Download
memory/5388-1461-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/5388-1586-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/5388-1460-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/5388-1440-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download