Analysis

  • max time kernel
    146s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-12-2023 08:06

General

  • Target

    a3219ddb25825de78bb1e9836128f84f.exe

  • Size

    1.2MB

  • MD5

    a3219ddb25825de78bb1e9836128f84f

  • SHA1

    cea92079d6532c647eaaab59c2847f59feca5a97

  • SHA256

    a4f9c3abb7204adb308b465fc0fe8d8c92ec69a3cfecd5bed35c27c3d497d96f

  • SHA512

    18ede629ab1c83ae28dc09a71a3e72d6cc742aba911e1376e8061ae59edecea62b8093528adf467ba88ba5ecaf4239de16276c9e5c5323733f92636c01f41a37

  • SSDEEP

    24576:YyhH35zNIid4O0KxJC6hWU14z2R9hUyX6yZgDoDGXPLcX/aiJnlVYL+ld:fhXpLj0IbWU14z2RD7HaXPgiiJn

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Extracted

Family

lumma

C2

http://castlesideopwas.pw/api

Signatures

  • Detect Lumma Stealer payload V4 3 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 2 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Stops running service(s) 3 TTPs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Drops file in System32 directory 4 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3219ddb25825de78bb1e9836128f84f.exe
    "C:\Users\Admin\AppData\Local\Temp\a3219ddb25825de78bb1e9836128f84f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Uz4oa16.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Uz4oa16.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:464
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1By46mn9.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1By46mn9.exe
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Adds Run key to start application
        • Drops file in System32 directory
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:2720
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:4388
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:808
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 1768
          4⤵
          • Program crash
          PID:2812
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lM545jS.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lM545jS.exe
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:4700
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LQ5PG9.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LQ5PG9.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3720
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3776
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffac05d46f8,0x7ffac05d4708,0x7ffac05d4718
          4⤵
            PID:3940
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2854693578397317858,3352938361315217989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5604
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2854693578397317858,3352938361315217989,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
            4⤵
              PID:5596
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1568
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffac05d46f8,0x7ffac05d4708,0x7ffac05d4718
              4⤵
                PID:2764
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5308743006618593417,9894504955520116267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5684
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5308743006618593417,9894504955520116267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                4⤵
                  PID:5676
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                3⤵
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:4396
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x13c,0x174,0x7ffac05d46f8,0x7ffac05d4708,0x7ffac05d4718
                  4⤵
                    PID:2468
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
                    4⤵
                      PID:5792
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
                      4⤵
                        PID:5780
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3472 /prefetch:8
                        4⤵
                          PID:5920
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:3
                          4⤵
                            PID:5912
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3412 /prefetch:2
                            4⤵
                              PID:5904
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
                              4⤵
                                PID:6384
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
                                4⤵
                                  PID:6716
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
                                  4⤵
                                    PID:6948
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
                                    4⤵
                                      PID:7028
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1
                                      4⤵
                                        PID:4600
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
                                        4⤵
                                          PID:6732
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
                                          4⤵
                                            PID:1864
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                                            4⤵
                                              PID:6240
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:1
                                              4⤵
                                                PID:7224
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
                                                4⤵
                                                  PID:7604
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
                                                  4⤵
                                                    PID:7720
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
                                                    4⤵
                                                      PID:7444
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
                                                      4⤵
                                                        PID:7456
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7500 /prefetch:8
                                                        4⤵
                                                          PID:7496
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7500 /prefetch:8
                                                          4⤵
                                                            PID:4076
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7296 /prefetch:1
                                                            4⤵
                                                              PID:8180
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7276 /prefetch:1
                                                              4⤵
                                                                PID:6252
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
                                                                4⤵
                                                                  PID:2992
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
                                                                  4⤵
                                                                    PID:5748
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7845123506531731679,1282449351035428698,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6576 /prefetch:2
                                                                    4⤵
                                                                      PID:6340
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                                                                    3⤵
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4300
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x13c,0x174,0x7ffac05d46f8,0x7ffac05d4708,0x7ffac05d4718
                                                                      4⤵
                                                                        PID:1808
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,4681209154297171380,6982278808755512902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
                                                                        4⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5660
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4681209154297171380,6982278808755512902,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
                                                                        4⤵
                                                                          PID:5652
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                                                        3⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2304
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffac05d46f8,0x7ffac05d4708,0x7ffac05d4718
                                                                          4⤵
                                                                            PID:1264
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4442365769063423726,10243080055762900118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
                                                                            4⤵
                                                                              PID:5304
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                            3⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4700
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x17c,0x180,0x184,0x158,0x188,0x7ffac05d46f8,0x7ffac05d4708,0x7ffac05d4718
                                                                              4⤵
                                                                                PID:464
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,4294508083117764036,12322499479663187465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
                                                                                4⤵
                                                                                  PID:6708
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                                3⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5132
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffac05d46f8,0x7ffac05d4708,0x7ffac05d4718
                                                                                  4⤵
                                                                                    PID:5180
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                  3⤵
                                                                                    PID:5696
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ffac05d46f8,0x7ffac05d4708,0x7ffac05d4718
                                                                                      4⤵
                                                                                        PID:5772
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                      3⤵
                                                                                        PID:6724
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffac05d46f8,0x7ffac05d4708,0x7ffac05d4718
                                                                                          4⤵
                                                                                            PID:6772
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                                          3⤵
                                                                                            PID:7084
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffac05d46f8,0x7ffac05d4708,0x7ffac05d4718
                                                                                              4⤵
                                                                                                PID:6248
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                          1⤵
                                                                                            PID:4792
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                            1⤵
                                                                                              PID:3020
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2720 -ip 2720
                                                                                              1⤵
                                                                                                PID:3252
                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:6520
                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:3364
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3DCF.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\3DCF.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:1340
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1B01.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\1B01.exe
                                                                                                    1⤵
                                                                                                      PID:8072
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
                                                                                                        2⤵
                                                                                                          PID:5972
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                            3⤵
                                                                                                              PID:5380
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                            2⤵
                                                                                                              PID:4448
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                                3⤵
                                                                                                                  PID:3120
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                                                                                2⤵
                                                                                                                  PID:1416
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell -nologo -noprofile
                                                                                                                    3⤵
                                                                                                                      PID:5284
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                                                                                      3⤵
                                                                                                                        PID:2240
                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -nologo -noprofile
                                                                                                                          4⤵
                                                                                                                            PID:6012
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                                                                            4⤵
                                                                                                                              PID:4572
                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                                                                                5⤵
                                                                                                                                • Modifies Windows Firewall
                                                                                                                                PID:528
                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell -nologo -noprofile
                                                                                                                              4⤵
                                                                                                                                PID:3016
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tuc3.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                            2⤵
                                                                                                                              PID:5484
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-3LBIF.tmp\tuc3.tmp
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-3LBIF.tmp\tuc3.tmp" /SL5="$3027C,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:2404
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    "C:\Windows\system32\schtasks.exe" /Query
                                                                                                                                    4⤵
                                                                                                                                      PID:6352
                                                                                                                                    • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                      "C:\Program Files (x86)\xrecode3\xrecode3.exe" -i
                                                                                                                                      4⤵
                                                                                                                                        PID:7940
                                                                                                                                      • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                        "C:\Program Files (x86)\xrecode3\xrecode3.exe" -s
                                                                                                                                        4⤵
                                                                                                                                          PID:5340
                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                          "C:\Windows\system32\net.exe" helpmsg 1
                                                                                                                                          4⤵
                                                                                                                                            PID:1300
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 helpmsg 1
                                                                                                                                              5⤵
                                                                                                                                                PID:5312
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                                                                                                                                          2⤵
                                                                                                                                            PID:7892
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1FC5.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\1FC5.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:8048
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\99A9.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\99A9.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:7100
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:3300
                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 1012
                                                                                                                                                  2⤵
                                                                                                                                                  • Program crash
                                                                                                                                                  PID:8076
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                                                                                1⤵
                                                                                                                                                  PID:6300
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4348
                                                                                                                                                    • C:\Windows\System32\sc.exe
                                                                                                                                                      sc stop WaaSMedicSvc
                                                                                                                                                      2⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:1440
                                                                                                                                                    • C:\Windows\System32\sc.exe
                                                                                                                                                      sc stop UsoSvc
                                                                                                                                                      2⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:5852
                                                                                                                                                    • C:\Windows\System32\sc.exe
                                                                                                                                                      sc stop wuauserv
                                                                                                                                                      2⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:5548
                                                                                                                                                    • C:\Windows\System32\sc.exe
                                                                                                                                                      sc stop bits
                                                                                                                                                      2⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:5508
                                                                                                                                                    • C:\Windows\System32\sc.exe
                                                                                                                                                      sc stop dosvc
                                                                                                                                                      2⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:4464
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1560
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                                                                                                                      1⤵
                                                                                                                                                        PID:6268
                                                                                                                                                        • C:\Windows\System32\powercfg.exe
                                                                                                                                                          powercfg /x -hibernate-timeout-ac 0
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3084
                                                                                                                                                          • C:\Windows\System32\powercfg.exe
                                                                                                                                                            powercfg /x -hibernate-timeout-dc 0
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2176
                                                                                                                                                            • C:\Windows\System32\powercfg.exe
                                                                                                                                                              powercfg /x -standby-timeout-ac 0
                                                                                                                                                              2⤵
                                                                                                                                                                PID:184
                                                                                                                                                              • C:\Windows\System32\powercfg.exe
                                                                                                                                                                powercfg /x -standby-timeout-dc 0
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:7728
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7100 -ip 7100
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:6544
                                                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                                                  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:6876
                                                                                                                                                                  • C:\Program Files\Google\Chrome\updater.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\updater.exe"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:1596
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D675.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\D675.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:2736

                                                                                                                                                                      Network

                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                      Replay Monitor

                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                      Downloads

                                                                                                                                                                      • C:\ProgramData\SpaceRacesEX\SpaceRacesEX.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        214KB

                                                                                                                                                                        MD5

                                                                                                                                                                        7ac9f5b63bb5c8d1971ca83850ba7013

                                                                                                                                                                        SHA1

                                                                                                                                                                        1789719580cecac3f13de4b1930732d25b1e0628

                                                                                                                                                                        SHA256

                                                                                                                                                                        c15793365a6dbdb2651effa87de02ba68e2802cebe5340053c721a707b5d439c

                                                                                                                                                                        SHA512

                                                                                                                                                                        2ba0095354d3023053e0a5ff03020223b37560887e004dd208422c06234d57d41116ebb0552b8e0646eb18f56dfcc19e821558d9f06f19bda6f2a442a467aac7

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                        Filesize

                                                                                                                                                                        152B

                                                                                                                                                                        MD5

                                                                                                                                                                        fcd8bb32c04fa99657007efde87bbbc2

                                                                                                                                                                        SHA1

                                                                                                                                                                        ce575cef42840e731c9834e27efa02efa0c57a6b

                                                                                                                                                                        SHA256

                                                                                                                                                                        2e3fecfa2023e8f7b14c40277a60b0c781659ae240a32ae2521f7fa0f000744f

                                                                                                                                                                        SHA512

                                                                                                                                                                        b87bece2e0850f523206684c555cf80b348f794d51e8e0f7cf9c0ef054fc103885145acde9698dc363e8162aeaa4495a180825836e3fb92d4a3220f3359f57c9

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                        Filesize

                                                                                                                                                                        152B

                                                                                                                                                                        MD5

                                                                                                                                                                        e5c27b4a4d5a3c9c60ba18cb867266e3

                                                                                                                                                                        SHA1

                                                                                                                                                                        dea55f1d4cdc831f943f4e56f4f8e9a926777600

                                                                                                                                                                        SHA256

                                                                                                                                                                        860ed0acc83eb0096cc8911725e2c631ff879ad8c35854577651af502c4b69c9

                                                                                                                                                                        SHA512

                                                                                                                                                                        56eda28e9c61e8081dadc220d23e7bb3320a9ba557eb7511d17a3d2836aa61f301d1d714a3d611eedd7c4b91886c790af7366b01acdb3b637f3dc4fb024f3f6b

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                                                                                                                        Filesize

                                                                                                                                                                        20KB

                                                                                                                                                                        MD5

                                                                                                                                                                        923a543cc619ea568f91b723d9fb1ef0

                                                                                                                                                                        SHA1

                                                                                                                                                                        6f4ade25559645c741d7327c6e16521e43d7e1f9

                                                                                                                                                                        SHA256

                                                                                                                                                                        bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

                                                                                                                                                                        SHA512

                                                                                                                                                                        a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                                                                                                                        Filesize

                                                                                                                                                                        21KB

                                                                                                                                                                        MD5

                                                                                                                                                                        7d75a9eb3b38b5dd04b8a7ce4f1b87cc

                                                                                                                                                                        SHA1

                                                                                                                                                                        68f598c84936c9720c5ffd6685294f5c94000dff

                                                                                                                                                                        SHA256

                                                                                                                                                                        6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

                                                                                                                                                                        SHA512

                                                                                                                                                                        cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

                                                                                                                                                                        Filesize

                                                                                                                                                                        33KB

                                                                                                                                                                        MD5

                                                                                                                                                                        909324d9c20060e3e73a7b5ff1f19dd8

                                                                                                                                                                        SHA1

                                                                                                                                                                        feea7790740db1e87419c8f5920859ea0234b76b

                                                                                                                                                                        SHA256

                                                                                                                                                                        dfc749d2afefe484d9aa9f8f06d461ad104a0ca9b75b46abfaaddda64a5e9278

                                                                                                                                                                        SHA512

                                                                                                                                                                        b64d2dce1f9a185fbb8a32adc1ff402d8045d379600bf3f9154bbde18303610f18af9fce258442db1e621ecf10b77aafe99cffedfcbe2a1490056c50cc42d0f9

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

                                                                                                                                                                        Filesize

                                                                                                                                                                        167KB

                                                                                                                                                                        MD5

                                                                                                                                                                        5d60f0d1cbe87b62baafae53497e5910

                                                                                                                                                                        SHA1

                                                                                                                                                                        f4093b67605f78ce0604ac639f107651f5daf447

                                                                                                                                                                        SHA256

                                                                                                                                                                        913ca75347c8ee8872d84a23bf72846cb44042796d7a51f0cc4b8b7daadadb4c

                                                                                                                                                                        SHA512

                                                                                                                                                                        dfd4fc0770e0a597ea7efaface4ce04f6f2a2a12dd2089cdc0e1f43161172374266d84287e13aa86a47bb257c55ad592ef3c647b0a3c897da3d551eae9967ac3

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

                                                                                                                                                                        Filesize

                                                                                                                                                                        200KB

                                                                                                                                                                        MD5

                                                                                                                                                                        b3ba9decc3bb52ed5cca8158e05928a9

                                                                                                                                                                        SHA1

                                                                                                                                                                        19d045a3fbccbf788a29a4dba443d9ccf5a12fb0

                                                                                                                                                                        SHA256

                                                                                                                                                                        8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4

                                                                                                                                                                        SHA512

                                                                                                                                                                        86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                        Filesize

                                                                                                                                                                        3KB

                                                                                                                                                                        MD5

                                                                                                                                                                        f24443baa72e4d27a13d1a8a4273e579

                                                                                                                                                                        SHA1

                                                                                                                                                                        cab0371adfd1cad96c8cfcc6b64ab480079d8647

                                                                                                                                                                        SHA256

                                                                                                                                                                        86cfabfe2f6182006525b158837a4da370e63e36197552a66658090e8664562d

                                                                                                                                                                        SHA512

                                                                                                                                                                        6e22f92b6c016cec7ef08b3b3270a292ce54e55dadbed3263509b87d78000ce0ac69f9426a8b7e150909c68b9d02a411a5745bc7957fcd326da942de0eeaccc9

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                        Filesize

                                                                                                                                                                        3KB

                                                                                                                                                                        MD5

                                                                                                                                                                        1cb144191ac9b7feb11123a73bd7b223

                                                                                                                                                                        SHA1

                                                                                                                                                                        8c42d01d63ce579f6539bd593e2879c90c3fcee0

                                                                                                                                                                        SHA256

                                                                                                                                                                        3528af5689db4ff03f210b986b2cb6db2e0fa574791ba60aca063a90f2d61de5

                                                                                                                                                                        SHA512

                                                                                                                                                                        3e523bb4c4ffad093fde8bb480d7a3d9d5509d6e33f91d943c028f382b99d9e8ae04bbc4cc2436dfb38c0df9dd1cd4e9d7f6f7c922858fc810e6534122d64fff

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                        Filesize

                                                                                                                                                                        111B

                                                                                                                                                                        MD5

                                                                                                                                                                        285252a2f6327d41eab203dc2f402c67

                                                                                                                                                                        SHA1

                                                                                                                                                                        acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                                                                        SHA256

                                                                                                                                                                        5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                                                                        SHA512

                                                                                                                                                                        11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                        Filesize

                                                                                                                                                                        8KB

                                                                                                                                                                        MD5

                                                                                                                                                                        1140fc3c2e268a31f67da8acd99a7119

                                                                                                                                                                        SHA1

                                                                                                                                                                        04049c1de2283d64448208a5f3ecc2b8b1b0615d

                                                                                                                                                                        SHA256

                                                                                                                                                                        928549365dd2310251b82c5cf9021b0924e826049c66d6f76ea36ba0cd2f9b86

                                                                                                                                                                        SHA512

                                                                                                                                                                        bd29b697ccc5be4c099266fe4612a65764a40cc96834604e2f64b964721ffa35b5a44931b3ab2fd24b3b8aea8e9a52ee851701f205930779276c1260045d7225

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                        Filesize

                                                                                                                                                                        8KB

                                                                                                                                                                        MD5

                                                                                                                                                                        0550c15d576fd92164a3ce9a00d8a73f

                                                                                                                                                                        SHA1

                                                                                                                                                                        c5dcb94aca35b1608b5714aa5cf2ccb8d332a67b

                                                                                                                                                                        SHA256

                                                                                                                                                                        41a02f283c32802b18626a1a92e75490844cbb4399b692212c371a6695030040

                                                                                                                                                                        SHA512

                                                                                                                                                                        2783ac6a08095a50b5b5549fbdf98e617d07ae86cd1abddeeb9f6adde67a4e0a59f54e2dac791999a217dea2ff3dd17cda52fb7bf15e2f47dc8292beceab7374

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                        Filesize

                                                                                                                                                                        5KB

                                                                                                                                                                        MD5

                                                                                                                                                                        b8978dce24912a9ea0807b48709dfd8e

                                                                                                                                                                        SHA1

                                                                                                                                                                        a4a6d3066984977813ff20e9a6daedc2dd34bb2f

                                                                                                                                                                        SHA256

                                                                                                                                                                        15096bea1d21548675da80908ca401c9d00f9f9e499f3ea2c6611a8148534104

                                                                                                                                                                        SHA512

                                                                                                                                                                        0cd40ae014775c4aaf3e3ab3b792b620fdd2c2be8fb13ed1cd9cd6e30b944a9b987fab37e410253564f0b24fec2c8ad204930acfa910bbe427e82abf313c989f

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                                                        Filesize

                                                                                                                                                                        24KB

                                                                                                                                                                        MD5

                                                                                                                                                                        e30738d93d6789672ce8e1c4bfe275a8

                                                                                                                                                                        SHA1

                                                                                                                                                                        ce2195ec1f2e3830b9a106a9dc8d7fa5397d10fc

                                                                                                                                                                        SHA256

                                                                                                                                                                        7d60046d1238ff11bdf616d83c212ad6866a7cc630ee9be8580050dee7f74832

                                                                                                                                                                        SHA512

                                                                                                                                                                        e39c9590f558477a1b823de555bf27542a725566d8bd839a1c493459444d49d755445d8ff34f59681ede12a8e654c5a7fc34b6008c9abcfd65d09f6b1b523a65

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                                                                                        Filesize

                                                                                                                                                                        83B

                                                                                                                                                                        MD5

                                                                                                                                                                        22926a273c0edff73a9e68413d2fe0ea

                                                                                                                                                                        SHA1

                                                                                                                                                                        396fa9a0e095babf0e362269fdc73a50dc8db96e

                                                                                                                                                                        SHA256

                                                                                                                                                                        cfd430961be1fc1da4492c8e925afb4de1510b23f8e0e6169b31548a7bd59de0

                                                                                                                                                                        SHA512

                                                                                                                                                                        187ba36687a56d8ada5fc37d258d12d983d3048e8cba8321b9bbfcc8a106de9f600729c9358039362f4dd75ae7971bfe3604996ff29e20e583321246f275f147

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                                                                                        Filesize

                                                                                                                                                                        79B

                                                                                                                                                                        MD5

                                                                                                                                                                        2b2f7db907b2f4355627603b194cf015

                                                                                                                                                                        SHA1

                                                                                                                                                                        926057234b0ea7a4b611d3d83227845018879603

                                                                                                                                                                        SHA256

                                                                                                                                                                        c9e451c85a832d042ed78cef03b8a2609b3f7c5bb52ee946b2b9449872be17d0

                                                                                                                                                                        SHA512

                                                                                                                                                                        45a1d586051ef5cb9cc051f7286f4aba06ae481f7e7bc4338769d7a83897806a9c2cfbfa5ef154e51353a64b3fb6811c7097c384743e7dc11d12f7a69eb3fd32

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                                                                                                                                        Filesize

                                                                                                                                                                        16B

                                                                                                                                                                        MD5

                                                                                                                                                                        46295cac801e5d4857d09837238a6394

                                                                                                                                                                        SHA1

                                                                                                                                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                        SHA256

                                                                                                                                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                        SHA512

                                                                                                                                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                                                                        Filesize

                                                                                                                                                                        96B

                                                                                                                                                                        MD5

                                                                                                                                                                        41db2c612be0eddc0db9bf70bb811fa6

                                                                                                                                                                        SHA1

                                                                                                                                                                        3b66815d7b3b6d3dae3151b500c67d112c6a4d1c

                                                                                                                                                                        SHA256

                                                                                                                                                                        862a7fee6543850fe192a9a07d679353c0e937c692e862d6d215331c27ef4f0a

                                                                                                                                                                        SHA512

                                                                                                                                                                        0a6de6530c65f50e09dde8c04d54deaab970d3096f1f5aac4a638baf9d7b34d0283777542835aeed699a986cff664891914cf8716e3539d0c47280bb7191aa9e

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594685.TMP

                                                                                                                                                                        Filesize

                                                                                                                                                                        48B

                                                                                                                                                                        MD5

                                                                                                                                                                        2ffdc2eefbc5e2e1d875b83053b0c1b9

                                                                                                                                                                        SHA1

                                                                                                                                                                        5c75bf4bea0c08be193d8796f813062937620d4a

                                                                                                                                                                        SHA256

                                                                                                                                                                        33abd4aa149b2009f2e91c5a4227235047fe4dac2090786b3d462ba4284f66f6

                                                                                                                                                                        SHA512

                                                                                                                                                                        748857c70ab904c488003ce8489e33fe4c37b1d9909592231020bed7a37bec62f1443319eb879f011ce532e5705fd5ebeb75623243eef2f953884a81b1cf0db4

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        fedf019fb0f36c5da4a89d4915552ecb

                                                                                                                                                                        SHA1

                                                                                                                                                                        ac30f8188547b9c25e7f1848f3f575fe4a0ae4ab

                                                                                                                                                                        SHA256

                                                                                                                                                                        97d3591542296c205e690debeb01ad987fc38fd865c1d7681d26010624b7ba8c

                                                                                                                                                                        SHA512

                                                                                                                                                                        31c9b67860bbd62c494d8a416e4ba641f2525430183aea38572add64d0ead954742501529d6ae8cdcc37199dda6addeb0a62a1306406fe0e403bf6a8c3f1c3eb

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        77f65ab0df04de53e9b09f5a4a2d2016

                                                                                                                                                                        SHA1

                                                                                                                                                                        a08c64b8be3963cbc40057a7e7c0beffda345a9b

                                                                                                                                                                        SHA256

                                                                                                                                                                        66362c941f30a93b8c1ab5855bbbc237c16f7d9c682a880c0785f3cc3fadbbef

                                                                                                                                                                        SHA512

                                                                                                                                                                        dd3a2130dd898849a6ef51c20ac7fd808aade0926d4495c32ca545a2351a602b77fb7a0864c6585682456bfa188c5fd6ed9b22b2edaaca123bd270d0f04c4da9

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                        Filesize

                                                                                                                                                                        3KB

                                                                                                                                                                        MD5

                                                                                                                                                                        b4da3e390ec814182483940d081705db

                                                                                                                                                                        SHA1

                                                                                                                                                                        becb18828b74f17a0d70878551eff527df92fed1

                                                                                                                                                                        SHA256

                                                                                                                                                                        8b0aa9ce51c1d955a08f8784b8680708dde51e97ffc3d8966fee9313b5ccbc4c

                                                                                                                                                                        SHA512

                                                                                                                                                                        38c76ab06119a8e36106164f03b7980394dab028feac01cd76d8858700a8d6046239ca2472646236671f4c352cc4c2376a744da060c97538b09d72ddaf76dea6

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                        Filesize

                                                                                                                                                                        3KB

                                                                                                                                                                        MD5

                                                                                                                                                                        0528e7f68ef6e61da03489d5c4cb6ca5

                                                                                                                                                                        SHA1

                                                                                                                                                                        d0b135d259e91c17c7d4f4954df22423fa577429

                                                                                                                                                                        SHA256

                                                                                                                                                                        384fb2b6e2bc0e7d2973ea0197d19de1fb7a29fcaa9e8ef34c2c713d5eae6516

                                                                                                                                                                        SHA512

                                                                                                                                                                        74588b4e11924531918964d3290967ccbb76be421019dbcafcdef692ee773c6740ec7974cc11c9a566d3414d3183a770ed5032372fd7e528a2c4692a9a0717f1

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                        Filesize

                                                                                                                                                                        3KB

                                                                                                                                                                        MD5

                                                                                                                                                                        23c11e90848f21bf0fa1c53c9a9b2d8c

                                                                                                                                                                        SHA1

                                                                                                                                                                        fec80146a24162dbea77db8f3e82c00e8db20f0c

                                                                                                                                                                        SHA256

                                                                                                                                                                        369fa12767089733258f0c3c3a3374f4200ae2b9c339d7ea0da0ca85f3a6a196

                                                                                                                                                                        SHA512

                                                                                                                                                                        98a9966bd3c2aa60875d72b0148a16704242cbb6e9e4fed8044b21ca2066c2ea0a6f699d3dc85e00f08ff2c8783248f1e94329b44ad564f36fe6ef10e25bce27

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                        Filesize

                                                                                                                                                                        3KB

                                                                                                                                                                        MD5

                                                                                                                                                                        364dafee99f39e45d353afce8c478c56

                                                                                                                                                                        SHA1

                                                                                                                                                                        9f862608876e67c56ff212dee684cc9fbecc8724

                                                                                                                                                                        SHA256

                                                                                                                                                                        df1ae4205dfed5d8ccefa555a81b34407a7763343ae5f27075fc73687a57c427

                                                                                                                                                                        SHA512

                                                                                                                                                                        6cfb143fce7520bc3c9a4bd668f55ae2bfa68d0b74c1063021ea5d06a1947748637a57429ed5f16f18284aba30d276a35e1998518179466452bd78ed1d3ce921

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                        Filesize

                                                                                                                                                                        3KB

                                                                                                                                                                        MD5

                                                                                                                                                                        014fe030ab15be1230e320939dbf9314

                                                                                                                                                                        SHA1

                                                                                                                                                                        239f8ddd5174f3585a0b858052a3e58fe6421c3e

                                                                                                                                                                        SHA256

                                                                                                                                                                        f69b5e8efa41915b0498469fc308e4f7895e5bb4ef1642c19144a90dba22db9d

                                                                                                                                                                        SHA512

                                                                                                                                                                        5c303d7bd7528ea7ee2d0b966a08abcc7f48439dcd1f29cf48a9002ad8aa6c50ed7b0c64c9f4aeaec8823f4d75c5fa4832b21b6dd8896cffde9d6d4c3c2619ca

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                        Filesize

                                                                                                                                                                        3KB

                                                                                                                                                                        MD5

                                                                                                                                                                        86f55dc4b03759ec1e8aa0997a3fb621

                                                                                                                                                                        SHA1

                                                                                                                                                                        c32671dc867de6ccaa0c0d4bf2723b8fee63424e

                                                                                                                                                                        SHA256

                                                                                                                                                                        b727f86a257d6204d3b5393beeada5a219b0cba2830a9b5d88f21ad31920ce22

                                                                                                                                                                        SHA512

                                                                                                                                                                        32ab8b444d5dded305a25e8345ba23309208082fdc99f01e64c7c19cc7094b8c75490953eeb036153b5871a6f3f092e41f9ecbf26df6df144ca09d67e1cb6345

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58586c.TMP

                                                                                                                                                                        Filesize

                                                                                                                                                                        1KB

                                                                                                                                                                        MD5

                                                                                                                                                                        1ec969350272403d3b01cbb48fb251b6

                                                                                                                                                                        SHA1

                                                                                                                                                                        d032b6020c00d9092c49a71b5defdca03bc69074

                                                                                                                                                                        SHA256

                                                                                                                                                                        cfb7ec13185de8c8f4e3f43cc7eaca29555e01da08d284fb559102bdc9eb7c1b

                                                                                                                                                                        SHA512

                                                                                                                                                                        5b232b89f11d65c67534d5f2872b57213924bb87c59a88725bdc87b518bd932ccc8d5f4fe59261e52496d4b7324568e9cab9536c6549cb41c2fd17fbce327ec1

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                        Filesize

                                                                                                                                                                        16B

                                                                                                                                                                        MD5

                                                                                                                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                        SHA1

                                                                                                                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                        SHA256

                                                                                                                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                        SHA512

                                                                                                                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                        Filesize

                                                                                                                                                                        10KB

                                                                                                                                                                        MD5

                                                                                                                                                                        95749b0f871537207c26c3304a236d79

                                                                                                                                                                        SHA1

                                                                                                                                                                        c361be8260103c33a642b05f1673bb306bf533a6

                                                                                                                                                                        SHA256

                                                                                                                                                                        4ab680a5bb7cf937229374b62b1abdc3045578130d62bdcf9f5c0675b45857d7

                                                                                                                                                                        SHA512

                                                                                                                                                                        4ef85d0d22fff5f33fc883ace918cabb15f44a3619ebfa829452023961ccab279d369623320bf71ef9e9237bebe897f75f785af6becf10f8ad7a7e724420ce3a

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        98baa8b2874cb9df97ca49e2e61ae9c4

                                                                                                                                                                        SHA1

                                                                                                                                                                        f258ad57b29ed7b1b6706172e0291077f82cb3b4

                                                                                                                                                                        SHA256

                                                                                                                                                                        8cc6a5cdb4c4fb888fb3999c951a0582cc91f7d072b92b49d5a9faab7d44c821

                                                                                                                                                                        SHA512

                                                                                                                                                                        49be455d9618b70d73a3375178a56f5b2a598a51f78a3c9c7d2ea553b6ccf231fde98785ffae8343de3540c3f64cf65e395ee5dafa8e2826e65d5d8ac2ecbd4d

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        9f0e6ddcab0c3d483c550531a4ac38d6

                                                                                                                                                                        SHA1

                                                                                                                                                                        341d82f5ca8e39ae792e7020df3891b3591cf189

                                                                                                                                                                        SHA256

                                                                                                                                                                        7cba4aa3535649d4672ad7d94e0d700042f3fe05d0225d2ffbdd555355b2c2dd

                                                                                                                                                                        SHA512

                                                                                                                                                                        0c2296fdd8977ecf4f82bd158553fc1d89f1b9cd7a443ac71a91bfb3774c40cd2fd4096cc687ebc6f61b42b53cc4eb2f8293b1bca4dc995c5829f06d6d7d3807

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        51b90d26a1cb49c9068b4fe69c1c2560

                                                                                                                                                                        SHA1

                                                                                                                                                                        e32fc4404cae6b9512ea6e007c7620eb98e4ba5c

                                                                                                                                                                        SHA256

                                                                                                                                                                        f6ca453f6d1a74b62fd2b3f62fea18031bf16c4ad7211957a214e070e3d6ebe0

                                                                                                                                                                        SHA512

                                                                                                                                                                        c59da2ec0d93be310ab4058b6a754600313c7ed20511471094278babd600ce66104ac6b5528d8b6877f59050363e5085d741bcffaea8765fd0b26e8c9f6bb7bd

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        0c33496fd75e81cbee721124fc74627d

                                                                                                                                                                        SHA1

                                                                                                                                                                        8f2e23b1951eca72d4d5aabc56c0583d1c6893fd

                                                                                                                                                                        SHA256

                                                                                                                                                                        8520d21734b2309b944cf23a3471621a50d72cc5ae25c083843d7af56f66313e

                                                                                                                                                                        SHA512

                                                                                                                                                                        ed5b6dadf376854cdf71817f0b14f19a75a4b3587116d18a630ddbffd94ed0dbb6dcc98aa2ad127568f9d1fed10f4511ed700846f3510e50a6ac98ed8ec13643

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        9c06492cdc2e14822026946f76ed9f2a

                                                                                                                                                                        SHA1

                                                                                                                                                                        18946b50ff2f872fc3a3d717033d6b74063c7ee8

                                                                                                                                                                        SHA256

                                                                                                                                                                        a6b5f78a548d9397a2edb19f21c82a1e4a7841ab03193f8b238ddb18de1b070c

                                                                                                                                                                        SHA512

                                                                                                                                                                        a29e3fb019dbceff80691e1aaf02863a2408191a46c4f9bc42b98f28084afd826bb6c32906f93a6338f2575d9033ccfd7605057d905daadd7ac97caa4cc542ed

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                        MD5

                                                                                                                                                                        67d91d7dfd2e3b4a538cb9332272e91e

                                                                                                                                                                        SHA1

                                                                                                                                                                        bc44b3caee1c81096ca085f33b7cf50e631849c2

                                                                                                                                                                        SHA256

                                                                                                                                                                        a674a3e179fdad3f5818d36a8ba0f32b6baad27e563f2daddf1f27c4601537fe

                                                                                                                                                                        SHA512

                                                                                                                                                                        009eb7e14f9434e860a847e86ca79f5caa066a927389f0bae8885d8d2b19253338c51b26886c00e07aaf26f972c708de45588e571d830701e2bf6a44e19bc547

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LQ5PG9.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        461KB

                                                                                                                                                                        MD5

                                                                                                                                                                        b106d6e790e48fe0ec2c86b3284ccae3

                                                                                                                                                                        SHA1

                                                                                                                                                                        60def57dc277a6398c582f0f6f06f0b55e2230b4

                                                                                                                                                                        SHA256

                                                                                                                                                                        67bbdbabda6635ee95eadfd5e129304198d74424d6b2508267dde229c2686dfb

                                                                                                                                                                        SHA512

                                                                                                                                                                        b901c5dc7a996c590e6f164d9ac598daca2e8d1858a118c37883876590b122bb56be21d1c2c76c4fb074ef91088b9887db25e4094405ef61ca3824dd47ffd947

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6LQ5PG9.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        733KB

                                                                                                                                                                        MD5

                                                                                                                                                                        cd9f9a498428210e9fb70709d79063b4

                                                                                                                                                                        SHA1

                                                                                                                                                                        314582b9c5f6b2ee691e0448c5f38e682bf7bef2

                                                                                                                                                                        SHA256

                                                                                                                                                                        66c5ebb03a9a39e861458a459ed6de4064a6c89cffefe6a59411e1287de0f841

                                                                                                                                                                        SHA512

                                                                                                                                                                        52e25bc109ecdc2a24dd4a23e6b9b3ae7f306611b998ebf448acc9a99a4262d8a63301543a1710ee654f11b0e45c26b318a208db7bb6c5f9389ecb3aa625476f

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Uz4oa16.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        789KB

                                                                                                                                                                        MD5

                                                                                                                                                                        cc2b35b6a0e7ea79ba9e22426def65b5

                                                                                                                                                                        SHA1

                                                                                                                                                                        ffa478850bb79bce0d33cd9912e775c5423039f0

                                                                                                                                                                        SHA256

                                                                                                                                                                        fd4aa87b3b2ef737863f64d4c690210d274d4f67552a08d0a11ffb4bef1d1d7c

                                                                                                                                                                        SHA512

                                                                                                                                                                        0fb292372beb4ca8bd7d3b29ea818947dcd7f3ca82be34de63c0d72fc9a85f03f0efeef9a218648d20dc67b87c40248bead8edfa288b2857d110b18e5548b5bd

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1By46mn9.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        1.6MB

                                                                                                                                                                        MD5

                                                                                                                                                                        af7eef9c9f90f8c0c3e2de93af516d90

                                                                                                                                                                        SHA1

                                                                                                                                                                        e21eee0871661be8f715ab5e482b1f77228021d9

                                                                                                                                                                        SHA256

                                                                                                                                                                        6aa34476f36f411b33346a93fd3b1b54d49e4138bde695cca795a3c1a7467ef2

                                                                                                                                                                        SHA512

                                                                                                                                                                        55f34ec91fdaeee0f28eff4d11cb7f09aaef9f2acc43a294bad9c0bd388648f4b22d5df2bc772b92a4e075e37a0a9eef6517fa3f2c862109c939713403b387ab

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lM545jS.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        37KB

                                                                                                                                                                        MD5

                                                                                                                                                                        9698a4775fc36edac37827571a7c593f

                                                                                                                                                                        SHA1

                                                                                                                                                                        55587ab6a391c38f0dd7aba446d72625c555f936

                                                                                                                                                                        SHA256

                                                                                                                                                                        642b50a06231fc50f477dbf2c0a39e79c65e9fd68b86222e6b56ceca7536ac79

                                                                                                                                                                        SHA512

                                                                                                                                                                        a70443b45fe0a2e682aa72092b4e7a1d803ddc5164098b59c4c19f4f30d09d5ed0d28c4bfdaf619ee035004bb52b7bde6779928d86017acb0ea6677cba1943e9

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        1.4MB

                                                                                                                                                                        MD5

                                                                                                                                                                        7d95ff2786c422490e91b4d7774ec70d

                                                                                                                                                                        SHA1

                                                                                                                                                                        937486fb8c2bfd0a25e814996165f31e065603fd

                                                                                                                                                                        SHA256

                                                                                                                                                                        1e62191715b9be43a266e9d08fe24f0c9135b89cc05fc3f07aee139b872939d1

                                                                                                                                                                        SHA512

                                                                                                                                                                        ed14d1998dc417d18aab7312925d569ea344fc7f0b91cea6d00435e05f82a672a84dde2e0a138c4a1d8a83e034039774e114bfa875bdbb173593ebb0f7864b72

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d5zhttpf.yhy.ps1

                                                                                                                                                                        Filesize

                                                                                                                                                                        60B

                                                                                                                                                                        MD5

                                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                        SHA1

                                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                        SHA256

                                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                        SHA512

                                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\grandUIAocZTYAYGouAGi\information.txt

                                                                                                                                                                        Filesize

                                                                                                                                                                        3KB

                                                                                                                                                                        MD5

                                                                                                                                                                        a9babc0460924a65ebc342e00359132e

                                                                                                                                                                        SHA1

                                                                                                                                                                        ec8ceff13527de7748513ecdd145dd1e9790a192

                                                                                                                                                                        SHA256

                                                                                                                                                                        7fcc5941bfb2e1756ceac1160e602b9e2761dc1235e96a63248aada7eaf638e7

                                                                                                                                                                        SHA512

                                                                                                                                                                        df169f1fda7b1f422e055b449025a1e1ff8bbff411b28a20e8e70d6615100140968ff1b0fc5528580ade11b0343c1e324ee521cf439bbf8f9515588f04d810ba

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        232KB

                                                                                                                                                                        MD5

                                                                                                                                                                        7cda0120b6d0c7bcae2f63abafd1432c

                                                                                                                                                                        SHA1

                                                                                                                                                                        f1493625eeb84ca07a4fd89d98c7c1c83d20a75a

                                                                                                                                                                        SHA256

                                                                                                                                                                        e70f2df99852e110d18f24aab99e367aabcbc6f1f46491e4ad57a0067960564f

                                                                                                                                                                        SHA512

                                                                                                                                                                        73e5646ab6b8759474169dbd6b559c74e6e40fcf1510b44f0de6033c29dd7ab0cdcd003e9136a56d8837818c2d97edc651ac51b394633de7ce47c93be5ae09e9

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        291KB

                                                                                                                                                                        MD5

                                                                                                                                                                        cde750f39f58f1ec80ef41ce2f4f1db9

                                                                                                                                                                        SHA1

                                                                                                                                                                        942ea40349b0e5af7583fd34f4d913398a9c3b96

                                                                                                                                                                        SHA256

                                                                                                                                                                        0a434be25f55f27ce0adbdfb08efeac1da01125b3e9194a94669bc7e9c6fe094

                                                                                                                                                                        SHA512

                                                                                                                                                                        c181faacbef70f8a91606943470af50cfd443958c48601051371ff5d9bf66bb9ec794571b05a347a7f5776f06484dc007f535591d2f5e1c57e3c0ee04f3e9580

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        382KB

                                                                                                                                                                        MD5

                                                                                                                                                                        60cbf3ed45bd3b402e060f6ea85854ea

                                                                                                                                                                        SHA1

                                                                                                                                                                        2bbfb266b7924d5ca03a6250d9377e915c3e1c0a

                                                                                                                                                                        SHA256

                                                                                                                                                                        f65af1d57d6418fa123fd5526073c05fc499690d2249841cb902731bbbad4c73

                                                                                                                                                                        SHA512

                                                                                                                                                                        391180989d16f1c7ed8b855f18d81c54d5b827189781c137e695ee122bf1aa021d12c9fb728cdeb34bc563346c5e8f04f82a4ca51c980c3399b67a6bcabb201d

                                                                                                                                                                      • memory/1416-1103-0x0000000002E40000-0x000000000372B000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        8.9MB

                                                                                                                                                                      • memory/1416-1101-0x0000000002A40000-0x0000000002E3A000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4.0MB

                                                                                                                                                                      • memory/1416-1106-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        9.1MB

                                                                                                                                                                      • memory/2404-927-0x00000000020D0000-0x00000000020D1000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                      • memory/2404-1125-0x00000000020D0000-0x00000000020D1000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                      • memory/3120-1109-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        36KB

                                                                                                                                                                      • memory/3120-1143-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        36KB

                                                                                                                                                                      • memory/3120-1105-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        36KB

                                                                                                                                                                      • memory/3300-1312-0x0000000000400000-0x000000000047E000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        504KB

                                                                                                                                                                      • memory/3300-1310-0x0000000000400000-0x000000000047E000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        504KB

                                                                                                                                                                      • memory/3300-1318-0x0000000000400000-0x000000000047E000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        504KB

                                                                                                                                                                      • memory/3340-94-0x0000000002330000-0x0000000002346000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        88KB

                                                                                                                                                                      • memory/3340-1142-0x0000000000920000-0x0000000000936000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        88KB

                                                                                                                                                                      • memory/4448-1107-0x0000000000A88000-0x0000000000A9B000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        76KB

                                                                                                                                                                      • memory/4448-1104-0x0000000000930000-0x0000000000939000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        36KB

                                                                                                                                                                      • memory/4700-92-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        44KB

                                                                                                                                                                      • memory/4700-95-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        44KB

                                                                                                                                                                      • memory/5284-1162-0x0000000007A80000-0x0000000007AB2000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        200KB

                                                                                                                                                                      • memory/5284-1157-0x0000000004F20000-0x0000000004F30000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/5284-1185-0x00000000752B0000-0x0000000075A60000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        7.7MB

                                                                                                                                                                      • memory/5284-1182-0x0000000007C60000-0x0000000007C68000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        32KB

                                                                                                                                                                      • memory/5284-1181-0x0000000007D10000-0x0000000007D2A000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        104KB

                                                                                                                                                                      • memory/5284-1180-0x0000000007C20000-0x0000000007C34000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        80KB

                                                                                                                                                                      • memory/5284-1179-0x0000000007C10000-0x0000000007C1E000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        56KB

                                                                                                                                                                      • memory/5284-1178-0x0000000007BD0000-0x0000000007BE1000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        68KB

                                                                                                                                                                      • memory/5284-1177-0x0000000007C70000-0x0000000007D06000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        600KB

                                                                                                                                                                      • memory/5284-1176-0x0000000007BB0000-0x0000000007BBA000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        40KB

                                                                                                                                                                      • memory/5284-1175-0x0000000007AC0000-0x0000000007B63000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        652KB

                                                                                                                                                                      • memory/5284-1174-0x0000000007A60000-0x0000000007A7E000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        120KB

                                                                                                                                                                      • memory/5284-1122-0x0000000004F30000-0x0000000004F66000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        216KB

                                                                                                                                                                      • memory/5284-1123-0x00000000752B0000-0x0000000075A60000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        7.7MB

                                                                                                                                                                      • memory/5284-1124-0x00000000055A0000-0x0000000005BC8000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        6.2MB

                                                                                                                                                                      • memory/5284-1164-0x000000006D270000-0x000000006D5C4000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        3.3MB

                                                                                                                                                                      • memory/5284-1127-0x0000000004F20000-0x0000000004F30000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/5284-1126-0x0000000004F20000-0x0000000004F30000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/5284-1129-0x0000000005CC0000-0x0000000005D26000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        408KB

                                                                                                                                                                      • memory/5284-1130-0x0000000005EA0000-0x0000000005F06000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        408KB

                                                                                                                                                                      • memory/5284-1163-0x000000006DA80000-0x000000006DACC000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        304KB

                                                                                                                                                                      • memory/5284-1128-0x00000000053F0000-0x0000000005412000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        136KB

                                                                                                                                                                      • memory/5284-1140-0x0000000006010000-0x0000000006364000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        3.3MB

                                                                                                                                                                      • memory/5284-1141-0x00000000064F0000-0x000000000650E000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        120KB

                                                                                                                                                                      • memory/5284-1161-0x000000007F550000-0x000000007F560000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/5284-1160-0x00000000078C0000-0x00000000078DA000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        104KB

                                                                                                                                                                      • memory/5284-1156-0x0000000007470000-0x00000000074B4000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        272KB

                                                                                                                                                                      • memory/5284-1159-0x0000000007F20000-0x000000000859A000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        6.5MB

                                                                                                                                                                      • memory/5284-1158-0x0000000007820000-0x0000000007896000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        472KB

                                                                                                                                                                      • memory/5340-1190-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        3.5MB

                                                                                                                                                                      • memory/5340-1186-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        3.5MB

                                                                                                                                                                      • memory/5340-1084-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        3.5MB

                                                                                                                                                                      • memory/5380-888-0x0000000000B40000-0x0000000000B41000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                      • memory/5380-1110-0x0000000000B40000-0x0000000000B41000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                      • memory/5484-904-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        80KB

                                                                                                                                                                      • memory/5484-1121-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        80KB

                                                                                                                                                                      • memory/7892-1328-0x00007FF6FC650000-0x00007FF6FCBF1000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        5.6MB

                                                                                                                                                                      • memory/7940-1078-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        3.5MB

                                                                                                                                                                      • memory/7940-1065-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        3.5MB

                                                                                                                                                                      • memory/8048-860-0x0000000007520000-0x0000000007530000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/8048-868-0x00000000029C0000-0x00000000029CA000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        40KB

                                                                                                                                                                      • memory/8048-877-0x0000000008520000-0x0000000008B38000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        6.1MB

                                                                                                                                                                      • memory/8048-889-0x00000000075B0000-0x00000000075FC000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        304KB

                                                                                                                                                                      • memory/8048-887-0x0000000007570000-0x00000000075AC000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        240KB

                                                                                                                                                                      • memory/8048-885-0x0000000007500000-0x0000000007512000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        72KB

                                                                                                                                                                      • memory/8048-884-0x00000000076E0000-0x00000000077EA000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        1.0MB

                                                                                                                                                                      • memory/8048-1108-0x0000000007520000-0x0000000007530000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/8048-1102-0x00000000752B0000-0x0000000075A60000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        7.7MB

                                                                                                                                                                      • memory/8048-859-0x0000000004E30000-0x0000000004EC2000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        584KB

                                                                                                                                                                      • memory/8048-858-0x0000000007950000-0x0000000007EF4000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        5.6MB

                                                                                                                                                                      • memory/8048-855-0x00000000004D0000-0x000000000050C000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        240KB

                                                                                                                                                                      • memory/8048-856-0x00000000752B0000-0x0000000075A60000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        7.7MB

                                                                                                                                                                      • memory/8072-852-0x0000000000FA0000-0x0000000002456000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        20.7MB

                                                                                                                                                                      • memory/8072-851-0x00000000752B0000-0x0000000075A60000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        7.7MB

                                                                                                                                                                      • memory/8072-928-0x00000000752B0000-0x0000000075A60000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        7.7MB