Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2023, 00:46

General

  • Target

    dcc8417f8686bb29d5e596ceb5dfbd7f.exe

  • Size

    1.2MB

  • MD5

    dcc8417f8686bb29d5e596ceb5dfbd7f

  • SHA1

    2e50d8eb01e1a16647f221f174ebd4705737bb41

  • SHA256

    48beaadd03e89be291f6003d61a6b8ae74050309f26744308b410af45cc106a9

  • SHA512

    8c38910d1abcc127ad59e1dd801632eee2493ccd4eee338c9c1286e598387bd712ff379cb74215050bba2c681ddfd156ea957e3c4ca3fe903994068c3efe6bec

  • SSDEEP

    24576:UByTM4+7dKjHCd4vrUfYWr1OzLIZrkyX4Br33RLV9fYORbStF:xuDirfWr1OzLIpO3Rx7RE

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

eternity

Wallets

47vk9PbPuHnEnazCn4tLpwPCWRLSMhpX9PD8WqpjchhTXisimD6j8EvRFDbPQHKUmHVq3vAM3DLytXLg8CqcdRXRFdPe92Q

Attributes
  • payload_urls

    https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 3 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 29 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dcc8417f8686bb29d5e596ceb5dfbd7f.exe
    "C:\Users\Admin\AppData\Local\Temp\dcc8417f8686bb29d5e596ceb5dfbd7f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\To1Jl94.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\To1Jl94.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Sv98lt0.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Sv98lt0.exe
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Adds Run key to start application
        • Drops file in System32 directory
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:1420
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:3260
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:4744
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1792
          4⤵
          • Program crash
          PID:5036
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4qI251AZ.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4qI251AZ.exe
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:836
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Vq1vJ9.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Vq1vJ9.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4444
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe617746f8,0x7ffe61774708,0x7ffe61774718
          4⤵
            PID:4944
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,343684655554355194,17852206476443339632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5156
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,343684655554355194,17852206476443339632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
            4⤵
              PID:5140
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
            3⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4276
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2396 /prefetch:8
              4⤵
                PID:5252
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5244
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
                4⤵
                  PID:5236
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                  4⤵
                    PID:5468
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                    4⤵
                      PID:5460
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
                      4⤵
                        PID:5984
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
                        4⤵
                          PID:5764
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
                          4⤵
                            PID:6224
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
                            4⤵
                              PID:6388
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
                              4⤵
                                PID:6776
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
                                4⤵
                                  PID:6920
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                                  4⤵
                                    PID:6936
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
                                    4⤵
                                      PID:7052
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
                                      4⤵
                                        PID:6560
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
                                        4⤵
                                          PID:6440
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
                                          4⤵
                                            PID:7016
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
                                            4⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5920
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
                                            4⤵
                                              PID:6276
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:1
                                              4⤵
                                                PID:5412
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1
                                                4⤵
                                                  PID:5084
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7792 /prefetch:8
                                                  4⤵
                                                    PID:6076
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7792 /prefetch:8
                                                    4⤵
                                                      PID:6124
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
                                                      4⤵
                                                        PID:5216
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
                                                        4⤵
                                                          PID:6976
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7576 /prefetch:8
                                                          4⤵
                                                            PID:5416
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17092009116070614535,2798355414797645070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:1
                                                            4⤵
                                                              PID:6000
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                            3⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3560
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x108,0x170,0x7ffe617746f8,0x7ffe61774708,0x7ffe61774718
                                                              4⤵
                                                                PID:4692
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1472,8825296556159980410,15116523837721252639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
                                                                4⤵
                                                                  PID:5920
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                                                                3⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2036
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe617746f8,0x7ffe61774708,0x7ffe61774718
                                                                  4⤵
                                                                    PID:4516
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1460,16874765493326825591,7949868393338416310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:3
                                                                    4⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5896
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                                                  3⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1980
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffe617746f8,0x7ffe61774708,0x7ffe61774718
                                                                    4⤵
                                                                      PID:2536
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,9482365654366138163,8193449190316019444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
                                                                      4⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:6648
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                    3⤵
                                                                      PID:5132
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffe617746f8,0x7ffe61774708,0x7ffe61774718
                                                                        4⤵
                                                                          PID:5180
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                        3⤵
                                                                          PID:6012
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffe617746f8,0x7ffe61774708,0x7ffe61774718
                                                                            4⤵
                                                                              PID:3972
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                            3⤵
                                                                              PID:808
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe617746f8,0x7ffe61774708,0x7ffe61774718
                                                                                4⤵
                                                                                  PID:6236
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                3⤵
                                                                                  PID:6596
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                                  3⤵
                                                                                    PID:6956
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe617746f8,0x7ffe61774708,0x7ffe61774718
                                                                                      4⤵
                                                                                        PID:7080
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                  1⤵
                                                                                    PID:4312
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                    1⤵
                                                                                      PID:5068
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1420 -ip 1420
                                                                                      1⤵
                                                                                        PID:3400
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffe617746f8,0x7ffe61774708,0x7ffe61774718
                                                                                        1⤵
                                                                                          PID:4616
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:5736
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:5456
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x16c,0x140,0x170,0x7ffe617746f8,0x7ffe61774708,0x7ffe61774718
                                                                                              1⤵
                                                                                                PID:6724
                                                                                              • C:\Users\Admin\AppData\Local\Temp\B8A1.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\B8A1.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:6024
                                                                                              • C:\Users\Admin\AppData\Local\Temp\4F83.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\4F83.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:8912
                                                                                                • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
                                                                                                  2⤵
                                                                                                    PID:9016
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                      3⤵
                                                                                                        PID:9096
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                      2⤵
                                                                                                        PID:9064
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                          3⤵
                                                                                                            PID:2788
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 328
                                                                                                              4⤵
                                                                                                              • Program crash
                                                                                                              PID:7240
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                                                                          2⤵
                                                                                                            PID:9196
                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell -nologo -noprofile
                                                                                                              3⤵
                                                                                                                PID:4864
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                                                                                3⤵
                                                                                                                  PID:4584
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell -nologo -noprofile
                                                                                                                    4⤵
                                                                                                                      PID:2540
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                                                                      4⤵
                                                                                                                        PID:4840
                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        powershell -nologo -noprofile
                                                                                                                        4⤵
                                                                                                                          PID:8704
                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -nologo -noprofile
                                                                                                                          4⤵
                                                                                                                            PID:844
                                                                                                                          • C:\Windows\rss\csrss.exe
                                                                                                                            C:\Windows\rss\csrss.exe
                                                                                                                            4⤵
                                                                                                                              PID:2064
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell -nologo -noprofile
                                                                                                                                5⤵
                                                                                                                                  PID:8984
                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  powershell -nologo -noprofile
                                                                                                                                  5⤵
                                                                                                                                    PID:7816
                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                    schtasks /delete /tn ScheduledUpdate /f
                                                                                                                                    5⤵
                                                                                                                                      PID:7792
                                                                                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                                                                                      5⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:7776
                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell -nologo -noprofile
                                                                                                                                      5⤵
                                                                                                                                        PID:8136
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                                                                                                        5⤵
                                                                                                                                          PID:3356
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tuc3.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                                    2⤵
                                                                                                                                      PID:7364
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-75UKA.tmp\tuc3.tmp
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-75UKA.tmp\tuc3.tmp" /SL5="$102C4,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:7464
                                                                                                                                          • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                            "C:\Program Files (x86)\xrecode3\xrecode3.exe" -i
                                                                                                                                            4⤵
                                                                                                                                              PID:8180
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              "C:\Windows\system32\schtasks.exe" /Query
                                                                                                                                              4⤵
                                                                                                                                                PID:8168
                                                                                                                                              • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                                "C:\Program Files (x86)\xrecode3\xrecode3.exe" -s
                                                                                                                                                4⤵
                                                                                                                                                  PID:8300
                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                  "C:\Windows\system32\net.exe" helpmsg 1
                                                                                                                                                  4⤵
                                                                                                                                                    PID:8292
                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                      C:\Windows\system32\net1 helpmsg 1
                                                                                                                                                      5⤵
                                                                                                                                                        PID:8396
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:7448
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\53AB.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\53AB.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:9148
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:9188
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:7540
                                                                                                                                                            • C:\Windows\SysWOW64\chcp.com
                                                                                                                                                              chcp 65001
                                                                                                                                                              4⤵
                                                                                                                                                                PID:8432
                                                                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                ping 127.0.0.1
                                                                                                                                                                4⤵
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:3988
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f
                                                                                                                                                                4⤵
                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                PID:2756
                                                                                                                                                              • C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:1688
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5775.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\5775.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:7632
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2788 -ip 2788
                                                                                                                                                              1⤵
                                                                                                                                                                PID:7188
                                                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                                                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                                                                                                                1⤵
                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                PID:8644
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9CBC.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\9CBC.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:7336

                                                                                                                                                                Network

                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                  Filesize

                                                                                                                                                                  152B

                                                                                                                                                                  MD5

                                                                                                                                                                  ae3f322db2ce5486f67f63ed1970430b

                                                                                                                                                                  SHA1

                                                                                                                                                                  eebcc22e1f1f217e9f5078d0f02575cbb78bc731

                                                                                                                                                                  SHA256

                                                                                                                                                                  296fd26e4db2fc68e1334ac6fc98cf92881c28cc2403a794b7062e8b4d7e5383

                                                                                                                                                                  SHA512

                                                                                                                                                                  856ca2456edb93baf561026ed21a738f7319c4d300bf272ad7e78e56418593569997e14145e518a04ec4a44fe85421c2d69768dde400f86dff076f3630466b3d

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                  Filesize

                                                                                                                                                                  152B

                                                                                                                                                                  MD5

                                                                                                                                                                  330c53ed8d8829bd4caf2c392a894f6b

                                                                                                                                                                  SHA1

                                                                                                                                                                  dc4f3eea00d78949be4aded712fcbfe85e6b06a5

                                                                                                                                                                  SHA256

                                                                                                                                                                  bbca8b0343812fb9db9b3c59655a18772c7c40bc77f497b89067a82d5e4ce8a5

                                                                                                                                                                  SHA512

                                                                                                                                                                  37674d84e4ea2079e8fe9bc45b0ea8fd93ffc8d206547835e4211046ad310ba3e5a397cf444b17a4322f9513cbd91bd92c0b106776b879cb0388ca9386ebd44d

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                                                                                                                                                                  Filesize

                                                                                                                                                                  20KB

                                                                                                                                                                  MD5

                                                                                                                                                                  923a543cc619ea568f91b723d9fb1ef0

                                                                                                                                                                  SHA1

                                                                                                                                                                  6f4ade25559645c741d7327c6e16521e43d7e1f9

                                                                                                                                                                  SHA256

                                                                                                                                                                  bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

                                                                                                                                                                  SHA512

                                                                                                                                                                  a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                                                                                                                  Filesize

                                                                                                                                                                  21KB

                                                                                                                                                                  MD5

                                                                                                                                                                  7d75a9eb3b38b5dd04b8a7ce4f1b87cc

                                                                                                                                                                  SHA1

                                                                                                                                                                  68f598c84936c9720c5ffd6685294f5c94000dff

                                                                                                                                                                  SHA256

                                                                                                                                                                  6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

                                                                                                                                                                  SHA512

                                                                                                                                                                  cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

                                                                                                                                                                  Filesize

                                                                                                                                                                  200KB

                                                                                                                                                                  MD5

                                                                                                                                                                  b3ba9decc3bb52ed5cca8158e05928a9

                                                                                                                                                                  SHA1

                                                                                                                                                                  19d045a3fbccbf788a29a4dba443d9ccf5a12fb0

                                                                                                                                                                  SHA256

                                                                                                                                                                  8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4

                                                                                                                                                                  SHA512

                                                                                                                                                                  86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                  Filesize

                                                                                                                                                                  5KB

                                                                                                                                                                  MD5

                                                                                                                                                                  496400d78b483f0bac69c9825af028e3

                                                                                                                                                                  SHA1

                                                                                                                                                                  2239cd0550c8343158fba6b5030af9c5a81b31ab

                                                                                                                                                                  SHA256

                                                                                                                                                                  c2a279cbef0be7d2b856db37bbf0b8fdd3a04b3c5ab3b1124431502c04ee5f77

                                                                                                                                                                  SHA512

                                                                                                                                                                  46c8d6aefa6b8426f744525c8547eb364d1b941a2d9e439eb815444056fb22d367ec54cb78df9393f05323d7eab528a273310c9efbcdc881beca855a38e159e9

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                  Filesize

                                                                                                                                                                  111B

                                                                                                                                                                  MD5

                                                                                                                                                                  285252a2f6327d41eab203dc2f402c67

                                                                                                                                                                  SHA1

                                                                                                                                                                  acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                                                                  SHA256

                                                                                                                                                                  5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                                                                  SHA512

                                                                                                                                                                  11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                  Filesize

                                                                                                                                                                  3KB

                                                                                                                                                                  MD5

                                                                                                                                                                  4bdc5b24656ecb79fd9524ab2ef06c9e

                                                                                                                                                                  SHA1

                                                                                                                                                                  04a80df2393c1687e7b67606572b7c64bf26a591

                                                                                                                                                                  SHA256

                                                                                                                                                                  988a8a0edaf06391e5f2dae7224b41cabcdc2dbdf5712b18d44d998603c007c9

                                                                                                                                                                  SHA512

                                                                                                                                                                  a1f97098ad10f14c10f31379c8cffcce0adec4ad0866c62fe7de8f9b50ebd5b92c400928a2052e2119d13ce1c1b220f55e19106693cce3f2986a4159a76ec73c

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                  Filesize

                                                                                                                                                                  5KB

                                                                                                                                                                  MD5

                                                                                                                                                                  8a565d43388bbdb2b215cfe34cef8e56

                                                                                                                                                                  SHA1

                                                                                                                                                                  6b33e679977cc8e992956f4e05d789dd5371eb10

                                                                                                                                                                  SHA256

                                                                                                                                                                  cb6df7b184ed48ca85cebd10c17f8364a450c2f4c51cd0b3f686a6387e8edd17

                                                                                                                                                                  SHA512

                                                                                                                                                                  a778901c4393d7f79d16117466a5596e4be04aa0982225515b7e89ef3e1496d508e73f3eaddc5c32dea57c0a0016919b4f50f50631e1c1537bb91b35541b492d

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                  Filesize

                                                                                                                                                                  9KB

                                                                                                                                                                  MD5

                                                                                                                                                                  1a78297f627f5106c9b6140b46974cd4

                                                                                                                                                                  SHA1

                                                                                                                                                                  c1646e4afe5be58d81445a379e4b624acfc55202

                                                                                                                                                                  SHA256

                                                                                                                                                                  fc92eb182d271166e2290b9b4282d6a57167b2cde148389e4da89e7548e3e286

                                                                                                                                                                  SHA512

                                                                                                                                                                  ac1be82c6f64b84fcc8ad32ca06ce5196fc35c0042425a852084bebdecf2850d5f3e765bcc2f47f2eddbbd40d20d4eea193635c3f27a900431e2b033e0cf09b4

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                  Filesize

                                                                                                                                                                  9KB

                                                                                                                                                                  MD5

                                                                                                                                                                  39fe255f94cf3926b6ee1fa34748324c

                                                                                                                                                                  SHA1

                                                                                                                                                                  51b2dbedb6b81aa15451344a721a2f6cf601d8f6

                                                                                                                                                                  SHA256

                                                                                                                                                                  944be8897520cd438b758e3ce40542f51090058675da0c3a0a25075147289ef6

                                                                                                                                                                  SHA512

                                                                                                                                                                  300ed112906b359ef613383074b8ffb9501f72f8983514614a35686fb0b1ac20763321751e50a79add2464be03545a88ce9b0fd5b3279846b771cceb2127c878

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                  Filesize

                                                                                                                                                                  9KB

                                                                                                                                                                  MD5

                                                                                                                                                                  24f6e44c41193bda75e2df5270ccc6a0

                                                                                                                                                                  SHA1

                                                                                                                                                                  9f9d51a8be70fb5f51adb9a2e49ffe1c5effe409

                                                                                                                                                                  SHA256

                                                                                                                                                                  332438483e1522c389bed00e9fe69e994268599c93c41aa811f67ec126303177

                                                                                                                                                                  SHA512

                                                                                                                                                                  64cfe0dd5d25853c358644b27b58e3dfe7952cdaacb661f71a37ae029294c95a904766165fecedb950b61d980db4b3b144cb9e964e6cb51f03f5f62cc3aa83b2

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                                                  Filesize

                                                                                                                                                                  24KB

                                                                                                                                                                  MD5

                                                                                                                                                                  642c1320fd78c859c77e459a2ce6b373

                                                                                                                                                                  SHA1

                                                                                                                                                                  9381494b4b82068a5ee6d144f93874c3c2e7a2ad

                                                                                                                                                                  SHA256

                                                                                                                                                                  a83b29b24ebf01b390239fc578d820ff596c2be395f86bb6f1b0868fca3dbef9

                                                                                                                                                                  SHA512

                                                                                                                                                                  891913c52311da6946a48c3034730b9e7c4c9ca1541fa477dadf8203b85ea4c8b7dd60b7c63eeea8b19716d71fc11777020a77a45270f2ab1e0109e2bc7ea083

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                                  Filesize

                                                                                                                                                                  89B

                                                                                                                                                                  MD5

                                                                                                                                                                  53c602a86826693912cdb32ef52376ab

                                                                                                                                                                  SHA1

                                                                                                                                                                  6a22bb600233f299fcda2dc1dc1f1c4cbb7300b9

                                                                                                                                                                  SHA256

                                                                                                                                                                  190317e374fa25d5799a1a78d3788ee25918bed6570874c2b916f617b52df271

                                                                                                                                                                  SHA512

                                                                                                                                                                  6a1f39e9588d1a1233c69892506350f26bb9e249f5a84815c838bc3e44e0acd9b8ae499e3cc6aa42f50e13fef9cc98e6663ebcac1a0889cdfae485df4b990355

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                                  Filesize

                                                                                                                                                                  146B

                                                                                                                                                                  MD5

                                                                                                                                                                  e6c7b863ab5b2cdcb865cdfafb1e90af

                                                                                                                                                                  SHA1

                                                                                                                                                                  7c43237821ee091fe8b0d01f0f8d930c62ae3a78

                                                                                                                                                                  SHA256

                                                                                                                                                                  573dedb2e49e48b12925796281786bc2ed7fed7aa10e6060fedb5af779aeaab4

                                                                                                                                                                  SHA512

                                                                                                                                                                  d81067dd336b6550d6db499ea18710dfc87511bf5c37fe92a4b61e48275a010b8f4416197dc22b7a18ab664ab94749ab611cf12e4186ae11f5d9aa0b9ff9986f

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                                  Filesize

                                                                                                                                                                  82B

                                                                                                                                                                  MD5

                                                                                                                                                                  26344e6c85cdf82a449d166eb985764d

                                                                                                                                                                  SHA1

                                                                                                                                                                  c7c7f983c27776886f9577b351b9cfecee0a9a93

                                                                                                                                                                  SHA256

                                                                                                                                                                  238c8b17dd47f58052db0236c32755cb9ffad0310e6e181d24071fe6ee9e49f8

                                                                                                                                                                  SHA512

                                                                                                                                                                  8783a074da5084b0988af258b62a23b2e389f926daf00689bdc6b064745d0da1b2a6fa1a5a4da80645e734c4c8197f2ecd55da966675afdc413dde5eb04491ce

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\07bf82a9-e4fe-4068-8bfe-bfa011233057\index-dir\the-real-index

                                                                                                                                                                  Filesize

                                                                                                                                                                  6KB

                                                                                                                                                                  MD5

                                                                                                                                                                  7bb4aa8ce6ef433ccaba3a787e9f1249

                                                                                                                                                                  SHA1

                                                                                                                                                                  3aceedd38ba36112f32ba2060f386dff0015ff24

                                                                                                                                                                  SHA256

                                                                                                                                                                  ea0971280dd99f09ecc9f80bba7972a288a9d3d3aa43bf4bddb4c834c88268ab

                                                                                                                                                                  SHA512

                                                                                                                                                                  e4ec94da3b6783624ed029476bcddad2527b82bc75f9290ca01421ae0c8dbb9abd00ef6c0362f09e1668d067250db1d0bb0ec1631b59b20b45bdda7f59c3e6a4

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\07bf82a9-e4fe-4068-8bfe-bfa011233057\index-dir\the-real-index~RFe584755.TMP

                                                                                                                                                                  Filesize

                                                                                                                                                                  48B

                                                                                                                                                                  MD5

                                                                                                                                                                  16957d5d6d51e32fcd46175fd9ac4343

                                                                                                                                                                  SHA1

                                                                                                                                                                  c5c82ed507ae900891456d3550f70ba2498f7ab4

                                                                                                                                                                  SHA256

                                                                                                                                                                  e6f7e07de56165a7d5afb61c300f3b266133c506b22e8a32f962aeebd52c8412

                                                                                                                                                                  SHA512

                                                                                                                                                                  41d3c32c225f72d8fcdb664b3012fd7e47d82081fd5af2a4efe32e5dc47548754a037843ffa8c8ec9ea9ebb1afc7d0ad86fc564eb0db0f74cab84ef16f831fb5

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                                                                                  Filesize

                                                                                                                                                                  83B

                                                                                                                                                                  MD5

                                                                                                                                                                  0b44ae66d60a987b349141740f8013a2

                                                                                                                                                                  SHA1

                                                                                                                                                                  baf4bcc48c42dd3fe12b4b8aa6f3c9ef2dca88ee

                                                                                                                                                                  SHA256

                                                                                                                                                                  e0b1639a479e0f8a230fe979162a0a949b7ed5bdac0f9886d8f8186e98f7b1d6

                                                                                                                                                                  SHA512

                                                                                                                                                                  5b5fdff1424b2c3896e9b217d399ca76f038dba64662bd802e0535f2acd3dab53ab9c06667715928b24007b237b5fc06e78df293d822debe4f9faead38c2eb3f

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                                                                                  Filesize

                                                                                                                                                                  79B

                                                                                                                                                                  MD5

                                                                                                                                                                  1661b140b3b68c994d492da6ad2ef0ac

                                                                                                                                                                  SHA1

                                                                                                                                                                  c94ddb0942542b1883788f9095e9cd88c0d228c1

                                                                                                                                                                  SHA256

                                                                                                                                                                  a8670a6b5c323db94bf3e121127c0a30dd7513c0e092fea525a212b19152796e

                                                                                                                                                                  SHA512

                                                                                                                                                                  006dd0a082c703ee4b2a7523e0d9edcf4ec9e13d699fc595493e4ff7a4fa7d79a1bee28344e2e775c78c402ccda1f6e2cec18434bd9350927aef0a910fc0578b

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                                                                                                                                  Filesize

                                                                                                                                                                  16B

                                                                                                                                                                  MD5

                                                                                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                                                                                  SHA1

                                                                                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                  SHA256

                                                                                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                  SHA512

                                                                                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                                                                  Filesize

                                                                                                                                                                  120B

                                                                                                                                                                  MD5

                                                                                                                                                                  d9081818c399b61e8431ab0ad501cfdf

                                                                                                                                                                  SHA1

                                                                                                                                                                  5905f80069e5205880a57ae6e63281261b82c5da

                                                                                                                                                                  SHA256

                                                                                                                                                                  29c0e63d9527f764fee708113a723e18efee399324e8af567bb5c9277e9c32aa

                                                                                                                                                                  SHA512

                                                                                                                                                                  e331cde1ec7434a4bea9e72943f84351cc287bd859be20e74506328ba6775bcf2b31b3248ac61c2c6ac9a1aee0f0fad87b400502674a84627edf381252233b15

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583285.TMP

                                                                                                                                                                  Filesize

                                                                                                                                                                  48B

                                                                                                                                                                  MD5

                                                                                                                                                                  460fb63b53a038109a391f11ba97f61a

                                                                                                                                                                  SHA1

                                                                                                                                                                  b5a78b755eabda1ed4ab7663025ac5f2de34533c

                                                                                                                                                                  SHA256

                                                                                                                                                                  f139d1757c42af99d45f3548001b71bdaacf420f9831a902fe4a9cc84ef6caa1

                                                                                                                                                                  SHA512

                                                                                                                                                                  a2a84c4ea99183bfe5d02abf5b0e347dcd232edf27625ee9f6de158f5cd2654d833518536c41b420405b52897c82b1371c06d4f45b48bed0380622d34c0f0db9

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  MD5

                                                                                                                                                                  a971e6126b82aba5c7527ae18ee584ce

                                                                                                                                                                  SHA1

                                                                                                                                                                  609f3bdda719eca12a3fe0f1ee10e47907f80cd2

                                                                                                                                                                  SHA256

                                                                                                                                                                  cda646dc141015767e9d63c6bba57c1c83ddc51a50ded2714b97e3b544a294df

                                                                                                                                                                  SHA512

                                                                                                                                                                  df2723490b8853b2d23601b013b9633be5b6d963b547059282fcbaf76644575895fd9f6db828d58a1b6d439483053093edcb809bf769c807f70dd0a1b1e54bd2

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  MD5

                                                                                                                                                                  70fd2308f8d801dad5ce254632e13b02

                                                                                                                                                                  SHA1

                                                                                                                                                                  0df2733a0f931fde809dc2907589d164bd35c9c6

                                                                                                                                                                  SHA256

                                                                                                                                                                  1b78c3b676d9514241ac22f13a2b37cdb733d9062f56000f00a4601892f325d7

                                                                                                                                                                  SHA512

                                                                                                                                                                  9f81082a4946587866b5967ba73be6af671324caa8ff05ad86b823f78cf57cfa942c4fff74b8c1233587eda4f217c91ad128273c520480dddba622f9cde1a6db

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  MD5

                                                                                                                                                                  5276106b0f5249dae09b2050c150023e

                                                                                                                                                                  SHA1

                                                                                                                                                                  64b58961a12f3f8f61a5e5f2d274e7692cee9c9c

                                                                                                                                                                  SHA256

                                                                                                                                                                  39e2967039efea79588017ca12e2120a30bcc12e30b211f7093b00dc3e9d13b8

                                                                                                                                                                  SHA512

                                                                                                                                                                  84a2f103f6d3e4d03f754b41c18231b5fea78abc71935c07c97bd43be787dabc4c3e782d331dc86116e112ac49ab603bfed250086f4f4eb3757b92e7012d1e6b

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c553.TMP

                                                                                                                                                                  Filesize

                                                                                                                                                                  3KB

                                                                                                                                                                  MD5

                                                                                                                                                                  3598a3238009ec787fe0833d41c7ff87

                                                                                                                                                                  SHA1

                                                                                                                                                                  465603c560cd9fb1d9f3776f706394dd0f30ebf0

                                                                                                                                                                  SHA256

                                                                                                                                                                  1090059cf4c6e150885540f99bd403142af6a1af182f62f39af339f5669b2504

                                                                                                                                                                  SHA512

                                                                                                                                                                  0aa6e4e7c7f3660a8394be99e6e9206ffa45a89a6bfa694b040e27849988135ef2043a7d01d0e4a45f0fdaef46292a4180b48fb1f639f5b52ea2fcf6023380df

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                  Filesize

                                                                                                                                                                  16B

                                                                                                                                                                  MD5

                                                                                                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                  SHA1

                                                                                                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                  SHA256

                                                                                                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                  SHA512

                                                                                                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                  Filesize

                                                                                                                                                                  2KB

                                                                                                                                                                  MD5

                                                                                                                                                                  6cfc4b098d78d63c5f9ee18fe27056e5

                                                                                                                                                                  SHA1

                                                                                                                                                                  db8264bd1d9a02b7133797e7e991c729da25ee52

                                                                                                                                                                  SHA256

                                                                                                                                                                  1895f270b25c96273d6146a43264d278b04b3853a91cb49c59de4d38267293e4

                                                                                                                                                                  SHA512

                                                                                                                                                                  068268f397af537338169a1292357fc27e622ef2b4c00931749725b1573afa7583b9ae158fabdce6e006ccdafcc518fd0a0dde34f4f87daf4456293c2a6e4552

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                  Filesize

                                                                                                                                                                  2KB

                                                                                                                                                                  MD5

                                                                                                                                                                  ff9fc6db20b69a12b9d1001bb4f73835

                                                                                                                                                                  SHA1

                                                                                                                                                                  650d2c13e8115d836ef14a21dff191d302af0227

                                                                                                                                                                  SHA256

                                                                                                                                                                  713d671efd67e7624d4ff4628c1b339f2b7a32067e5709ef68c3abfe5d49db69

                                                                                                                                                                  SHA512

                                                                                                                                                                  3f6287283ef6c6d0d0a8dacddadbf0f13ede1b1975e83a186c518101a5ab1084d273fbdef3cff250bd2142db282a9708b73a78ece37d5b2f3572d234ef2c09cd

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                  Filesize

                                                                                                                                                                  10KB

                                                                                                                                                                  MD5

                                                                                                                                                                  f1fecb2f49d30c9f65edc04d0358763a

                                                                                                                                                                  SHA1

                                                                                                                                                                  ff6b29c60cb3057f573a3d50c3e50d732647d196

                                                                                                                                                                  SHA256

                                                                                                                                                                  b391b3b33c1fe131d5b441d0a7a5505c5c6f64b0d38ac1ed50bb016bad1b17ac

                                                                                                                                                                  SHA512

                                                                                                                                                                  eedcd4a228db1d443115a898998c3ef2ea1d838805c04955971e20a1a6338771d3cddf138f528b2dbeb6ceb208e281db84fd569cacd5488c125de3f3ec4851c6

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                  Filesize

                                                                                                                                                                  2KB

                                                                                                                                                                  MD5

                                                                                                                                                                  055ac6ba10a8ee051f04a0129e43bdc1

                                                                                                                                                                  SHA1

                                                                                                                                                                  2c98bb23b1ad218ca39e2287ce00949b994ca5bf

                                                                                                                                                                  SHA256

                                                                                                                                                                  1dee195c68e7f4083f8c227d530eb85eab900e796c39f241522683da56c335e7

                                                                                                                                                                  SHA512

                                                                                                                                                                  396d055c2085632dbefc1a2d6ebb6161c15e3e2891d21b580b3cfae7f1603b25a353a4fc3f52f0040c2a172a39820aad9d30f6abca001e3f147147796f7de1c2

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                  Filesize

                                                                                                                                                                  2KB

                                                                                                                                                                  MD5

                                                                                                                                                                  002348e2ae1cc5187f6a9d3270fbb2c0

                                                                                                                                                                  SHA1

                                                                                                                                                                  90d1f1dc1e911350b4465857e9fd16598d44b50e

                                                                                                                                                                  SHA256

                                                                                                                                                                  be5a3af40b095a42dcd3889f27de62eca8d14b5aa9baa9aa255416935c9f4028

                                                                                                                                                                  SHA512

                                                                                                                                                                  f024e859a13b794ac7f95028098b573f91e09d2f25f100eccf525d95b7c0c4f8840d66fa061eb4afd0243d39629da37522be09380659e3719af1f7a2aacb6461

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.0MB

                                                                                                                                                                  MD5

                                                                                                                                                                  37d1530cb01a1203ebcc437a39567af0

                                                                                                                                                                  SHA1

                                                                                                                                                                  c6ca5012ee5382d0dc9049fa6faf9402f3debb45

                                                                                                                                                                  SHA256

                                                                                                                                                                  b86c94eac73ddb7cffefde1cec8b6eae9a296ce446c392432de05d0c66808873

                                                                                                                                                                  SHA512

                                                                                                                                                                  a19814eb5092b61cc7188063f89e3ba59973f4f5c3ff395df72bca555a0abe5d5af9c9d3c226c55e203209f5d8790f0b667194b5725b56c978e0b8be719b238d

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Vq1vJ9.exe

                                                                                                                                                                  Filesize

                                                                                                                                                                  898KB

                                                                                                                                                                  MD5

                                                                                                                                                                  c68274738e7ca418381b5c3bb0460cff

                                                                                                                                                                  SHA1

                                                                                                                                                                  d736afd0db842e6b8d7a34c4c8da991265df24e4

                                                                                                                                                                  SHA256

                                                                                                                                                                  08850c42dbd15d21da0b8c8a7fa95055df0f869fdae64c76ce0ba5c984c8cee5

                                                                                                                                                                  SHA512

                                                                                                                                                                  58be347722ed44bc6bc81529db6a2a628b8a0e0165e43aaf18282d0e86dc8425f9d26f875838b6dd69785c9e8899268246428f306ee2eccd0bb656dadc1166f3

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\To1Jl94.exe

                                                                                                                                                                  Filesize

                                                                                                                                                                  789KB

                                                                                                                                                                  MD5

                                                                                                                                                                  b783ae499133ad9b6ef92d27e0005dca

                                                                                                                                                                  SHA1

                                                                                                                                                                  6b4daf52e48b1507cc05aa7265d5ab224b1c3388

                                                                                                                                                                  SHA256

                                                                                                                                                                  91b55bf606e869d0fe5883374359b136b5a8b8ae416573ca65c9801cbb1b1918

                                                                                                                                                                  SHA512

                                                                                                                                                                  2fdc83757b3f72405c9f83ffbe2d221f730c7b9dadb3b6e875358dcc974609720f8c935fc60a070da998e0eb83c5e7a66b5909b92ee69224a399b7c1f85166cf

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\To1Jl94.exe

                                                                                                                                                                  Filesize

                                                                                                                                                                  750KB

                                                                                                                                                                  MD5

                                                                                                                                                                  f5b2c61db18d150aeec53a668e347f09

                                                                                                                                                                  SHA1

                                                                                                                                                                  1dcf0a36c86c48c311b316583d4b101e865060cb

                                                                                                                                                                  SHA256

                                                                                                                                                                  6b4b79a3d6bf4cb0f63f8c23e42493791b1e8daca817b284f450090837b5df1e

                                                                                                                                                                  SHA512

                                                                                                                                                                  c2c37d065e7e72599d89e08bb2d30438e67074b92aee97f1952c6646684bc9585899238453afc2152f6976b8206b65c1312d6dc30d410093c484e2bb9abf69a8

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Sv98lt0.exe

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.6MB

                                                                                                                                                                  MD5

                                                                                                                                                                  6e3e67117f68f997f8c5b598fbd2a5d7

                                                                                                                                                                  SHA1

                                                                                                                                                                  bbdc2a29c1b2a56243c929d97a3f15d0ac5f11f5

                                                                                                                                                                  SHA256

                                                                                                                                                                  eae7287e83f9659d59b02798092ea1ba18910f136171d4c6e08d9385ed289a51

                                                                                                                                                                  SHA512

                                                                                                                                                                  7cf7bc98f949b8b98260e63b78716f992d4bc8ea3339cc9749197a88589a7ed561999c3e391baa86b760ba6378620409182cad98908c159be811a2736fc669b7

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4qI251AZ.exe

                                                                                                                                                                  Filesize

                                                                                                                                                                  37KB

                                                                                                                                                                  MD5

                                                                                                                                                                  32c757b42d8d39f1483dda1db7180263

                                                                                                                                                                  SHA1

                                                                                                                                                                  68ff5e0e222c7db6b0d6362abe68a7ab8b5d0a2e

                                                                                                                                                                  SHA256

                                                                                                                                                                  262895bd6acd8d895c14c8549fec6b7b0b4de7368f887db9d6541ae537820a0a

                                                                                                                                                                  SHA512

                                                                                                                                                                  bb9713bad7b32a74d3aa2c2c61b6afccd3391209ef182aa2811aa36e3bdf858ff61d09092bb493672a4a3a574a0615b4760f0238641041fe4b9a86a1e4fa3f2e

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                                                                                                                                                  Filesize

                                                                                                                                                                  324KB

                                                                                                                                                                  MD5

                                                                                                                                                                  5190c78ec3faad13ef1de7f2d95c7815

                                                                                                                                                                  SHA1

                                                                                                                                                                  5717565de8c516bd75fa96d067bdcd5f7d750a2f

                                                                                                                                                                  SHA256

                                                                                                                                                                  7836e573748b3fb7d8cd6111d30d19b8a0315766aaa7c2de435c56e26a735ccf

                                                                                                                                                                  SHA512

                                                                                                                                                                  abe8489de31b3dc5b3d30adac949a934568ce77174e8568c1bef027f95c0194a3880efacdc8273f2c2f6f3b2b8e9aca69e7064a20b52d434f8194b937c19dd18

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0mze0mqa.xgt.ps1

                                                                                                                                                                  Filesize

                                                                                                                                                                  60B

                                                                                                                                                                  MD5

                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                  SHA1

                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                  SHA256

                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                  SHA512

                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\grandUIABsMTMeWO9JUVy\information.txt

                                                                                                                                                                  Filesize

                                                                                                                                                                  3KB

                                                                                                                                                                  MD5

                                                                                                                                                                  dca5cbb1c712e8a972fd2d57ef2c1e36

                                                                                                                                                                  SHA1

                                                                                                                                                                  b098c8c502785b5ba844d3551d3cb65efa8bd2b6

                                                                                                                                                                  SHA256

                                                                                                                                                                  4049607ae20f2641474e25eaf39f8999a41024c5b5dcdd0739133f92a84a5389

                                                                                                                                                                  SHA512

                                                                                                                                                                  c6e7fcdbd773c8abc1618f88fae8d4d4a2cf32e5a28c651148d58518baf0d27f7782a913f8a49939c9788fd869d87655a3cff6ef10dcc73a6cf97a656d1b0066

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                                                                                                                                                  Filesize

                                                                                                                                                                  28KB

                                                                                                                                                                  MD5

                                                                                                                                                                  dbb225e48b3358fe25c4abf784bf9d45

                                                                                                                                                                  SHA1

                                                                                                                                                                  cfaa0c52581b9ea40dcb145478141e83f90b6651

                                                                                                                                                                  SHA256

                                                                                                                                                                  403566e9fea515005ac70aa5852112e6551fc84c2f6e94d8c087c605261c8790

                                                                                                                                                                  SHA512

                                                                                                                                                                  53faf4287701e4fc3d8d13c91ee2bf7db14954c5cb7c1194c2b8f1e72f3ee0b25c467d01ae0b422447741a248520348b591197411ccd7c28b5494b243bcc332d

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                                                                                                                                  Filesize

                                                                                                                                                                  80KB

                                                                                                                                                                  MD5

                                                                                                                                                                  8408ae4a61bfb7949f029dcf998d0458

                                                                                                                                                                  SHA1

                                                                                                                                                                  e56b6cbdf940277aa2c706808f05cef75abbb899

                                                                                                                                                                  SHA256

                                                                                                                                                                  5d5f43030e5847da8120a91e9b91f792a457b7a68a0b1b256f274cb2195d67e9

                                                                                                                                                                  SHA512

                                                                                                                                                                  d01f52fc4f1825cf9a849b9344df8b8d32a5c962ecce28ac9263035f555363d9d38837d1b783363fb60ca457ce44571c5690cd223fff52093eb4ba8248ec249f

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                                                                                                                                                                  Filesize

                                                                                                                                                                  816KB

                                                                                                                                                                  MD5

                                                                                                                                                                  7ec6c1cece64feb8f9776e864a578d35

                                                                                                                                                                  SHA1

                                                                                                                                                                  ff530630d015c07bbbeaeb4b3de28b1d038751a4

                                                                                                                                                                  SHA256

                                                                                                                                                                  3ab60d74bd917a79fe40922652bb00bca05c068cd8c0fe36ac6ccdfc860b603b

                                                                                                                                                                  SHA512

                                                                                                                                                                  2cf8348c23bdbda8e0608bedeef6eff1ef27960eac8be8e9653d7d95719a4bd6cca0462b2267424e99c63af09a5efe8f2005e10e21c6060fc7e3eedd9b2ed747

                                                                                                                                                                • memory/836-95-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  44KB

                                                                                                                                                                • memory/836-92-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  44KB

                                                                                                                                                                • memory/2788-2353-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  36KB

                                                                                                                                                                • memory/2788-2273-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  36KB

                                                                                                                                                                • memory/2788-2271-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  36KB

                                                                                                                                                                • memory/3240-94-0x0000000000880000-0x0000000000896000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  88KB

                                                                                                                                                                • memory/3240-2331-0x00000000021B0000-0x00000000021C6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  88KB

                                                                                                                                                                • memory/4584-2472-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  9.1MB

                                                                                                                                                                • memory/4864-2281-0x0000000005460000-0x0000000005470000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  64KB

                                                                                                                                                                • memory/4864-2316-0x0000000007E70000-0x0000000007F13000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  652KB

                                                                                                                                                                • memory/4864-2323-0x0000000007FD0000-0x0000000007FE4000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  80KB

                                                                                                                                                                • memory/4864-2325-0x0000000008000000-0x0000000008008000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  32KB

                                                                                                                                                                • memory/4864-2324-0x00000000080C0000-0x00000000080DA000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  104KB

                                                                                                                                                                • memory/4864-2322-0x0000000007FC0000-0x0000000007FCE000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  56KB

                                                                                                                                                                • memory/4864-2302-0x000000007F230000-0x000000007F240000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  64KB

                                                                                                                                                                • memory/4864-2303-0x0000000007E10000-0x0000000007E42000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  200KB

                                                                                                                                                                • memory/4864-2320-0x0000000007F80000-0x0000000007F91000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  68KB

                                                                                                                                                                • memory/4864-2305-0x000000006C740000-0x000000006CA94000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.3MB

                                                                                                                                                                • memory/4864-2319-0x0000000008020000-0x00000000080B6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  600KB

                                                                                                                                                                • memory/4864-2318-0x0000000007F60000-0x0000000007F6A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  40KB

                                                                                                                                                                • memory/4864-2315-0x0000000007E50000-0x0000000007E6E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  120KB

                                                                                                                                                                • memory/4864-2304-0x0000000071780000-0x00000000717CC000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  304KB

                                                                                                                                                                • memory/4864-2300-0x00000000082C0000-0x000000000893A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.5MB

                                                                                                                                                                • memory/4864-2301-0x0000000007C60000-0x0000000007C7A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  104KB

                                                                                                                                                                • memory/4864-2299-0x0000000007BC0000-0x0000000007C36000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  472KB

                                                                                                                                                                • memory/4864-2298-0x0000000006CB0000-0x0000000006CF4000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  272KB

                                                                                                                                                                • memory/4864-2297-0x00000000068A0000-0x00000000068BE000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  120KB

                                                                                                                                                                • memory/4864-2278-0x00000000032B0000-0x00000000032E6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  216KB

                                                                                                                                                                • memory/4864-2296-0x0000000006420000-0x0000000006774000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.3MB

                                                                                                                                                                • memory/4864-2280-0x0000000074770000-0x0000000074F20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  7.7MB

                                                                                                                                                                • memory/4864-2295-0x00000000063B0000-0x0000000006416000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  408KB

                                                                                                                                                                • memory/4864-2285-0x00000000061D0000-0x0000000006236000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  408KB

                                                                                                                                                                • memory/4864-2284-0x0000000006100000-0x0000000006122000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  136KB

                                                                                                                                                                • memory/4864-2282-0x0000000005AA0000-0x00000000060C8000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.2MB

                                                                                                                                                                • memory/4864-2283-0x0000000005460000-0x0000000005470000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  64KB

                                                                                                                                                                • memory/7364-2090-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  80KB

                                                                                                                                                                • memory/7364-2269-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  80KB

                                                                                                                                                                • memory/7464-2279-0x0000000000530000-0x0000000000531000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                • memory/7464-2120-0x0000000000530000-0x0000000000531000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                • memory/7632-2274-0x0000000007560000-0x0000000007570000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  64KB

                                                                                                                                                                • memory/7632-2272-0x0000000074770000-0x0000000074F20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  7.7MB

                                                                                                                                                                • memory/7632-2122-0x0000000008420000-0x0000000008A38000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.1MB

                                                                                                                                                                • memory/7632-2093-0x0000000074770000-0x0000000074F20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  7.7MB

                                                                                                                                                                • memory/7632-2107-0x0000000007540000-0x000000000754A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  40KB

                                                                                                                                                                • memory/7632-2095-0x00000000005F0000-0x000000000062C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  240KB

                                                                                                                                                                • memory/7632-2105-0x0000000007560000-0x0000000007570000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  64KB

                                                                                                                                                                • memory/7632-2124-0x0000000007700000-0x000000000780A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.0MB

                                                                                                                                                                • memory/7632-2125-0x0000000007630000-0x0000000007642000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  72KB

                                                                                                                                                                • memory/7632-2185-0x0000000007E00000-0x0000000007E4C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  304KB

                                                                                                                                                                • memory/7632-2103-0x0000000007390000-0x0000000007422000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  584KB

                                                                                                                                                                • memory/7632-2144-0x0000000007690000-0x00000000076CC000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  240KB

                                                                                                                                                                • memory/8180-2257-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.5MB

                                                                                                                                                                • memory/8180-2255-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.5MB

                                                                                                                                                                • memory/8300-2260-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.5MB

                                                                                                                                                                • memory/8300-2317-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.5MB

                                                                                                                                                                • memory/8300-2263-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.5MB

                                                                                                                                                                • memory/8912-2045-0x0000000074770000-0x0000000074F20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  7.7MB

                                                                                                                                                                • memory/8912-2046-0x0000000000E80000-0x0000000002336000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  20.7MB

                                                                                                                                                                • memory/8912-2106-0x0000000074770000-0x0000000074F20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  7.7MB

                                                                                                                                                                • memory/9064-2270-0x0000000000890000-0x0000000000990000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1024KB

                                                                                                                                                                • memory/9064-2268-0x0000000000860000-0x0000000000869000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  36KB

                                                                                                                                                                • memory/9096-2264-0x0000000000B30000-0x0000000000B31000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                • memory/9096-2066-0x0000000000B30000-0x0000000000B31000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                • memory/9188-2085-0x0000000074770000-0x0000000074F20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  7.7MB

                                                                                                                                                                • memory/9188-2123-0x0000000074770000-0x0000000074F20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  7.7MB

                                                                                                                                                                • memory/9188-2073-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  40KB

                                                                                                                                                                • memory/9188-2075-0x00000000058D0000-0x0000000005E74000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  5.6MB

                                                                                                                                                                • memory/9196-2267-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  9.1MB

                                                                                                                                                                • memory/9196-2266-0x0000000002DA0000-0x000000000368B000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.9MB

                                                                                                                                                                • memory/9196-2265-0x00000000029A0000-0x0000000002D9F000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.0MB