Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    24s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2023, 02:51

General

  • Target

    c4a844e31520ffff519cc4aea8acce0eff61cf4f54566964febbde1be29a8712.exe

  • Size

    2.7MB

  • MD5

    afa6fbd86c448bceaf510ae6f8b831be

  • SHA1

    4343ea3bf97c160b0329432a1cd9a9680491509c

  • SHA256

    c4a844e31520ffff519cc4aea8acce0eff61cf4f54566964febbde1be29a8712

  • SHA512

    3796cf18cb04bd6f1ff3a9bbd70078db850bcbde5808138174519b70a77385d29f16066850c0956044f4024fb324e10fc6f2c64c069fc8bbfa1de496fab70574

  • SSDEEP

    49152:himYSnZL14ZONmqUwewSxHecP4XCxexdjXpo6N1QV:YmBLGZEmqUDzx+JdVo6N1

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

smokeloader

Botnet

up3

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4a844e31520ffff519cc4aea8acce0eff61cf4f54566964febbde1be29a8712.exe
    "C:\Users\Admin\AppData\Local\Temp\c4a844e31520ffff519cc4aea8acce0eff61cf4f54566964febbde1be29a8712.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tB0lu63.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tB0lu63.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qP8xB26.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qP8xB26.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kX8EH32.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kX8EH32.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4012
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1yz61bk1.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1yz61bk1.exe
            5⤵
            • Executes dropped EXE
            PID:5100
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 628
              6⤵
              • Program crash
              PID:2688
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3mk61Eb.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3mk61Eb.exe
            5⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:2580
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4hV149il.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4hV149il.exe
          4⤵
          • Executes dropped EXE
          PID:400
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 608
            5⤵
            • Program crash
            PID:1728
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5eh2lq1.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5eh2lq1.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4840
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          4⤵
            PID:2348
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            4⤵
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:4044
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6FR1MW1.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6FR1MW1.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:392
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1600
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fff892c46f8,0x7fff892c4708,0x7fff892c4718
            4⤵
              PID:1624
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,1049261313024902400,15936508813069205908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
              4⤵
                PID:6028
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,1049261313024902400,15936508813069205908,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1948 /prefetch:2
                4⤵
                  PID:5924
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3324
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fff892c46f8,0x7fff892c4708,0x7fff892c4718
                  4⤵
                    PID:1356
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,3531044504432431244,7384855396341942096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
                    4⤵
                      PID:3748
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3531044504432431244,7384855396341942096,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                      4⤵
                        PID:1124
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4264
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x8c,0x164,0x168,0x158,0x16c,0x7fff892c46f8,0x7fff892c4708,0x7fff892c4718
                        4⤵
                          PID:1872
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,11106478719089992969,9112746107973927177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                          4⤵
                            PID:5284
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11106478719089992969,9112746107973927177,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
                            4⤵
                              PID:5280
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2540
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff892c46f8,0x7fff892c4708,0x7fff892c4718
                              4⤵
                                PID:5056
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,15372195050069477539,17926900808892766239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
                                4⤵
                                  PID:6692
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,15372195050069477539,17926900808892766239,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
                                  4⤵
                                    PID:6684
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5100
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff892c46f8,0x7fff892c4708,0x7fff892c4718
                                    4⤵
                                      PID:2688
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,2924032611325179600,7629150963523831743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
                                      4⤵
                                        PID:5264
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2924032611325179600,7629150963523831743,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
                                        4⤵
                                          PID:3008
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                        3⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3588
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff892c46f8,0x7fff892c4708,0x7fff892c4718
                                          4⤵
                                            PID:2584
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
                                            4⤵
                                              PID:6056
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                                              4⤵
                                                PID:6048
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                                                4⤵
                                                  PID:6040
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
                                                  4⤵
                                                    PID:5460
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                                                    4⤵
                                                      PID:6524
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                                                      4⤵
                                                        PID:6512
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
                                                        4⤵
                                                          PID:6476
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
                                                          4⤵
                                                            PID:7492
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
                                                            4⤵
                                                              PID:7700
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
                                                              4⤵
                                                                PID:7832
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
                                                                4⤵
                                                                  PID:7852
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
                                                                  4⤵
                                                                    PID:7984
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                                                                    4⤵
                                                                      PID:8168
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
                                                                      4⤵
                                                                        PID:8188
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
                                                                        4⤵
                                                                          PID:3968
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5368 /prefetch:8
                                                                          4⤵
                                                                            PID:8148
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
                                                                            4⤵
                                                                              PID:6140
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2008 /prefetch:8
                                                                              4⤵
                                                                                PID:5724
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
                                                                                4⤵
                                                                                  PID:5672
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:1
                                                                                  4⤵
                                                                                    PID:5608
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
                                                                                    4⤵
                                                                                      PID:6468
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
                                                                                      4⤵
                                                                                        PID:5256
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6876 /prefetch:8
                                                                                        4⤵
                                                                                          PID:7208
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6876 /prefetch:8
                                                                                          4⤵
                                                                                            PID:7256
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                                                                                            4⤵
                                                                                              PID:7512
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8648195079554807709,2397000971430248390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
                                                                                              4⤵
                                                                                                PID:2824
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                                              3⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:544
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff892c46f8,0x7fff892c4708,0x7fff892c4718
                                                                                                4⤵
                                                                                                  PID:2844
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,7554209971505646077,17031260379057247057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
                                                                                                  4⤵
                                                                                                    PID:6744
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                                  3⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3684
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff892c46f8,0x7fff892c4708,0x7fff892c4718
                                                                                                    4⤵
                                                                                                      PID:4588
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,3268499750566788766,507192513105887910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
                                                                                                      4⤵
                                                                                                        PID:7276
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                                      3⤵
                                                                                                        PID:5272
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff892c46f8,0x7fff892c4708,0x7fff892c4718
                                                                                                          4⤵
                                                                                                            PID:5312
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14998178518782835120,6753473800935370349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
                                                                                                            4⤵
                                                                                                              PID:7480
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                                                            3⤵
                                                                                                              PID:5560
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5100 -ip 5100
                                                                                                          1⤵
                                                                                                            PID:2684
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 400 -ip 400
                                                                                                            1⤵
                                                                                                              PID:2604
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff892c46f8,0x7fff892c4708,0x7fff892c4718
                                                                                                              1⤵
                                                                                                                PID:5824
                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:6488
                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:3968
                                                                                                                  • C:\Windows\system32\AUDIODG.EXE
                                                                                                                    C:\Windows\system32\AUDIODG.EXE 0x240 0x2f8
                                                                                                                    1⤵
                                                                                                                      PID:3328
                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                      1⤵
                                                                                                                        PID:7100
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\C927.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\C927.exe
                                                                                                                        1⤵
                                                                                                                          PID:5480
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9A63.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\9A63.exe
                                                                                                                          1⤵
                                                                                                                            PID:5752
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
                                                                                                                              2⤵
                                                                                                                                PID:7400
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:5372
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                                                  2⤵
                                                                                                                                    PID:6964
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:5816
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                                                                                                      2⤵
                                                                                                                                        PID:5156
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tuc3.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                                        2⤵
                                                                                                                                          PID:5108
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-LPG7P.tmp\tuc3.tmp
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-LPG7P.tmp\tuc3.tmp" /SL5="$80210,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:3488
                                                                                                                                              • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                                "C:\Program Files (x86)\xrecode3\xrecode3.exe" -i
                                                                                                                                                4⤵
                                                                                                                                                  PID:2052
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  "C:\Windows\system32\schtasks.exe" /Query
                                                                                                                                                  4⤵
                                                                                                                                                    PID:4448
                                                                                                                                                  • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                                    "C:\Program Files (x86)\xrecode3\xrecode3.exe" -s
                                                                                                                                                    4⤵
                                                                                                                                                      PID:6504
                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                      "C:\Windows\system32\net.exe" helpmsg 1
                                                                                                                                                      4⤵
                                                                                                                                                        PID:6716
                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                          C:\Windows\system32\net1 helpmsg 1
                                                                                                                                                          5⤵
                                                                                                                                                            PID:4496
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:6740
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\A2DF.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\A2DF.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:7064
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1448.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\1448.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4136
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3926.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3926.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:3236

                                                                                                                                                          Network

                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                          Replay Monitor

                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                          Downloads

                                                                                                                                                          • C:\ProgramData\SpaceRacesEX\SpaceRacesEX.exe

                                                                                                                                                            Filesize

                                                                                                                                                            320KB

                                                                                                                                                            MD5

                                                                                                                                                            9d958d9d68afee63d4f3b0cab68c2f38

                                                                                                                                                            SHA1

                                                                                                                                                            d2a6654a465f2c5b8283b4e01813f6da83ea0127

                                                                                                                                                            SHA256

                                                                                                                                                            a1bf472a9cc785c517ed384fcce3114d79ed235d4b53eb2342e264daa56e3aa8

                                                                                                                                                            SHA512

                                                                                                                                                            46f180939a5075f87e4d698ca3386dcf3811b4d7b8827076097397fe9b86271a0c663656e3b251a7d81d677444c29d877ac4c22b23f83288a85b3c15069dc37f

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\15a791e0-3522-42d5-b40d-239c72f5010b.tmp

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            1126cb7063cb782a13bc4c97e6d676af

                                                                                                                                                            SHA1

                                                                                                                                                            492fafc0a0095b513283e74264d808d9f8280ae9

                                                                                                                                                            SHA256

                                                                                                                                                            93f38f06bcfe97b8df139912fa5b1d54d7d08a442c21ba218518899ae54f761a

                                                                                                                                                            SHA512

                                                                                                                                                            48264a33ff7dcaa1dd6695c32497783752a869f35c6885268254415be34fc926cdb87e2412f539f583c50060a19295541e4b5c5913074d489f92522d3ce9c992

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\57acb496-6456-4b00-b4b5-b2a775a812bb.tmp

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            c202f5494d80702e29e1c4e555896e7c

                                                                                                                                                            SHA1

                                                                                                                                                            ca1902fecf5b1a94b0ae29b72e55f6bd672b106d

                                                                                                                                                            SHA256

                                                                                                                                                            ec565f9e6fd3fe063ac5145e8051699a13fe35b97b5799c751b36abcd85be21f

                                                                                                                                                            SHA512

                                                                                                                                                            2d75d8013ccb3dd6835630b053c605619da0879ab56e0a564e68551ad175a716223d5aed6cd9d8a747b47cacd85047b8d28c0cd5aa86d7b6de3f94a70bdd482e

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                            Filesize

                                                                                                                                                            152B

                                                                                                                                                            MD5

                                                                                                                                                            5990c020b2d5158c9e2f12f42d296465

                                                                                                                                                            SHA1

                                                                                                                                                            dcb52612d301824d3a7fdfd0ea20c3fcfbb7a1b4

                                                                                                                                                            SHA256

                                                                                                                                                            2f33956ce5a0bb01abb3c0fee9a321c8f8f7abcf1d7535800bf25f1dc44b1643

                                                                                                                                                            SHA512

                                                                                                                                                            9efb70c4922365967c5fa7e89967e21eede96979a149e027099da786cd8b198d4e81bb3bf2b39c8d65a8796c5d72ca79241e66fc69e2502fdec8a0c5f230412c

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                            Filesize

                                                                                                                                                            152B

                                                                                                                                                            MD5

                                                                                                                                                            208a234643c411e1b919e904ee20115e

                                                                                                                                                            SHA1

                                                                                                                                                            400b6e6860953f981bfe4716c345b797ed5b2b5b

                                                                                                                                                            SHA256

                                                                                                                                                            af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458

                                                                                                                                                            SHA512

                                                                                                                                                            2779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8eb36ded-f32a-4ec2-b085-d4a9dbb636b8.tmp

                                                                                                                                                            Filesize

                                                                                                                                                            5KB

                                                                                                                                                            MD5

                                                                                                                                                            20bdb20bec15566de6ff3609d89f84be

                                                                                                                                                            SHA1

                                                                                                                                                            d3339405349f875c16c6940e7640bfae03a56f0d

                                                                                                                                                            SHA256

                                                                                                                                                            b2a09e3fa322d804c24b1e76a3a7cfb449729809d870bd9910cb6abcde9c2de6

                                                                                                                                                            SHA512

                                                                                                                                                            84eb401049d17ac2cc4a2e7a11daed96fc4bfb462b2fb21abd43c5b796b598a8e01a89340a23378ea1ee5eb7e28b45b28b98428fce2e7c5b81a85dc3bdbbccf0

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

                                                                                                                                                            Filesize

                                                                                                                                                            20KB

                                                                                                                                                            MD5

                                                                                                                                                            923a543cc619ea568f91b723d9fb1ef0

                                                                                                                                                            SHA1

                                                                                                                                                            6f4ade25559645c741d7327c6e16521e43d7e1f9

                                                                                                                                                            SHA256

                                                                                                                                                            bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

                                                                                                                                                            SHA512

                                                                                                                                                            a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

                                                                                                                                                            Filesize

                                                                                                                                                            21KB

                                                                                                                                                            MD5

                                                                                                                                                            7d75a9eb3b38b5dd04b8a7ce4f1b87cc

                                                                                                                                                            SHA1

                                                                                                                                                            68f598c84936c9720c5ffd6685294f5c94000dff

                                                                                                                                                            SHA256

                                                                                                                                                            6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

                                                                                                                                                            SHA512

                                                                                                                                                            cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

                                                                                                                                                            Filesize

                                                                                                                                                            33KB

                                                                                                                                                            MD5

                                                                                                                                                            909324d9c20060e3e73a7b5ff1f19dd8

                                                                                                                                                            SHA1

                                                                                                                                                            feea7790740db1e87419c8f5920859ea0234b76b

                                                                                                                                                            SHA256

                                                                                                                                                            dfc749d2afefe484d9aa9f8f06d461ad104a0ca9b75b46abfaaddda64a5e9278

                                                                                                                                                            SHA512

                                                                                                                                                            b64d2dce1f9a185fbb8a32adc1ff402d8045d379600bf3f9154bbde18303610f18af9fce258442db1e621ecf10b77aafe99cffedfcbe2a1490056c50cc42d0f9

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                            Filesize

                                                                                                                                                            111B

                                                                                                                                                            MD5

                                                                                                                                                            285252a2f6327d41eab203dc2f402c67

                                                                                                                                                            SHA1

                                                                                                                                                            acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                                                            SHA256

                                                                                                                                                            5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                                                            SHA512

                                                                                                                                                            11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                            Filesize

                                                                                                                                                            3KB

                                                                                                                                                            MD5

                                                                                                                                                            d78818271ade787b8735713212e17ec7

                                                                                                                                                            SHA1

                                                                                                                                                            b0938d017b1cb91bec916224706447743fb8705b

                                                                                                                                                            SHA256

                                                                                                                                                            d549e066f5735a0f12e8b4f947cf65b5d56ece61f948b1fc64e34d187a374fe3

                                                                                                                                                            SHA512

                                                                                                                                                            528fc6a55acfc718c89ae1801fd7b6fd41a376d73c18ebe74ca8b38a9f827602f76df3ff66ca4f39ef68cd87e509729f4a577d270c09299f648b838c64edb15b

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                            Filesize

                                                                                                                                                            7KB

                                                                                                                                                            MD5

                                                                                                                                                            f212b845908d39aedf4f8bd1ee9898cb

                                                                                                                                                            SHA1

                                                                                                                                                            0300f8d12ab5b7e455e8691ffea7bd3abd58c725

                                                                                                                                                            SHA256

                                                                                                                                                            ab50fadb3696251e76cd14b59f909d1ef8ec679eca5b7e44497774515da397d2

                                                                                                                                                            SHA512

                                                                                                                                                            782554a15d48bc3be67cb444066768bcc7a22292ee222ceababcdc85dfd74ccb1cbce2335d4a066e2c81ee3f10c1dc1bf62d3f08247e873ac4ab4c0a84a13a56

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                            Filesize

                                                                                                                                                            8KB

                                                                                                                                                            MD5

                                                                                                                                                            ab88e479cb1f73bad4b9eb7a0ea20a1f

                                                                                                                                                            SHA1

                                                                                                                                                            2b0304bad0065bd1401724844e4f36a365ca5b23

                                                                                                                                                            SHA256

                                                                                                                                                            c4e161d6573a1a572e83934579cfdb0a433fe46b6ffb0fd4c33a6d1956ca349b

                                                                                                                                                            SHA512

                                                                                                                                                            0218674d7bfb549a5c79320ae615febaf5d47fe0775db236a33e3f36e5aaf3051f563f7d5bf967222510bacb4a67d7c8daaa7accb0ae9696da2234d0331335f0

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                                            Filesize

                                                                                                                                                            24KB

                                                                                                                                                            MD5

                                                                                                                                                            5a6206a3489650bf4a9c3ce44a428126

                                                                                                                                                            SHA1

                                                                                                                                                            3137a909ef8b098687ec536c57caa1bacc77224b

                                                                                                                                                            SHA256

                                                                                                                                                            0a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28

                                                                                                                                                            SHA512

                                                                                                                                                            980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7d0ba500-9b74-49bd-91f5-569fe231f7e6\index-dir\the-real-index

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            4aeeedd40d3b2290bc998666d263c7a0

                                                                                                                                                            SHA1

                                                                                                                                                            0c877f54125a84fb9d18b851515592d6678933f1

                                                                                                                                                            SHA256

                                                                                                                                                            d4ec354477bf7b1df750f127fc0eacb4377242bded4e864081bc0fd4f327a069

                                                                                                                                                            SHA512

                                                                                                                                                            cfab3de4d88bbf9368a7c56d153061345521ac82d22a6b4f634cc1b6500d70a0f5e6af2dc0d5d719c7ccff1da3a511505f3f25b7e2e0e7d6d34ca453146399aa

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7d0ba500-9b74-49bd-91f5-569fe231f7e6\index-dir\the-real-index~RFe59044c.TMP

                                                                                                                                                            Filesize

                                                                                                                                                            48B

                                                                                                                                                            MD5

                                                                                                                                                            67b566aa842453cb11700a778eb17b9b

                                                                                                                                                            SHA1

                                                                                                                                                            185b728a208d5e97550dbfa34a247e29e456d9aa

                                                                                                                                                            SHA256

                                                                                                                                                            306ebc050b6f8a4957428fd8553fe7ea24d50e7f0fe63e01a1d4863d7e9dfd91

                                                                                                                                                            SHA512

                                                                                                                                                            626c96807b2e886d4f5f8d1210d020fda2e27126e5d80cf6a6fb53444379e1552f87a72699e67afca8736eb3775fc29a300e80aaa08cb71b56f4d02ed1c7853d

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                            Filesize

                                                                                                                                                            89B

                                                                                                                                                            MD5

                                                                                                                                                            a230065bceb961e4dfdb60589aed8f1e

                                                                                                                                                            SHA1

                                                                                                                                                            60237ecf832fa5b881d4138e627e92506a449c13

                                                                                                                                                            SHA256

                                                                                                                                                            9d4a690f7c235cc4fd837f8a57e7a67f10ceee3a30c9d568ac3289d951b7a3b4

                                                                                                                                                            SHA512

                                                                                                                                                            7dd3f45b4f6babca491dd6543550bd039fff60a5767cefcb304eaaac271cbb019744823ae7d03cebc9be752bd79bc9736306e78d8a9a3a499e3280b63ac5ae6f

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                            Filesize

                                                                                                                                                            146B

                                                                                                                                                            MD5

                                                                                                                                                            949bcef9bef77b6d5db24ed13bdf1575

                                                                                                                                                            SHA1

                                                                                                                                                            03753d4b6cd546fb9bfc5c62ce31632d3abd466f

                                                                                                                                                            SHA256

                                                                                                                                                            aeafd9af251ce3f3cd5551f22674cfd983ba2cce0531980dcac75e82061a4aa5

                                                                                                                                                            SHA512

                                                                                                                                                            00aa5e0dc94cdb44cf4d78e3f32726390c0a807fb933c384e7197b36138cbf334f4596768289519fbd1007534e9d0c59857a3b7c71f048cd21c6947cf947f8e2

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                            Filesize

                                                                                                                                                            84B

                                                                                                                                                            MD5

                                                                                                                                                            d063552eebb961d631f138b795d429fd

                                                                                                                                                            SHA1

                                                                                                                                                            bfaea3f86a1eb7b8add5a05aa8c822cbdd073386

                                                                                                                                                            SHA256

                                                                                                                                                            994174f7ed6b689e139818b46bbf329f3775dac1c909858fc3f193a7de65c2c4

                                                                                                                                                            SHA512

                                                                                                                                                            5d7cc3c3b394e8c2fdbd445d333e3510ac579807f781b8b74811532ac3470b997ccfb9deff8c31632aac94537da7ad409b54c1e0a7396149b84d12443c2429a3

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                            Filesize

                                                                                                                                                            82B

                                                                                                                                                            MD5

                                                                                                                                                            3e3c4a727ffee6728cfd53a38ae7254e

                                                                                                                                                            SHA1

                                                                                                                                                            e56a31795dfbf41b1e2594cc60aee95417df1cb2

                                                                                                                                                            SHA256

                                                                                                                                                            5c0efe1b277c258a546466a7fae0e9b5a2cd60e88a2dbf46328f1b5a5b6befe0

                                                                                                                                                            SHA512

                                                                                                                                                            4794c88a495714d43a1196ee9b006f14a4398758c80b2cf7d11ba87cbb3130ffd6e7c54bf35a9b7ace7094ed00e3f04e8661f9605766613f82549978d5c1fbbf

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                                                                                                                            Filesize

                                                                                                                                                            16B

                                                                                                                                                            MD5

                                                                                                                                                            46295cac801e5d4857d09837238a6394

                                                                                                                                                            SHA1

                                                                                                                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                            SHA256

                                                                                                                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                            SHA512

                                                                                                                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                                                            Filesize

                                                                                                                                                            72B

                                                                                                                                                            MD5

                                                                                                                                                            89b184ed87bf79ae6ab859ff1f5a86c5

                                                                                                                                                            SHA1

                                                                                                                                                            6ddc69c7dc5bdadb9b837abea9673a1c83d1915d

                                                                                                                                                            SHA256

                                                                                                                                                            ccdcc882353726ec09e7bfc3c68e0e2b9ceb76bccb8cfb9769730ea1b4a7365b

                                                                                                                                                            SHA512

                                                                                                                                                            2792a39a622f8e6d17d46e7d41d1b0f36dcd4513364eb0993ab825054d4c2055e2d1f00f90d983b03334d4f989298a929e0de2cb089928f25d1daa288cfd7c4a

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f5f4.TMP

                                                                                                                                                            Filesize

                                                                                                                                                            48B

                                                                                                                                                            MD5

                                                                                                                                                            d07b0dc4448ee7a225984cf5db2a48b0

                                                                                                                                                            SHA1

                                                                                                                                                            5142019209879f7054aad4dc6c8d25d3f215d576

                                                                                                                                                            SHA256

                                                                                                                                                            d96a87584353b3fc74e9ee82cdbd052d3586a7a255e7782025506ef9b28e68ed

                                                                                                                                                            SHA512

                                                                                                                                                            24e156ef6d2d527dc99d5d887f1d07390d1b1dab6b0e7a85941af6612f513dd5ed35be80035925859fd2544cf21d707212b155bd6bd08b4705f1add94bae96b2

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                            Filesize

                                                                                                                                                            1KB

                                                                                                                                                            MD5

                                                                                                                                                            40b1aedefd484a382e31514debbddd9e

                                                                                                                                                            SHA1

                                                                                                                                                            7786659c79ec179d862df784f138e2b4d32d4988

                                                                                                                                                            SHA256

                                                                                                                                                            2baab224e2239709a1d5789d44efebec1c49c6fe2c26277a14533a1be3d60f92

                                                                                                                                                            SHA512

                                                                                                                                                            d1e6d112f76b8a6aad30de8386f7b72c414037aecb2a60625cefa33598f0f3580ced703489961d07df1fd7891729919955b687eb2ecdaeca22f2bda891a52a67

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            8195022d73d67d5b3c19d1336add2457

                                                                                                                                                            SHA1

                                                                                                                                                            c55244bb9f731cea0c9223cb6d3ea86bd57a5a01

                                                                                                                                                            SHA256

                                                                                                                                                            3e745cb8b542100f4dbe4d3ba8b1396c33761ab625cf619cc6603d0b7f611c99

                                                                                                                                                            SHA512

                                                                                                                                                            e4bc004f181c0f9f9fd941915f43edba2914916ee14d476de0d3795fdc456a105a4bec580ef56aad4c9639ae15076ea23a1985362917e3054ce12c972b15a52a

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            80898b70d238a943a721476e7b6d60af

                                                                                                                                                            SHA1

                                                                                                                                                            d08a3e0c72d98b53feb4de91dedf87d2c836edc0

                                                                                                                                                            SHA256

                                                                                                                                                            8b2a12114bc84dd41ee0c17df8d77b8c7aa060e8ee5679c4cec45304fc8abfbe

                                                                                                                                                            SHA512

                                                                                                                                                            9eb6635cd220ebfaacd7b69ef8c8b63834dc3a1b932dcf51cf9de7431cd177e0e9e9207eeae51283f2aefec2722907266a0155d69ed15f1f1918885e019e2143

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            87ec7b5edb2c37f1ecb7f75d25dcbca5

                                                                                                                                                            SHA1

                                                                                                                                                            6086ed0aea53b7e0844b9de4828804fe22406bbe

                                                                                                                                                            SHA256

                                                                                                                                                            5ffbc8029c2b29fe54476e2f68c5144a1d6f2782cf8dee820370f36c7a3d4781

                                                                                                                                                            SHA512

                                                                                                                                                            c0755278db2ca0802dbe9213cb41c1d43fe706999f5ab72de996288e1d9e95baaad96817e9cc91fc8f9c682109d68b29480cc525290bf08b770ebfdeb7b2a4b7

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            7fe22b91aa18f0a47d49c880c17c7f51

                                                                                                                                                            SHA1

                                                                                                                                                            462eb893231093806933de3c4bf1f1df369161b5

                                                                                                                                                            SHA256

                                                                                                                                                            545a6ebc32259a5ea635bb4df5f610b1a2b101c5fa9b4b6e9be4b3c529cf4f1e

                                                                                                                                                            SHA512

                                                                                                                                                            70e52fde704420508dd49eb1696fa2f7cb942be9466807b0b8f6efefd657e7ec2e9d4772f6270e30b6f6d1b7596a75ff383ca7e12f4a4e0482aeabff7c80c951

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            e0eb30a57e09efcb745ea35e1cda74a6

                                                                                                                                                            SHA1

                                                                                                                                                            8454ac827bf5e510e754244bbc090f66615fca48

                                                                                                                                                            SHA256

                                                                                                                                                            1a3fb0989f10f5f41832fb459953693b33d36a76e31b6e68e6cb2ae22cf69dd4

                                                                                                                                                            SHA512

                                                                                                                                                            64d8c570cac0a9510704ff311c3acf8ae55b0cc76902a8815da4a8f2734975d9f9f6d26ce515c78d941cd2215efee90a130199fee02a16602cffe3737cf05d37

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            f00baee6e02fb6e91373d99de63e2f1a

                                                                                                                                                            SHA1

                                                                                                                                                            e4a8c5526fa5b5bfefc00272de693f5532342878

                                                                                                                                                            SHA256

                                                                                                                                                            10df9e516bd7a0d669c7588674ea14231cfefd59fff83686014677001bb04f64

                                                                                                                                                            SHA512

                                                                                                                                                            b65a746e6a4822f8d695ea746868591a336997ece7f2bcc5c4b6a99e9fecbf12c0406fea7af41654a64e68d35c6e25831c2b2cc4453a2910f03404728a84c1ba

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ea8a.TMP

                                                                                                                                                            Filesize

                                                                                                                                                            1KB

                                                                                                                                                            MD5

                                                                                                                                                            583ca452530be7d5f1b783b02832b390

                                                                                                                                                            SHA1

                                                                                                                                                            22683d9e674cb1f9b009993855f88f8f2df6cd34

                                                                                                                                                            SHA256

                                                                                                                                                            104f492b1ff44dcfe4322d1033c1a359c5fea26cf492397340b22669674e3b61

                                                                                                                                                            SHA512

                                                                                                                                                            15f38f4c9663a780fc95693afe6f404c7982fe700be22bb63654efe4ddd385f5858d87e94d50debdcca869cd89d4b31afd7e87f9cc5aa4663886ecc77b65b897

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                            Filesize

                                                                                                                                                            16B

                                                                                                                                                            MD5

                                                                                                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                            SHA1

                                                                                                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                            SHA256

                                                                                                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                            SHA512

                                                                                                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            9c650455db58a1a16f7161c41c7bc9b1

                                                                                                                                                            SHA1

                                                                                                                                                            1eb426006a65a8bcbbecf8e5d08aff8d30891463

                                                                                                                                                            SHA256

                                                                                                                                                            1b66dbd314ba86887b68b95b096a4fc2f8ae39ce97dbc57bad4d46fea8e854ab

                                                                                                                                                            SHA512

                                                                                                                                                            daa0cd1c0912544a606c6679b12ac1211272e0d3695b34a8e3d919f3b6f8829134b64289c05c3e4bd26c7f095d21c93a0e609b3d3df0953941ced3cf64ff9e40

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            85a48f87cef1be2ae2b4c970cff01032

                                                                                                                                                            SHA1

                                                                                                                                                            b1c886e24c69af438d25ca4ddf49defa0fea5289

                                                                                                                                                            SHA256

                                                                                                                                                            75eb9718e6f7ba85e1fd5db0cc82c89008d9593fe6fa94fe26b09d5f9063f0b0

                                                                                                                                                            SHA512

                                                                                                                                                            d4438d75eaeb4c57480c174afdc1a0bd2951e92d7146699ddaab0fd81866fd28e9936bd7e0a398b13716d474c87c9763123267d50af0e30745155cb423b14cef

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                            Filesize

                                                                                                                                                            12KB

                                                                                                                                                            MD5

                                                                                                                                                            72fdda49dea5124dfe81b7cb36103f87

                                                                                                                                                            SHA1

                                                                                                                                                            fa664b69fd364f56ca6e53c4139424220db97680

                                                                                                                                                            SHA256

                                                                                                                                                            077f219d19c6e718bb3aa2e0330cfd0cae34e6c59c51e7392d2a559b3c30da76

                                                                                                                                                            SHA512

                                                                                                                                                            754071cb201159291b2823ac01c9d39059c03536ebbec0349820fd600e285c3137b2fc3ac186455153ef823bf29854322222a6f741532ebb87a385a3480a4f1e

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            49dd5041685000c1d461af857f7fa6ed

                                                                                                                                                            SHA1

                                                                                                                                                            a5301e5be6fae5fd9a7459fec67f57b84e45ba95

                                                                                                                                                            SHA256

                                                                                                                                                            b13bbcf1159ca84b2ae0ab7e11fa8d6ce54607cc087504d9858586b662772287

                                                                                                                                                            SHA512

                                                                                                                                                            9a1f1eb2eb3a321e41a09f141e013db1ac80d42a4d5534576d752696f18848888376b7c9c77f6db4abd0fa0f76a17497ad1021e137979766012f745521a47482

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            2b01a67138bb84a9bcbc373fb92b21aa

                                                                                                                                                            SHA1

                                                                                                                                                            e4ecc3932e4532db8e74ca5de379301ebbdf62bb

                                                                                                                                                            SHA256

                                                                                                                                                            c1a108200547956162c67b3d76a2556b13a57493f5d1e7f04c597c0cf4915313

                                                                                                                                                            SHA512

                                                                                                                                                            171b066ba60e34d92733d97803d61940facca34c12b53cc2819e38371f8363c9d08bb263844ec10c70b9111a649881e5adfe649ec42f181378276358099ddc1d

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                            Filesize

                                                                                                                                                            10KB

                                                                                                                                                            MD5

                                                                                                                                                            5ee6870f99d536216485085288252960

                                                                                                                                                            SHA1

                                                                                                                                                            80c469e7b9510d9052be2d62564e98fab504af20

                                                                                                                                                            SHA256

                                                                                                                                                            833655ace7c4b5a44671f8eb0ab0c1f8544a2990eb2cedf5cdabdaa121c9c199

                                                                                                                                                            SHA512

                                                                                                                                                            82199b93c2f92ce5dcd646eaff20e521c8a14de2ee3a70a7d520444deea469564fbcfefd6c458b409180fd5152dbc8e0eb8c53eb739fd0a79bdd44586757719a

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            a3a515f7a35a9b872037d2ba61ca407d

                                                                                                                                                            SHA1

                                                                                                                                                            636439c4cf9ea8650eba7da172027c8201b0e28c

                                                                                                                                                            SHA256

                                                                                                                                                            c11a7a8708071ba69d2c54e21480daf56db142513593d92d4430204cca8d2529

                                                                                                                                                            SHA512

                                                                                                                                                            7e1b4f5b29752d95577440e5a5ae3fa594b6a4a11bf8cac8f829fd8ae58d4e3b1158bbef3aeacc5f31a753c6995dce29c0066654fca97f49d9878271ede75ece

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            f7ffd1936dd7d45f15fa6df252f0fdfe

                                                                                                                                                            SHA1

                                                                                                                                                            9d75745e85ea062a9c56fe16b398494142d9a73a

                                                                                                                                                            SHA256

                                                                                                                                                            c5123335fa170e20f050ca8360cf2c8d66a7abdb20cba206a72da56c2ebce575

                                                                                                                                                            SHA512

                                                                                                                                                            d2b46684548e577274f21ccca97dc326b354c2a6cb9bf656e38a3fe7857f553d2a7d40dfe4857b0e680d3695edabbce79e9dceb3994e1c72b3ead412947e19af

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                                                                                                                            Filesize

                                                                                                                                                            832KB

                                                                                                                                                            MD5

                                                                                                                                                            4a9e40fa8264d6e63bf044600ae92ec1

                                                                                                                                                            SHA1

                                                                                                                                                            917d952821b9c1ae38205a036ee4540afdf48f8a

                                                                                                                                                            SHA256

                                                                                                                                                            611487839bfadd009afa344945503a08ea240b2b966b924ab6c0cc160995798d

                                                                                                                                                            SHA512

                                                                                                                                                            1a1a1eb60e1710e6ad89bc3c4e7d87d032a463f905d03ff7f1a8bfc18ed81cb96951fe315659526b2ce40a55d05de3601c19643a17b915c1bb4efed43aaeea20

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6FR1MW1.exe

                                                                                                                                                            Filesize

                                                                                                                                                            897KB

                                                                                                                                                            MD5

                                                                                                                                                            c956e6d564e5212ccbe7d54fdbcb3d9b

                                                                                                                                                            SHA1

                                                                                                                                                            84af86348b68c4c506da8eac1c5f3cb3aa3516e6

                                                                                                                                                            SHA256

                                                                                                                                                            55dad4f157ed9281e93da63193c0f7517ab33f5c887ae71363ae0ded7a9fe08c

                                                                                                                                                            SHA512

                                                                                                                                                            b9a8273568773b9e4405b7c3d1a9488520783cc19e243d4527fa74567b8d5730efea0389320a38edaed9b06073d722577d5d2a56c20ad74c5876cc39e9f33907

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tB0lu63.exe

                                                                                                                                                            Filesize

                                                                                                                                                            2.2MB

                                                                                                                                                            MD5

                                                                                                                                                            b1caf9dbe7725c1236f25b2480be541c

                                                                                                                                                            SHA1

                                                                                                                                                            c2543db8e40ed220b5c7153ba8c4fb8b4312d310

                                                                                                                                                            SHA256

                                                                                                                                                            a4c388983d1b63417f4c5cd95ac755e1a87305302ec62186cccf4879225a8ce8

                                                                                                                                                            SHA512

                                                                                                                                                            f49d86c1d194f1e816f666f1ae875561d2a71b505aff64c649157e37d660db0c91730c1b8cb20c15c6514896024f3d740e9320a791b1c6886a6cbc5515c00a7e

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5eh2lq1.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.7MB

                                                                                                                                                            MD5

                                                                                                                                                            d5f1c71946a24fcea5d71b1e5e100915

                                                                                                                                                            SHA1

                                                                                                                                                            3978591516fc8ad4f6264196337dbbe9db6ebc8a

                                                                                                                                                            SHA256

                                                                                                                                                            3fd2b7d371580f758445c2a49613690f9e93cb86aa58b72fa047fabe044a6d1e

                                                                                                                                                            SHA512

                                                                                                                                                            24552c53253b1cf525bab8dfc1d4173f0c4a993ceeb8cc14f07cbf742f6ff27e1db5fc6752d6f9ff15cafc4c143138648222c631864fda85ac00c10ee6d466f5

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qP8xB26.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.7MB

                                                                                                                                                            MD5

                                                                                                                                                            7c7a8fc194486fb2bac3d20ff21fea55

                                                                                                                                                            SHA1

                                                                                                                                                            6ed89e96775678b343a2cc8bb1f388abdf5ff26a

                                                                                                                                                            SHA256

                                                                                                                                                            0e2d4a4ef6c90764da5e81a136aa0804968aa4983abf93238e316b7c0b0e6ad3

                                                                                                                                                            SHA512

                                                                                                                                                            d52224789f8b9dcab9442403196ef179885a826b6364bd2a142c4b9a2cc95c880b24ca51f0d05166e75a6ba532f1b004268ff0ed7720a0dac8a04bc246a26c50

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4hV149il.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                            MD5

                                                                                                                                                            1c3b0453008f29036653dfd8a960f6c9

                                                                                                                                                            SHA1

                                                                                                                                                            4fb23dba787f0c0f0da70b959139c555898a075d

                                                                                                                                                            SHA256

                                                                                                                                                            5c2f537ea53c8b26c93212773baff3d36e532af1c8434620f8e92a53d98a9791

                                                                                                                                                            SHA512

                                                                                                                                                            59266fb04dd5b891567bd60bf49b8897bdb295e2ddb2d199a7de0b2c6062a3a036438d5cbc16e791876848f12f248af9605502d7800253bf9bd913aabc7b21a5

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kX8EH32.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.0MB

                                                                                                                                                            MD5

                                                                                                                                                            446c684ccfad4a141bb4b06facd17cfa

                                                                                                                                                            SHA1

                                                                                                                                                            a4eeaee46b852dec61158690dff3e5e3ef45d3ba

                                                                                                                                                            SHA256

                                                                                                                                                            78dca9868ac26b9860183d6ceb666cce99b50e2901af5555bc2f2a468c3611a5

                                                                                                                                                            SHA512

                                                                                                                                                            f2b90353ed3c180b567236574c1f4db065fba274c5f06c090fdb22bfc3efb37ed351ac9fcda8d7ddd877bf1bc60ca1a0e737e949ab1bcafd57ad23d21fda5259

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1yz61bk1.exe

                                                                                                                                                            Filesize

                                                                                                                                                            963KB

                                                                                                                                                            MD5

                                                                                                                                                            1f95ef22d1953626831daeee233ddcb9

                                                                                                                                                            SHA1

                                                                                                                                                            88fb859078e5d5b16d1fb2404d5bb8a5b74cbfce

                                                                                                                                                            SHA256

                                                                                                                                                            daa98a4a331d8487689dde6a9f21069e6455f9c8a799d7cf5404559df7d337aa

                                                                                                                                                            SHA512

                                                                                                                                                            8544b7817841ce714f86ccd4c1cd6048cf6e1215ce0f6d0400e36c7f96917f5a82811fe3372fe725d305b4d29d75d8556b182d3265eb41c324a1262b2a6ed229

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3mk61Eb.exe

                                                                                                                                                            Filesize

                                                                                                                                                            37KB

                                                                                                                                                            MD5

                                                                                                                                                            fa42753a5fe2e60076476da32fcfaf01

                                                                                                                                                            SHA1

                                                                                                                                                            8147938ec14fc596c55d1819f8e2cb3d92991ac5

                                                                                                                                                            SHA256

                                                                                                                                                            22bf47b5ca0c997a013a8259a44a81171f00ee542c349695f1ea30a8b9c1051a

                                                                                                                                                            SHA512

                                                                                                                                                            e16b32648b38d7a6d8e2bb3062e0246d6bae0118d60b865eda9a671b26eb2f8f087d1ebddc9a6f9191cdc980e94d734adcd461e0dc2479e7790e2ebb79561dd1

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                                                                                                                                            Filesize

                                                                                                                                                            2.3MB

                                                                                                                                                            MD5

                                                                                                                                                            77471d919a5e2151fb49f37c315af514

                                                                                                                                                            SHA1

                                                                                                                                                            0687047ed80aa348bdc1657731f21181995b654c

                                                                                                                                                            SHA256

                                                                                                                                                            52666594a3e8bd7ac277411e215e1f65a7771f7c1d5b00a9e6ec95fade64f1f1

                                                                                                                                                            SHA512

                                                                                                                                                            6ffb45e79b03bac2820c98503793cd11c13803f49522eea9334c4c6cd05384dda3a60b0a8a8f363abc439ad444f1a8da290f0350fa69b75b6c3c9701177f8844

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                                                                                                                                            Filesize

                                                                                                                                                            448KB

                                                                                                                                                            MD5

                                                                                                                                                            1e8bd63c32c0ab2bdd62d30fd8686369

                                                                                                                                                            SHA1

                                                                                                                                                            ea0c1477d450837d1a01545b401ea4450de090a2

                                                                                                                                                            SHA256

                                                                                                                                                            10cc6b44a356a155c2a60fce044cac0fdd2e8666deac687c9f43d33da02a5529

                                                                                                                                                            SHA512

                                                                                                                                                            63006a7338ff30b368fba2f0550b37ed0d00df6243e8b08204529bfd0086f4cc994a73267645f896fdec9201f97f7709bb278b2a60f5c06ed5dc85dc9fc5db82

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                                                                                                                            Filesize

                                                                                                                                                            291KB

                                                                                                                                                            MD5

                                                                                                                                                            cde750f39f58f1ec80ef41ce2f4f1db9

                                                                                                                                                            SHA1

                                                                                                                                                            942ea40349b0e5af7583fd34f4d913398a9c3b96

                                                                                                                                                            SHA256

                                                                                                                                                            0a434be25f55f27ce0adbdfb08efeac1da01125b3e9194a94669bc7e9c6fe094

                                                                                                                                                            SHA512

                                                                                                                                                            c181faacbef70f8a91606943470af50cfd443958c48601051371ff5d9bf66bb9ec794571b05a347a7f5776f06484dc007f535591d2f5e1c57e3c0ee04f3e9580

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                                                                                                                                                            Filesize

                                                                                                                                                            576KB

                                                                                                                                                            MD5

                                                                                                                                                            0d20a5253d6047514e8d1fd41c684ec4

                                                                                                                                                            SHA1

                                                                                                                                                            6b737ec431ad97be9a87035c1093ebd2658d65c4

                                                                                                                                                            SHA256

                                                                                                                                                            fe8765126fe48275d33647f34480e760aef7d63fece8609229747230d6941139

                                                                                                                                                            SHA512

                                                                                                                                                            15db4de6977964d3838b6f31ed5a4d726ce34d08c0b47b3b46bc18f43cd91fcd55bc6b1c1a6dbd4ea4eda89ba1ed557c97642ea7d152fd3b3ea41a272923a15f

                                                                                                                                                          • memory/2052-1103-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            3.5MB

                                                                                                                                                          • memory/2052-1099-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            3.5MB

                                                                                                                                                          • memory/2052-1100-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            3.5MB

                                                                                                                                                          • memory/2580-40-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            44KB

                                                                                                                                                          • memory/2580-36-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            44KB

                                                                                                                                                          • memory/3340-38-0x0000000000B20000-0x0000000000B36000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                          • memory/3340-110-0x0000000002C80000-0x0000000002C96000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                          • memory/3488-948-0x0000000000620000-0x0000000000621000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                          • memory/4044-49-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            44KB

                                                                                                                                                          • memory/4044-119-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            44KB

                                                                                                                                                          • memory/4136-1167-0x0000000005550000-0x0000000005560000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            64KB

                                                                                                                                                          • memory/4136-1161-0x0000000074B90000-0x0000000075340000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            7.7MB

                                                                                                                                                          • memory/4136-1165-0x00000000053A0000-0x000000000543C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            624KB

                                                                                                                                                          • memory/4136-1162-0x0000000000280000-0x0000000000832000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                          • memory/5100-33-0x00000000028B0000-0x0000000002A45000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/5100-30-0x00000000028B0000-0x0000000002A45000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/5100-29-0x0000000002710000-0x00000000027E5000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            852KB

                                                                                                                                                          • memory/5100-31-0x0000000000400000-0x0000000000914000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.1MB

                                                                                                                                                          • memory/5108-923-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            80KB

                                                                                                                                                          • memory/5108-1181-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            80KB

                                                                                                                                                          • memory/5156-1178-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            9.1MB

                                                                                                                                                          • memory/5156-1175-0x0000000002E50000-0x000000000373B000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            8.9MB

                                                                                                                                                          • memory/5156-1172-0x0000000002A50000-0x0000000002E4B000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.0MB

                                                                                                                                                          • memory/5372-1173-0x0000000000B40000-0x0000000000B41000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                          • memory/5372-910-0x0000000000B40000-0x0000000000B41000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                          • memory/5752-847-0x0000000000240000-0x00000000016F6000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            20.7MB

                                                                                                                                                          • memory/5752-952-0x0000000074B90000-0x0000000075340000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            7.7MB

                                                                                                                                                          • memory/5752-835-0x0000000074B90000-0x0000000075340000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            7.7MB

                                                                                                                                                          • memory/5816-1179-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            36KB

                                                                                                                                                          • memory/5816-1177-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            36KB

                                                                                                                                                          • memory/6504-1110-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            3.5MB

                                                                                                                                                          • memory/6504-1111-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            3.5MB

                                                                                                                                                          • memory/6964-1176-0x0000000000870000-0x0000000000879000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            36KB

                                                                                                                                                          • memory/6964-1180-0x0000000000908000-0x000000000091B000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            76KB

                                                                                                                                                          • memory/7064-877-0x00000000072C0000-0x00000000072CA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            40KB

                                                                                                                                                          • memory/7064-836-0x00000000004F0000-0x000000000052C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            240KB

                                                                                                                                                          • memory/7064-1166-0x0000000074B90000-0x0000000075340000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            7.7MB

                                                                                                                                                          • memory/7064-846-0x0000000074B90000-0x0000000075340000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            7.7MB

                                                                                                                                                          • memory/7064-1171-0x0000000007420000-0x0000000007430000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            64KB

                                                                                                                                                          • memory/7064-848-0x00000000077F0000-0x0000000007D94000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.6MB

                                                                                                                                                          • memory/7064-1134-0x0000000007EB0000-0x0000000007F16000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            408KB

                                                                                                                                                          • memory/7064-849-0x00000000072E0000-0x0000000007372000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            584KB

                                                                                                                                                          • memory/7064-862-0x0000000007420000-0x0000000007430000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            64KB

                                                                                                                                                          • memory/7064-950-0x00000000075F0000-0x000000000763C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            304KB

                                                                                                                                                          • memory/7064-930-0x0000000007450000-0x0000000007462000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            72KB

                                                                                                                                                          • memory/7064-934-0x00000000074B0000-0x00000000074EC000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            240KB

                                                                                                                                                          • memory/7064-922-0x00000000083C0000-0x00000000089D8000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            6.1MB

                                                                                                                                                          • memory/7064-927-0x0000000007DA0000-0x0000000007EAA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.0MB