Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    107s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2023, 22:00

General

  • Target

    676d1dc88c05a048e7e61e7d43cf886861fd0d827211339cea1229aceb9b47b5.exe

  • Size

    1.2MB

  • MD5

    285d96be76959824ef3e04822dd982e0

  • SHA1

    bb61fbc2185465c40d152877fb491e1ca7439046

  • SHA256

    676d1dc88c05a048e7e61e7d43cf886861fd0d827211339cea1229aceb9b47b5

  • SHA512

    40a9c588ebd9929e3ab9c04a14e66f4e657ed172497c7075c3c229ba5d889e9b9a0d77a1c638a68f38c57b4c7ad4ecb588b612a37380aa46516436e60e9ac602

  • SSDEEP

    24576:IyNB2F4ed4wNbFuQw/aXWe1MzKrrfAyXa/MWz8I8yQDI1gR7iL:PNBQ4eRNbF6/4We1MzKrz0M1IW

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

C2

77.105.132.87:6731

Extracted

Family

eternity

Wallets

47vk9PbPuHnEnazCn4tLpwPCWRLSMhpX9PD8WqpjchhTXisimD6j8EvRFDbPQHKUmHVq3vAM3DLytXLg8CqcdRXRFdPe92Q

Attributes
  • payload_urls

    https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 4 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 53 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\676d1dc88c05a048e7e61e7d43cf886861fd0d827211339cea1229aceb9b47b5.exe
    "C:\Users\Admin\AppData\Local\Temp\676d1dc88c05a048e7e61e7d43cf886861fd0d827211339cea1229aceb9b47b5.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Co3wz10.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Co3wz10.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1sH95AG1.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1sH95AG1.exe
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Adds Run key to start application
        • Drops file in System32 directory
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:1168
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:4028
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:2788
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1812
          4⤵
          • Program crash
          PID:2580
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ez543ij.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ez543ij.exe
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:3384
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Yf7Rw8.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Yf7Rw8.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3248
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7fff198346f8,0x7fff19834708,0x7fff19834718
          4⤵
            PID:4544
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,4145223780979837494,16918310531096099558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
            4⤵
              PID:5232
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,4145223780979837494,16918310531096099558,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
              4⤵
                PID:4504
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2284
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff198346f8,0x7fff19834708,0x7fff19834718
                4⤵
                  PID:3352
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4739978311595923877,1939737227500032777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                  4⤵
                    PID:6592
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4739978311595923877,1939737227500032777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
                    4⤵
                      PID:6584
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4948
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff198346f8,0x7fff19834708,0x7fff19834718
                      4⤵
                        PID:1568
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,2668452963041852569,11773699694061954942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
                        4⤵
                          PID:5920
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2668452963041852569,11773699694061954942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
                          4⤵
                            PID:5908
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2788
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff198346f8,0x7fff19834708,0x7fff19834718
                            4⤵
                              PID:3376
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,18393057438108316204,1839808287229930225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
                              4⤵
                                PID:6816
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,18393057438108316204,1839808287229930225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
                                4⤵
                                  PID:6792
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1168
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x174,0x178,0x17c,0x150,0x180,0x7fff198346f8,0x7fff19834708,0x7fff19834718
                                  4⤵
                                    PID:1556
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,15782563113279315551,12508878141948017084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
                                    4⤵
                                      PID:5816
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,15782563113279315551,12508878141948017084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
                                      4⤵
                                        PID:5828
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                      3⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3396
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff198346f8,0x7fff19834708,0x7fff19834718
                                        4⤵
                                          PID:4316
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,6842882894232181029,13994320291931207792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
                                          4⤵
                                            PID:3060
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,6842882894232181029,13994320291931207792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
                                            4⤵
                                              PID:5524
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                            3⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4312
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff198346f8,0x7fff19834708,0x7fff19834718
                                              4⤵
                                                PID:3796
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,1046691089217783452,7524208721445976184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
                                                4⤵
                                                  PID:2088
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1046691089217783452,7524208721445976184,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
                                                  4⤵
                                                    PID:4424
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                  3⤵
                                                  • Enumerates system info in registry
                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4840
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff198346f8,0x7fff19834708,0x7fff19834718
                                                    4⤵
                                                      PID:2676
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
                                                      4⤵
                                                        PID:5552
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 /prefetch:3
                                                        4⤵
                                                          PID:5556
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2600 /prefetch:2
                                                          4⤵
                                                            PID:5532
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                                                            4⤵
                                                              PID:6292
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
                                                              4⤵
                                                                PID:6284
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
                                                                4⤵
                                                                  PID:7248
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
                                                                  4⤵
                                                                    PID:7600
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
                                                                    4⤵
                                                                      PID:7992
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
                                                                      4⤵
                                                                        PID:8148
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
                                                                        4⤵
                                                                          PID:2236
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
                                                                          4⤵
                                                                            PID:8020
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:1
                                                                            4⤵
                                                                              PID:8228
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                                                                              4⤵
                                                                                PID:8288
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
                                                                                4⤵
                                                                                  PID:8388
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
                                                                                  4⤵
                                                                                    PID:8608
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1
                                                                                    4⤵
                                                                                      PID:9008
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
                                                                                      4⤵
                                                                                        PID:6316
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7444 /prefetch:8
                                                                                        4⤵
                                                                                          PID:9176
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7444 /prefetch:8
                                                                                          4⤵
                                                                                            PID:9136
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
                                                                                            4⤵
                                                                                              PID:7296
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
                                                                                              4⤵
                                                                                                PID:7068
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
                                                                                                4⤵
                                                                                                  PID:7904
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7644 /prefetch:1
                                                                                                  4⤵
                                                                                                    PID:7924
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
                                                                                                    4⤵
                                                                                                      PID:7116
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7164 /prefetch:8
                                                                                                      4⤵
                                                                                                        PID:2052
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,7100966136515662229,214348590895654102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8248 /prefetch:1
                                                                                                        4⤵
                                                                                                          PID:7504
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                                        3⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2572
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff198346f8,0x7fff19834708,0x7fff19834718
                                                                                                          4⤵
                                                                                                            PID:4944
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,11754181687336579694,18217922460640017383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
                                                                                                            4⤵
                                                                                                              PID:7232
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                                                            3⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4008
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff198346f8,0x7fff19834708,0x7fff19834718
                                                                                                              4⤵
                                                                                                                PID:1680
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,18165313608323834196,11112296160573817763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
                                                                                                                4⤵
                                                                                                                  PID:7800
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,18165313608323834196,11112296160573817763,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
                                                                                                                  4⤵
                                                                                                                    PID:7788
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                              1⤵
                                                                                                                PID:2616
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                1⤵
                                                                                                                  PID:3960
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1168 -ip 1168
                                                                                                                  1⤵
                                                                                                                    PID:2036
                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                    1⤵
                                                                                                                      PID:6984
                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                      1⤵
                                                                                                                        PID:8160
                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                        1⤵
                                                                                                                          PID:7864
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2E9D.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2E9D.exe
                                                                                                                          1⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:7460
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                            2⤵
                                                                                                                            • Enumerates system info in registry
                                                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                            PID:6444
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff198346f8,0x7fff19834708,0x7fff19834718
                                                                                                                              3⤵
                                                                                                                                PID:5900
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
                                                                                                                                3⤵
                                                                                                                                  PID:9180
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                                                                                                                                  3⤵
                                                                                                                                    PID:4664
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
                                                                                                                                    3⤵
                                                                                                                                      PID:4972
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
                                                                                                                                      3⤵
                                                                                                                                        PID:8948
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                                                                                                                                        3⤵
                                                                                                                                          PID:4356
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1
                                                                                                                                          3⤵
                                                                                                                                            PID:6548
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
                                                                                                                                            3⤵
                                                                                                                                              PID:6632
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
                                                                                                                                              3⤵
                                                                                                                                                PID:7296
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
                                                                                                                                                3⤵
                                                                                                                                                  PID:4336
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
                                                                                                                                                  3⤵
                                                                                                                                                    PID:6872
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5708
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5238029214285763430,769336256400977313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
                                                                                                                                                      3⤵
                                                                                                                                                        PID:8880
                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                    1⤵
                                                                                                                                                      PID:7860
                                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                      1⤵
                                                                                                                                                        PID:5852
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3262.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3262.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:5276
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3644
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                                                                              3⤵
                                                                                                                                                                PID:9148
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5324
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:7920
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:6376
                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      powershell -nologo -noprofile
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:8172
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3528
                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell -nologo -noprofile
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:2564
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:5636
                                                                                                                                                                                • C:\Windows\system32\netsh.exe
                                                                                                                                                                                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                  PID:7192
                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell -nologo -noprofile
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:8460
                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  powershell -nologo -noprofile
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:8480
                                                                                                                                                                                  • C:\Windows\rss\csrss.exe
                                                                                                                                                                                    C:\Windows\rss\csrss.exe
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:6924
                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        powershell -nologo -noprofile
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:3268
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tuc3.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:6360
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-S2L5S.tmp\tuc3.tmp
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-S2L5S.tmp\tuc3.tmp" /SL5="$3029A,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:7200
                                                                                                                                                                                          • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                                                                            "C:\Program Files (x86)\xrecode3\xrecode3.exe" -i
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:8480
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              "C:\Windows\system32\schtasks.exe" /Query
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:8468
                                                                                                                                                                                              • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                                                                                "C:\Program Files (x86)\xrecode3\xrecode3.exe" -s
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:8796
                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                  "C:\Windows\system32\net.exe" helpmsg 1
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:7028
                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                      C:\Windows\system32\net1 helpmsg 1
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:6108
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:7176
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\359F.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\359F.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4568
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5368
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:7524
                                                                                                                                                                                                              • C:\Windows\SysWOW64\chcp.com
                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:9164
                                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                  ping 127.0.0.1
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                  PID:6272
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                  PID:1844
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:5676
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\389D.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\389D.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:7536
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:5056
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:8432
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:7800
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:924
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:3420
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:6032
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6608
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:8492
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:7252
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:7432
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3660
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:5252
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13972248130852941996,17858521237106433612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5308
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff198346f8,0x7fff19834708,0x7fff19834718
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:1972
                                                                                                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:4420
                                                                                                                                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:4152
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9BEC.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\9BEC.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:9164
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\AD91.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\AD91.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:8196

                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d91bbdd-73ba-46b0-b339-35d454cee0c0.tmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    22242267cc6509f9eb806eba3f26dc80

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    dc21c9cd71ccacf428bf9c4eb35876902c6b8a31

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    91535d0f0def0435c02ea18ce1b0951744496b6251d4cbc8ee5e0ea057201b3f

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    4cd19f1a1a670de39ddaabbb5dfda68de5d0aacbb3fae71645c9ad604253c947afadb12f4cb440f31af188cb62c5168555ce30d07701d787f1885aeedaa11f90

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6ab49820-002d-4ad1-8cce-d5d2780d3cf2.tmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    10KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    807cfe46f67705a57054e5617a9ff920

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    788ffabe63a43ec662489a9cf806692a688a81ca

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    9b2d9ae0342573d2271d1704c827215b3a9e7582a19486b6d67df402952df147

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    01de8a55116917f9bc3934f4c9019ff3a296801ffc71d75d8e8e4a938293b3deb32a226f8fc910d70c7b8d1bee58c0d365e9d056ad1aac00dbd8d7edb386ff03

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    152B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    16f2e3b53bcbb102e66ce976ddf51d21

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    2d08df66868e7a63324fc49d8badcce608bd68e3

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    735cfaa43a4815a1aef46276a32d628ce5b1b7a4f57b316e7d51abc762b92653

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    bb567f8fa37c0b0a1447e247aef839c681a24e0861fcb2fc9ece89978cd6443cf2cd6d73b288b1cdd5ccd1851d3f10e2fcde896da8571e99102b1a9a14c9d524

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    152B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    ef2ab50a3d368243b8203ac219278a5d

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    2d154d63c4371354ff607656a4d94bc3734658a9

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    2e2faf2873e0b8d58788da8603acdd772642a396fff661c4e32f8a581362cbdf

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    4533997bf4070f99306337b8ff553691d4cf1d1b53401628524ad4dc9d29bd0536a3f2df4ecdd0a8afa81b7f917f40524c9a1898b566ee499a358abc5c84b27a

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    152B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    c4e07376cba920d8340d293f1a8b592b

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    f1e2de6a461355b57879cd8fdcfec3df22cc5958

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    59567aec4a624af50bbddab7d6514a0c3e02ba11e97939ed3b6b9710657f9058

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    7a3a0981e6636f1d80577c0479d18be7ab66409318d91bcf230f0fb24447e7d1efa9c6c59f06b488677ed55d2261d734ec7fd93e52d351d4a1f8a8a0eb617198

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    152B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    a90ad51e6f7def3a8c2d411cf919450b

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    f94e19d51139f0b47c224979dc22c1cae6269d2e

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    9e4596789e186224fdd5580d6c7d588483a9141e1206a1a9fc9e81574a09d6f8

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    afec0aaa6cf27f3656c7bbd66c1fb969bc2d3c7a8358d3e86fc17d4c6acdc0b2909d75f1ea1740bf81994c73fa95b23c67b2572080de19a85bd4ac7b2693551a

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    152B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    f05d7c7f3dddae11bd077c4c54bf4aa4

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    cd6528e9a6f599de9f5d21380d86b10ea06d80a0

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    9c468916160cd42edebc90547886daa59296e064bc5d43c5c03ff8429755bf7e

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    34ff96d4d5c99c0aed569dd65def1a1ce66cbc042e5140ac82f39dd39f2354cd70e565c00080337b907900ae788e4e21b22db7f6439087dee314bebc6c3fb258

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73be0d63-0f90-4376-bfab-39489681cc71.tmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    20KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    923a543cc619ea568f91b723d9fb1ef0

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    6f4ade25559645c741d7327c6e16521e43d7e1f9

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    21KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    7d75a9eb3b38b5dd04b8a7ce4f1b87cc

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    68f598c84936c9720c5ffd6685294f5c94000dff

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    33KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    909324d9c20060e3e73a7b5ff1f19dd8

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    feea7790740db1e87419c8f5920859ea0234b76b

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    dfc749d2afefe484d9aa9f8f06d461ad104a0ca9b75b46abfaaddda64a5e9278

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    b64d2dce1f9a185fbb8a32adc1ff402d8045d379600bf3f9154bbde18303610f18af9fce258442db1e621ecf10b77aafe99cffedfcbe2a1490056c50cc42d0f9

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    190KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    d55250dc737ef207ba326220fff903d1

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    cbdc4af13a2ca8219d5c0b13d2c091a4234347c6

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    d3e913618a52fe57ab4320e62a5ace58a699d6bce8187164e198abe3279726fd

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    13adff61e2cfa25dc535eba9d63209b7e7e9bd29fc4d6c868b057df7f680aa66ef5783a0e82a8367185debf7f6fe5bae89adc0770daff5317d2e16db5ad3ab39

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    200KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    b3ba9decc3bb52ed5cca8158e05928a9

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    19d045a3fbccbf788a29a4dba443d9ccf5a12fb0

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    111B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    285252a2f6327d41eab203dc2f402c67

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    0b26671cef39328b620060e25e5be7c8

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    2eaef40f81f07431cf8d683ef038c3e53e4e4676

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    2827eee858eefe2ba4985c2eb2d5bd359130296da878bdb7b7651791ed4188d7

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    99f79b83e0115f0966092b191d1c2df932a318f369fec0a74e7cf4d8acb7a093199a602c9fc25e5720cf5ea7dadc93cc4ba322913d74a3bba4016570474d954d

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    33f2924054b2b388cbbb95e2f63ff6f1

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    cceb0e2f914a523164aaa41acac3aafa0f7f1438

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    51a745986daa07b531d13d610e5bd8e2a9a678a1d0f942af36970bc26eba2382

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    78b2d1b58c5de9d6b32c2bacc2ab92ba6d55a413861bca2fcd4bb570e1c5ca8a24bc6f75954dd421a760013d31e615ddb35f7f23f7f1c62b251850e9fcef24cb

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    5KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    87ea1702f7de8338f05eebc742df8baf

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    f496bf223fc7bc2ae9aff57afa2badfa25ef024f

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    75bb6a0dc7fb0ebf162d6280e4863150f8d8cd11cfe298f837b101e49f0447e5

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    550658ac0ac14047dc29af33ad8cdf62c47548431c4009877d8784b313771cc880bde158778befa4e8d93ca71d8d49b8265aa4cffa11932a8dda210fe82e9f3d

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    560e296d27800a57d694d9b4b272befd

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    fb1fe3c56137968197c8cc00c327df5ad32c916c

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    5503e4567b6690e0a3ee4c2beb0516e40396dd48a0eb7efc2b7122602d9551d6

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    776f50eda441c03285bd30da6c4a27967c5568265e53c34bfc9567b50c715c73712c581d190fb284011e02edfdf3665e47ae8d77de9c09c1fc638e0631164d70

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    c67480984bd7aafb8ed63d71a87a54c6

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    070247e083186cf40acb10adb782828be15adefd

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    1eba7efdbd1b0a6ccad92209bab0e05799b954f12616dd6bd31e589468f72c03

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    ae5c04c4a988b45e9461b0d9e0fba39ded2ca2c3063e0091cf7a2ad6242e1cd54e72ed93d9221ff20864951e77d87244c7a992cdf01401d85653dc0389e82b9d

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    832e96f17e69cbf6985912737889f4e5

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    e09cb81a44569f40daf9de444608f674fdcc6f0f

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    7a6a74785021b66063955d2ca2fbc7cbf1ac0a5a53bcf94f2b56a428bea3c13b

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    a34147ed7818f4ba0897a3ffc65b0690b990b42e93b403c4bc89b0503fc32f82e6a2f632558678700836bc9497fe7f297277b1e5e2eb9a8bd708b2f6f6ed4030

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    a09a18bdc6418c33cb0180bd50bb50e8

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    0ca39ab7aea34d23ca91f5c7c8bed8591210a5a1

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    b7934ce254576076e95bbb2fb19686669b93067e8479dd3cb1dcc359d0afa1f4

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    0d92a00bbfbdc608f7fd986e753e99fe557c20257eae1b0b8b136cbb11cb88b04e8e8a34f3af1c15111efebb65f0e6dd18c36fb8f93e99b85a7d0d3636e959b6

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    c5d0bd61a67a4eac06ed038c9439b70f

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    159d13bae1858d9bb6f46712305ee05f6d3825d5

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    266b2f5c9d5e8a4527dcc622ae6463bb81295b4bd90c80bdc8f823708a8992a4

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    de681bbe05c1e00948daa1a0e33ec4981f6d4c9314cea5c38cae5214f1ed7199ca45740558f143558a2ba98c4eff1079f1dcd67268e2b4671c12b99a06247827

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    24KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    bf38e67347aea6d520cda5fde321a1e5

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    0e7a8def4c923201d76b41dfa9918bb1052827ea

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    0f0744f36e30e64949c41835aa5666f25c1ab4f3636d9247b8350fd8ad4f8025

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    f62478dd4e38c6bef2bfc24f46caa03840613711e2b6fda2aad707df5cbd33b25af4fc3954521e203b981c4a10e5c8fd2520cabc16cdad858eed819b45a6f366

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    89B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    85df224500cf9bf462725095299c26c4

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    9cc71497f77b2808b339da1116d080f5bbcefb1c

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    aadc6e8943d0a8474cc1c9f92bc044aeb4522ae89c5f7352aa207a88ec8faead

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    dabe2ec9b9f3ab9620bc4628375a3459c1ad50de1da08f48a69a66e592dfc4831568bd6d7adca58ae27ace4c417667d974f675df210acdf384bc48e9cc6c27f3

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    146B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    ea98f2c491f0517a52492c4bf8a3f236

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    5410b148a1e8cc9c1f372f9ce342dffb964f71d5

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    8156fd54f1db31d6d9f4c99e016d8f00e161b199d209f910bd296171d6cbe48f

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    ab5db33e1da940aa9ed0e42710c529f5e07f1e0a89404d6f500db0055ea6e4c1b3b4b8bd52da4d8e12a20f7c6f82e24df7fd3bf7fcc99575e039bc2baec7569e

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    82B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    c21c06a083d45072b3f49d6d6bc81520

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    2f53f54553416d5096fa615930f8b572c50ab082

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    a649bdcf42705e9890067c79f72b84d226af5472b70e57c02e232a9d289ee2d2

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    7c96dd4db89444363d895cc3003a6c4139a8bc7263803a2a123a72fba4c72b7cc8a4f3843c10fc5154fbcfc2b2c8b164a80e2841d1bdc91db99fcbb063308efb

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    83B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    0ac1182d5f446719eb8e7aab97246985

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    78055798550911fe46a9f65ba9aa0ec1b290b17e

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    6e94f378d8eac5a6116e2c3f3e554e9da80a9cb93ada2c68dd2fddd077ae93b2

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    f7465f9cb8cc853efb5c277cc8e8fd846b8c44181eac1b14997ec8636ae71ce6b8c7d808d5ef47b62053693bb30a1f31b698ccf7fe55864b27fc55e2f208a3ac

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    16B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    0fcbd36c2429da16be9973836fb2bd1f

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    870d2c4557939f0e66c48e545c7e4a0823cc0793

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    57aa462a214ce8b6f2e11d84e88de77288a5c4f60b0c440c88f979d138474ef5

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    b3249d31956eff31d735a042db3417f5f88ba1584908cd28a6b19d45a63e8fd782c448e0161c21d7fcef130bb564ffd130383975b0586e80a3cdcf106f19132b

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    8a2701ad974252846bf37c174af0b38a

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    302a587ccb7d7165b2c3137c5749326e51fc4aa6

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    69227de5f383bacdf253fbfda354ffcd100e8c06550720afd8b061a3c5c00b1a

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    0e4154d4f0e6d23ff209f51088d36826f47702da4f368f76e993ff7a401e087040a186a41c8af48c8a38e7eb4bfe261bba03047b8a496e8fc1cbe4b1e2a08e1b

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    4e5a2d9d251b0760d03959a5631000ca

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    ed6559ee46628711cffc1a07646007442e0aa5aa

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    2ebdd47d107c4a8bc588f64d0303f242f402abe22b82172d277e37f312a9dce1

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    d049774650ddab6f8d9c6574c84a4b8e3dd914ba0836b3b3216740244ba68e1f3d7efa8c78ebcb4da725008eb498791c8fbce7166855e06790b4f25c0f99bc74

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    e60076e2d031925da43dd45ac5141894

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    761f183dc9a30eed5e336c45eeab58299159f3a7

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    1d166e31de2e0d8698df69beb840fe9dd4d946c34f904fdbce38e445f458f535

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    eb9604295a6ac3eb15b7880077cd4840f39fd15cac5514f8f345babe46108ef01a23c659ec7512f8d15e4ed41ca353509b96c7dba9bf31e722adbda44072120b

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583e0e.TMP

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    18078bae4d102ddbeb51428e8b8828df

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    ba49ad07d6622db2052fdda9ee1b67d87394c71b

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    937eb4d04522830f99a3aefe1bde6c2b444e47a9345ade32b671b564333b9924

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    079d54df57c12985f293b69ae0c2cba86697fbfacc90a7b05d543d8be911614a954908f2bc998b5956e936d7e586de3929fc7bdc20863a731f90e4615317a8fd

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    16B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    16B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    aefd77f47fb84fae5ea194496b44c67a

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    16B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    589c49f8a8e18ec6998a7a30b4958ebc

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    1d7b5f07b080ffcebd84071f0da644e0

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    58fdae1048dfb8d3b493215d0c7707217c3d0826

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    c6f3f6326ecfb8f410b9cdc8ef1fd7a591b259702e19441c967327d5079ac961

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    b6bc130c84d1a5121efb33dd34774eef0aef18cba57a060439bf5c0eff2fd545e78ed62d828b8b8ab5240608069fce849261a3f28d287169a53283c21da4fc50

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    671066b324b0660f321436f92d42b352

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    f4de65536ce0705689209329f3f6063c1e639771

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    f3e65a67d8079e7e5d5f53b65c40f0d429a65b56c10caa7dade54004e8f234af

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    35a0f42fb098bbe3fd8c9100adee16e13d8eb143ebb6c99bf8dc30186918b2a1751883353e68e9667e591fc58a1780249d1dd896af783869253d62bc1e1ad6ee

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    7c8c9b210ad043d947072a66b519bbaa

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    610db2e521f5c7e7ef528dcdf216eb883ec8ebfa

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    0f6cf9facada15e43867d4e27529a5f24bc22ead83fd30884cd402e5c621852b

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    917bb0d1e4272b06d45848374a8f1ec0161c714e93e7fd4429acb984a721341b9e3207a6fc82c855832b7b90e202b780c74834d0647c5e1fd3711e2db508d624

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    fc22ded4140f91ca2cc84a67288b8f74

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    1a7f9d29f204352718d855a233f9c2a831922a44

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    9d746eda7af577a6c70fac22e34243be24455fa6c330e8b689e188c96759edba

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    fc1ae3861f24b69179050116a0828785c07f5ab04633f3551be98e7cf9abd4d5bba031a1e5c0d24fc5486c73fb8659f3ae009844fc6c0a11fcec425e3c9a142a

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    33fd4406ab8ceb0e9c4c8d3c00586afa

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    3060da092deecaf0f74321ff6438cc83a40ef10d

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    9cf607eae31f6ccefb7fa91866defa71f1d47f5b7bdaf2a95c03d8ceeeb7d8e0

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    b01708c5c248a6d342ab2e78bdffc23b6a7260ecf19ab88260b8671b91dc4f61d5225ee5cb41d6e8d5cc67a4a12f180676626444f5c2c1c71d56a5fea95aaf73

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    9ecaf5096ef5451d79aae871c26c0a5b

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    5d990d2121bc2da718292e26ff80133939726b49

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    2fc50ab66e566fd98d400a072f95032cbd0192bcf3187ae215d22cf92b19e5c6

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    6c52e3c383a9db9dbc6a16c769103a9fb9cdec9d62a5878738098702f038b35a44489838eed205de9983deec42d4661b76520e7b6a5f24a7a1aefeff04701b5d

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    dc9d033b9fe2865acc24ae9e52b767ce

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    8943c281db6df0f798b6dd0cc350ea79d98c94bd

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    3ae106c3e92d233d8018212cfed50780b6140a29bd77eaf2f37ab6c662152465

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    5dde7ca2ce3fd33f9f14de23624f474ad1f3a36adb2a85b1f5ae5a0bdba553a32796455652c7537889374677144c22442bdb31baa3dc855841b74d92710101c4

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    2101102a98f2d2714621ab4631b36a7c

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    3c34989457f7067d55345fd5fcd53be96a6c16c7

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    de53c605c70b1ec886c85123a759fef5440333a4efffee2b71d9e63cc97a446b

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    d8caebfcaf55ebd490ff844895bf565c5b412cf6d9acb9f095a840b633952cc84bbefc6cc07b1c6b100a42116495c1be86eccd5f709883cc37f124819d6d08f5

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    617a555768046c86a0d92bd37c3af6c2

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    e663e58577af89cc50c2f2b2d2cdcb2fb2c9beed

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    7705ae9598f63531bdd041ee103bd3b30ae5fa14b905bab7bafef27628934ead

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    07ae426f1c6015cb7f91aae526634a5d4a48e194f8ad6a21b169fb538bf238ac4fd62785d67a2666ca6d94bfd28027c9631f21eedd6e56924047601696e2f604

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    1ca54ddbc0cc570e6b6663a714f775e4

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    cbb2c8c14a7bb9efb0d4fe2a1d7cd005227c8a57

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    3b62aef89fd1abba399677bf014ef198be0842b5e0f92efde9b7773dc444441b

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    057c97a13260b0eeb54411d77f32a8d62324d0c541218e0da4ee0f7a32fda20cc8efc2926df0ed1bd24ed57e3bd0bfdc84189f3bd1f4ecf2f061a145cb0da249

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Yf7Rw8.exe

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    898KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    cce0e2d6e5c3c1838927eb68d510f7b4

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    73d2398ce8acc979080da0d190ef1f941b27b9a7

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    c07a0068c3c8c24a1e9f3f8ccba23d70c9098d89299120d3db356e4bc3f33116

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    ddd8fcf0722df1ec9b12bbcecda52fec5a8e9ddd8ca1257e1c1b57931c5b92902e395852a081a44ae41180a2cb27672f08a8e0ad34bf46fcd64b7dd63692476e

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Co3wz10.exe

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    789KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    cb54e3843c47a37e4d62c5d5880a573a

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    471d32f6169c0ea124353245e81e29381fcd529b

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    20b07ed5e270950de86090d5de47e190a21b9e98092ea256bcdc0cdd361f4abb

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    f0e2b00898fb5181d04560a8aeed7d7b573a2beba2f3c7b6452b615d27aa526fc61c22cddabdb73174acd660795bceaf50dbdda7f7168b16b5f715fc8684e625

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1sH95AG1.exe

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    792KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    13a727491a596a71a4fb2c634764dd8e

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    0f82abaf43604ed59905e1b72c6f3dd0a27cb193

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    83c9b1b7358b2910aef7c6ed6d51ea8cc1734854106d8aff6e71835db1722d3c

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    b13b28778566e254abd413b2ab1988b28db1aff9a2b01a3f0625aa1115ffb768d0f176db42fa841111e2753bdd9e63d63cd8322ce62d491ff3e7faeda61c5fd8

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1sH95AG1.exe

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    597KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    a538b36847c581185cb045988f532829

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    f9835b110a9cc83909db00521563a23c59c8e69d

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    2c2030d9e6b0ed3db1764703a0a6bdcfae72614ddaacee4755248c18044003e6

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    e312780e3f9bd218375c69216977b1ceb3c96ca8178e87fa303d6920096087cbf12b614f36250ef719b65b1001ca0dbed0bc1a06fc9335354569e3d83e89074f

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ez543ij.exe

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    37KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    735b44ff60212c55c27c78c4136580ac

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    5efbbd50edb4b155f9e07a677e2f9a3dc9c5bbec

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    b81795f434d5c5b17088ee6f91d0698d50b66235289460f314cff30c38efac89

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    f3940f0d568231d728f0d5b52acf672df06fce67db39f5e6484e443cd00dbb5ca8e930979020ceae4dcaf49c1f711fe1d6d0040aa1945359267e6a37650b5e9b

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    2.3MB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    77471d919a5e2151fb49f37c315af514

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    0687047ed80aa348bdc1657731f21181995b654c

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    52666594a3e8bd7ac277411e215e1f65a7771f7c1d5b00a9e6ec95fade64f1f1

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    6ffb45e79b03bac2820c98503793cd11c13803f49522eea9334c4c6cd05384dda3a60b0a8a8f363abc439ad444f1a8da290f0350fa69b75b6c3c9701177f8844

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4c2vc5a.sly.ps1

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    60B

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\grandUIASJa1ZgsgK2Dj9\information.txt

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    a70c4a0fedeab331d737d34137fb5576

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    56e809f64fe7272d30ff422ccafb0d172d02f5b0

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    42c994386d9a0cb7a8428ba24ce4a8d3cb330f8e0f5677aa0cdcca42436f2908

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    088264bff0be46b1f87bcdf366745f3d2a8bcc769aa9ca9a09220f1c7d89290932b638a92201be59fd63d2972c65d78e0da3fd09e0a438e2ed6b869285d0e8bf

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    520KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    117bfb548382e0af1e104cd7149a9a05

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    cd7ce3318994aa62b8e7c860fb64ec8ec61f05b1

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    27b00b4f5bc57e5973c4159539c2c1a4e5f6e5e1b2a60f2ff269126ce70956d0

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    cfee6352f898be465a2a7db833e0483141a03853896de5b2899533c156a64077a3b758a6097cb60794502e108e635c814245a7c3d0aca70ad1fd1a62e0a088e1

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    291KB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    cde750f39f58f1ec80ef41ce2f4f1db9

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    942ea40349b0e5af7583fd34f4d913398a9c3b96

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    0a434be25f55f27ce0adbdfb08efeac1da01125b3e9194a94669bc7e9c6fe094

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    c181faacbef70f8a91606943470af50cfd443958c48601051371ff5d9bf66bb9ec794571b05a347a7f5776f06484dc007f535591d2f5e1c57e3c0ee04f3e9580

                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                    5a9f7ffc21ad18016611f25d86142bd4

                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                    d01b10dd26966cfa7ff95aba047c7715cc414fe8

                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                    ea0b288bbf4c01082680867b552555a2134ca04a91bf7945c0647c894a0740e5

                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                    d5b9cc793be1d628654aa5b70b643eaf12d6afa96c21a533ff1d55b218504c414785b8efd5abe5791ea8f7d50a088136499056eeb74a8fb42c9ccae6f8018de5

                                                                                                                                                                                                                                                  • memory/3296-94-0x0000000002EF0000-0x0000000002F06000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                  • memory/3296-1668-0x0000000002B70000-0x0000000002B86000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                  • memory/3384-96-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    44KB

                                                                                                                                                                                                                                                  • memory/3384-93-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    44KB

                                                                                                                                                                                                                                                  • memory/3528-1777-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    9.1MB

                                                                                                                                                                                                                                                  • memory/3528-1851-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    9.1MB

                                                                                                                                                                                                                                                  • memory/5276-1402-0x0000000074D00000-0x00000000754B0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                                                  • memory/5276-1460-0x0000000074D00000-0x00000000754B0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                                                  • memory/5276-1403-0x0000000000560000-0x0000000001A16000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    20.7MB

                                                                                                                                                                                                                                                  • memory/5324-1619-0x0000000000A60000-0x0000000000B60000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                                                  • memory/5324-1620-0x0000000000A40000-0x0000000000A49000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    36KB

                                                                                                                                                                                                                                                  • memory/5368-1423-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                  • memory/5368-1433-0x0000000074D00000-0x00000000754B0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                                                  • memory/5368-1608-0x0000000074D00000-0x00000000754B0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                                                  • memory/6360-1617-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                  • memory/6360-1447-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                  • memory/6376-1650-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    9.1MB

                                                                                                                                                                                                                                                  • memory/6376-1616-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    9.1MB

                                                                                                                                                                                                                                                  • memory/6376-1615-0x0000000002DD0000-0x00000000036BB000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    8.9MB

                                                                                                                                                                                                                                                  • memory/6376-1612-0x00000000029C0000-0x0000000002DC6000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4.0MB

                                                                                                                                                                                                                                                  • memory/7176-1682-0x00007FF772E90000-0x00007FF773431000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    5.6MB

                                                                                                                                                                                                                                                  • memory/7200-1623-0x0000000000540000-0x0000000000541000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                  • memory/7200-1467-0x0000000000540000-0x0000000000541000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                  • memory/7200-1683-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    756KB

                                                                                                                                                                                                                                                  • memory/7460-1236-0x000000000A930000-0x000000000A996000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                  • memory/7460-1322-0x000000000BFA0000-0x000000000C4CC000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    5.2MB

                                                                                                                                                                                                                                                  • memory/7460-1116-0x0000000000FC0000-0x0000000000FFC000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                  • memory/7460-1121-0x0000000074D00000-0x00000000754B0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                                                  • memory/7460-1124-0x0000000007E20000-0x00000000083C4000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    5.6MB

                                                                                                                                                                                                                                                  • memory/7460-1179-0x000000000A6D0000-0x000000000A70C000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                  • memory/7460-1125-0x0000000007910000-0x00000000079A2000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                  • memory/7460-1176-0x000000000A670000-0x000000000A682000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                  • memory/7460-1150-0x0000000007AC0000-0x0000000007AD0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                  • memory/7460-1172-0x0000000008DF0000-0x0000000009408000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    6.1MB

                                                                                                                                                                                                                                                  • memory/7460-1180-0x000000000A710000-0x000000000A75C000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                  • memory/7460-1159-0x0000000007900000-0x000000000790A000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                  • memory/7460-1173-0x000000000A780000-0x000000000A88A000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                  • memory/7460-1265-0x0000000007AC0000-0x0000000007AD0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                  • memory/7460-1356-0x0000000074D00000-0x00000000754B0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                                                  • memory/7460-1325-0x0000000006670000-0x00000000066C0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    320KB

                                                                                                                                                                                                                                                  • memory/7460-1321-0x000000000B8A0000-0x000000000BA62000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                  • memory/7536-1449-0x0000000000780000-0x00000000007BC000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                  • memory/7536-1459-0x00000000076C0000-0x00000000076D0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                  • memory/7536-1621-0x00000000076C0000-0x00000000076D0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                  • memory/7536-1558-0x0000000007880000-0x00000000078CC000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                  • memory/7536-1614-0x0000000074D00000-0x00000000754B0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                                                  • memory/7536-1445-0x0000000074D00000-0x00000000754B0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                                                  • memory/7920-1622-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    36KB

                                                                                                                                                                                                                                                  • memory/7920-1618-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    36KB

                                                                                                                                                                                                                                                  • memory/7920-1669-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    36KB

                                                                                                                                                                                                                                                  • memory/8172-1630-0x0000000005E30000-0x0000000005E96000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                  • memory/8172-1663-0x0000000007AA0000-0x0000000007ABE000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                  • memory/8172-1641-0x0000000006530000-0x000000000654E000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                  • memory/8172-1642-0x0000000006A90000-0x0000000006AD4000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    272KB

                                                                                                                                                                                                                                                  • memory/8172-1643-0x0000000005050000-0x0000000005060000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                  • memory/8172-1644-0x0000000007880000-0x00000000078F6000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                  • memory/8172-1646-0x0000000007F80000-0x00000000085FA000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    6.5MB

                                                                                                                                                                                                                                                  • memory/8172-1647-0x0000000007900000-0x000000000791A000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    104KB

                                                                                                                                                                                                                                                  • memory/8172-1625-0x0000000074D00000-0x00000000754B0000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                                                  • memory/8172-1649-0x0000000007AC0000-0x0000000007AF2000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    200KB

                                                                                                                                                                                                                                                  • memory/8172-1629-0x0000000005660000-0x0000000005682000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                  • memory/8172-1651-0x000000006D070000-0x000000006D0BC000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                  • memory/8172-1652-0x0000000071250000-0x00000000715A4000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                  • memory/8172-1640-0x0000000006140000-0x0000000006494000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                  • memory/8172-1624-0x0000000004F70000-0x0000000004FA6000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    216KB

                                                                                                                                                                                                                                                  • memory/8172-1626-0x0000000005050000-0x0000000005060000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                  • memory/8172-1628-0x0000000005690000-0x0000000005CB8000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    6.2MB

                                                                                                                                                                                                                                                  • memory/8172-1627-0x0000000005050000-0x0000000005060000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                  • memory/8480-1602-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3.5MB

                                                                                                                                                                                                                                                  • memory/8480-1604-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3.5MB

                                                                                                                                                                                                                                                  • memory/8796-1684-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3.5MB

                                                                                                                                                                                                                                                  • memory/8796-1664-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3.5MB

                                                                                                                                                                                                                                                  • memory/8796-1776-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3.5MB

                                                                                                                                                                                                                                                  • memory/8796-1609-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3.5MB

                                                                                                                                                                                                                                                  • memory/8796-1606-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    3.5MB

                                                                                                                                                                                                                                                  • memory/9148-1648-0x0000000000400000-0x0000000000965000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    5.4MB

                                                                                                                                                                                                                                                  • memory/9148-1441-0x0000000000B50000-0x0000000000B51000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                  • memory/9148-1613-0x0000000000B50000-0x0000000000B51000-memory.dmp

                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                    4KB