Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2023, 04:31

General

  • Target

    c98e8ff8ff04152c062fb39408e19e05.exe

  • Size

    238KB

  • MD5

    c98e8ff8ff04152c062fb39408e19e05

  • SHA1

    498ba2ac5a1a2de316afafda6ab6c80d9b8ddeef

  • SHA256

    feeabd0ec12dfa5f3262e130908a56008d76ef32eb406a72762707bca9331eb9

  • SHA512

    b0d097bd6b45a03c1f7cd1c213c5235c7e04bf9fe96438b6a0e36eefb1b8da86cc4308f7b2462a06126c49a2276fda57696ecdbc1de1dcc5dd09700bf81fa4e9

  • SSDEEP

    3072:QHFS5nO3zlGZ0y/xz34XNUbXw2aIJOIGVRnww9mw7qKKtrjqR9A8GkZ5OeTC4L:hnO3zlU58QAEO/Pnww9z9KVe1Gk3T

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://zexeq.com/test1/get.php

Attributes
  • extension

    .hhuy

  • offline_id

    gG3wF8nDWRqLztkHPAxMzpvNVlmLBMgQKmKiCNt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://zexeq.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-5zKXJl7cwi Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0834ASdw

rsa_pubkey.plain

Extracted

Family

risepro

C2

193.233.132.51

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Detect ZGRat V1 27 IoCs
  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • .NET Reactor proctector 6 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 17 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 61 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
    "C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
      "C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2020
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B769.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
      2⤵
        PID:3700
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B9CB.bat" "
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Windows\system32\reg.exe
        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
        2⤵
          PID:1572
      • C:\Users\Admin\AppData\Local\Temp\C323.exe
        C:\Users\Admin\AppData\Local\Temp\C323.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        PID:4756
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          2⤵
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:6612
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718
            3⤵
              PID:3456
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2328 /prefetch:8
              3⤵
                PID:6932
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                3⤵
                  PID:5364
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
                  3⤵
                    PID:5380
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
                    3⤵
                      PID:6924
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
                      3⤵
                        PID:4956
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
                        3⤵
                          PID:6412
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
                          3⤵
                            PID:6388
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
                            3⤵
                              PID:4780
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
                              3⤵
                                PID:3080
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
                                3⤵
                                  PID:1172
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:8
                                  3⤵
                                    PID:1380
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:8
                                    3⤵
                                      PID:4108
                                • C:\Users\Admin\AppData\Local\Temp\D66D.exe
                                  C:\Users\Admin\AppData\Local\Temp\D66D.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of WriteProcessMemory
                                  PID:740
                                  • C:\Users\Admin\AppData\Local\Temp\D66D.exe
                                    C:\Users\Admin\AppData\Local\Temp\D66D.exe
                                    2⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of WriteProcessMemory
                                    PID:4764
                                    • C:\Windows\SysWOW64\icacls.exe
                                      icacls "C:\Users\Admin\AppData\Local\dd8032d2-9f19-4b6f-908f-0ed659910701" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                      3⤵
                                      • Modifies file permissions
                                      PID:4144
                                    • C:\Users\Admin\AppData\Local\Temp\D66D.exe
                                      "C:\Users\Admin\AppData\Local\Temp\D66D.exe" --Admin IsNotAutoStart IsNotTask
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of WriteProcessMemory
                                      PID:4388
                                      • C:\Users\Admin\AppData\Local\Temp\D66D.exe
                                        "C:\Users\Admin\AppData\Local\Temp\D66D.exe" --Admin IsNotAutoStart IsNotTask
                                        4⤵
                                        • Executes dropped EXE
                                        PID:5048
                                • C:\Users\Admin\AppData\Local\Temp\DF58.exe
                                  C:\Users\Admin\AppData\Local\Temp\DF58.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:808
                                  • C:\Users\Admin\AppData\Local\Temp\DF58.exe
                                    C:\Users\Admin\AppData\Local\Temp\DF58.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:1600
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5048 -ip 5048
                                  1⤵
                                    PID:1960
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 568
                                    1⤵
                                    • Program crash
                                    PID:4740
                                  • C:\Users\Admin\AppData\Local\Temp\EB30.exe
                                    C:\Users\Admin\AppData\Local\Temp\EB30.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2416
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 1220
                                      2⤵
                                      • Program crash
                                      PID:6232
                                  • C:\Users\Admin\AppData\Local\Temp\F2E2.exe
                                    C:\Users\Admin\AppData\Local\Temp\F2E2.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of WriteProcessMemory
                                    PID:1432
                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe
                                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Suspicious use of WriteProcessMemory
                                      PID:4796
                                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe
                                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • Checks SCSI registry key(s)
                                        • Suspicious behavior: MapViewOfSection
                                        PID:6508
                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe
                                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe
                                      2⤵
                                      • Drops startup file
                                      • Executes dropped EXE
                                      • Accesses Microsoft Outlook profiles
                                      • Adds Run key to start application
                                      • Drops file in System32 directory
                                      • Checks processor information in registry
                                      • outlook_office_path
                                      • outlook_win_path
                                      PID:7128
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                        3⤵
                                        • Creates scheduled task(s)
                                        PID:5440
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                        3⤵
                                        • Creates scheduled task(s)
                                        PID:4928
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 1780
                                        3⤵
                                        • Program crash
                                        PID:5436
                                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe
                                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of WriteProcessMemory
                                    PID:560
                                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe
                                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of WriteProcessMemory
                                      PID:2944
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                        3⤵
                                        • Enumerates system info in registry
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:1268
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718
                                          4⤵
                                            PID:4864
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
                                            4⤵
                                              PID:4136
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
                                              4⤵
                                                PID:1096
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                                                4⤵
                                                  PID:3280
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
                                                  4⤵
                                                    PID:1352
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
                                                    4⤵
                                                      PID:1848
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
                                                      4⤵
                                                        PID:5136
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2428 /prefetch:1
                                                        4⤵
                                                          PID:5532
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1
                                                          4⤵
                                                            PID:5680
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
                                                            4⤵
                                                              PID:5820
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                                                              4⤵
                                                                PID:6040
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
                                                                4⤵
                                                                  PID:6076
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
                                                                  4⤵
                                                                    PID:5808
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
                                                                    4⤵
                                                                      PID:5944
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
                                                                      4⤵
                                                                        PID:6220
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
                                                                        4⤵
                                                                          PID:6448
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
                                                                          4⤵
                                                                            PID:6528
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                                                                          3⤵
                                                                            PID:3524
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718
                                                                              4⤵
                                                                                PID:964
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,2886089277515987251,9168032825719720703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
                                                                                4⤵
                                                                                  PID:5184
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                                3⤵
                                                                                  PID:4040
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718
                                                                                    4⤵
                                                                                      PID:4576
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                                                                                    3⤵
                                                                                      PID:3736
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718
                                                                                        4⤵
                                                                                          PID:2288
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                                                                        3⤵
                                                                                          PID:1396
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718
                                                                                            4⤵
                                                                                              PID:3556
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                                            3⤵
                                                                                              PID:5768
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718
                                                                                                4⤵
                                                                                                  PID:5812
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                                3⤵
                                                                                                  PID:5576
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718
                                                                                                    4⤵
                                                                                                      PID:5792
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                                                    3⤵
                                                                                                      PID:6016
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                                      3⤵
                                                                                                        PID:5968
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718
                                                                                                          4⤵
                                                                                                            PID:5692
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                                                          3⤵
                                                                                                            PID:6172
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x80,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718
                                                                                                              4⤵
                                                                                                                PID:6272
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe
                                                                                                            2⤵
                                                                                                            • Modifies Windows Defender Real-time Protection settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Windows security modification
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:6260
                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:5568
                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:5692
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718
                                                                                                              1⤵
                                                                                                                PID:6068
                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:2216
                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:6712
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                    1⤵
                                                                                                                      PID:7020
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                      1⤵
                                                                                                                        PID:6396
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7128 -ip 7128
                                                                                                                        1⤵
                                                                                                                          PID:5224
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2416 -ip 2416
                                                                                                                          1⤵
                                                                                                                            PID:2988
                                                                                                                          • C:\Users\Admin\AppData\Local\AceFlags\oqababl\ContextProperties.exe
                                                                                                                            C:\Users\Admin\AppData\Local\AceFlags\oqababl\ContextProperties.exe
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            PID:5380
                                                                                                                            • C:\Users\Admin\AppData\Local\AceFlags\oqababl\ContextProperties.exe
                                                                                                                              C:\Users\Admin\AppData\Local\AceFlags\oqababl\ContextProperties.exe
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4876

                                                                                                                          Network

                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                                                                                            Filesize

                                                                                                                            1KB

                                                                                                                            MD5

                                                                                                                            3e61f1b5c83d57794fb57876a8ce4886

                                                                                                                            SHA1

                                                                                                                            d69fb46fde92526ba21a2ee39d9b98445310a71f

                                                                                                                            SHA256

                                                                                                                            44c1f59f48fca1dbbcb999232154f060a74d760bdb510accace016de59ed4233

                                                                                                                            SHA512

                                                                                                                            1bc86558d62a6730c2ab9b2382d68b5b35feef499b489c595ffc9fc4b776d63c0f23afcaef91b008bee22145d92067c7344d2f45ecc8d78d5bbe64ac1b2a1cdb

                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                                                                                            Filesize

                                                                                                                            410B

                                                                                                                            MD5

                                                                                                                            7dbb296dadd0f058e3aaafc85a9d7524

                                                                                                                            SHA1

                                                                                                                            e2bbe1bd4ca6fa71eb9f2f4c8309c139cdc1bbec

                                                                                                                            SHA256

                                                                                                                            8fb2661ec6a94139cbe64bcf4da97ccd5131cfc367dbc7b333b421639a40ec40

                                                                                                                            SHA512

                                                                                                                            aa16865c2dd0e7a9ed7fde87a7065c1021ea35188e0de0ebe8bccb8db8832fde5e93ec3a7b66c38a182c8a2150546ee6b7f8428cc9652d8a19c1159bdb7e8ae1

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                            Filesize

                                                                                                                            152B

                                                                                                                            MD5

                                                                                                                            7ee07b80c55c972f8fdcc56d4129733a

                                                                                                                            SHA1

                                                                                                                            4b24307850f55f31d1b87b7798b3b29c1edf46d1

                                                                                                                            SHA256

                                                                                                                            5e694fe488825cd3af0ff4d9096b0900ff822ea1319a426c147e1c79562347b6

                                                                                                                            SHA512

                                                                                                                            76857e8a8117946f6172af72cab8c4aa58f58c1d5d27649fa18101692907397c1ffce2de6557f57ff6fd4c767c27d439849c618d4910b028bc5ea3cfe98cb495

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                            Filesize

                                                                                                                            152B

                                                                                                                            MD5

                                                                                                                            e5c27b4a4d5a3c9c60ba18cb867266e3

                                                                                                                            SHA1

                                                                                                                            dea55f1d4cdc831f943f4e56f4f8e9a926777600

                                                                                                                            SHA256

                                                                                                                            860ed0acc83eb0096cc8911725e2c631ff879ad8c35854577651af502c4b69c9

                                                                                                                            SHA512

                                                                                                                            56eda28e9c61e8081dadc220d23e7bb3320a9ba557eb7511d17a3d2836aa61f301d1d714a3d611eedd7c4b91886c790af7366b01acdb3b637f3dc4fb024f3f6b

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61401a62-fab6-4d83-ba10-424b7fe83620.tmp

                                                                                                                            Filesize

                                                                                                                            5KB

                                                                                                                            MD5

                                                                                                                            d44e2ebfacbda456cbe5e9afb8cd8ec4

                                                                                                                            SHA1

                                                                                                                            5d6533ad3a2bde32a45ec26e0bbbbb328ac492bc

                                                                                                                            SHA256

                                                                                                                            c14290832768aa3abf494e16c7478c1ebba626ad9c33098596fea04c86d2b9d3

                                                                                                                            SHA512

                                                                                                                            531904778dbe0783f2089582776d791fc98f70508fa77da2c288034593e2dea53944c4403f8dd52c32a0408fc9e7a9951da9983c77e5fa87c72ecd598b677394

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal

                                                                                                                            Filesize

                                                                                                                            14KB

                                                                                                                            MD5

                                                                                                                            39b7c2536ef3619f381f98922a40aee1

                                                                                                                            SHA1

                                                                                                                            579659030fa4ffe085e38766e95b2b63b5f7ea0a

                                                                                                                            SHA256

                                                                                                                            907f6f69ea7f0ac924485cd33c337a8efd40c11d7c915d6f5b6e6be001309fba

                                                                                                                            SHA512

                                                                                                                            bb0aafaee55da0b801bd92a9e88cbee5b64fee1ab7dcf8621dad3c42244ca35363fb5b61eb2f5fcf9c5929e5d173a576cbaec337432c81a574cce6bc3143d5fa

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

                                                                                                                            Filesize

                                                                                                                            28KB

                                                                                                                            MD5

                                                                                                                            f453cde2367807df0a452cc2891814bd

                                                                                                                            SHA1

                                                                                                                            29833b82a96fa84724507b5f89ca03e8a0bbb5e6

                                                                                                                            SHA256

                                                                                                                            f14ea17ecea0740d5b7674fdab8df6205bf89773a0534214e0a439109bf45035

                                                                                                                            SHA512

                                                                                                                            508648965ae5c06b6c3ccb257b69d00bb512425d0d1ec6b40e7d257921af3e5e597ef4a1f0b5f9222312bbc3bd6e766d6c2fb9e7a518783e8a072e171d94e3d8

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                            Filesize

                                                                                                                            111B

                                                                                                                            MD5

                                                                                                                            285252a2f6327d41eab203dc2f402c67

                                                                                                                            SHA1

                                                                                                                            acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                            SHA256

                                                                                                                            5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                            SHA512

                                                                                                                            11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                            Filesize

                                                                                                                            5KB

                                                                                                                            MD5

                                                                                                                            dc1e433c1609f1f0215b2df2844524ec

                                                                                                                            SHA1

                                                                                                                            729c8de60e59c584e1a22f01dc3602447b848b7f

                                                                                                                            SHA256

                                                                                                                            90285c031bf8a37098d4860f9160cc512405ce64a1a2a4b49fd181017a84ce5c

                                                                                                                            SHA512

                                                                                                                            55cc14a1549c17e6da92e072c813cc58ee8973386b63ef729f5611020eeff26c972e1c9e93b3336968add1a54cab47e349a52184d03f332c39dae73ef15622d1

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                            Filesize

                                                                                                                            5KB

                                                                                                                            MD5

                                                                                                                            46b95103da3b7301cb24c9a11b0f2384

                                                                                                                            SHA1

                                                                                                                            10935f9ac19a553815734e78c68af4280452ea71

                                                                                                                            SHA256

                                                                                                                            6399c2554073dba13a7359f6d0b880f315a2374440a7fed6000e6dc032a0ebee

                                                                                                                            SHA512

                                                                                                                            11525501e1273b71ea945ae8689be534b914c3e729f2d5ef94b3b6962ef6341d16373f83789be1806255caa43138fd4f7488e1cddf3b4e50cc281afc5e5d764e

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                            Filesize

                                                                                                                            24KB

                                                                                                                            MD5

                                                                                                                            e30738d93d6789672ce8e1c4bfe275a8

                                                                                                                            SHA1

                                                                                                                            ce2195ec1f2e3830b9a106a9dc8d7fa5397d10fc

                                                                                                                            SHA256

                                                                                                                            7d60046d1238ff11bdf616d83c212ad6866a7cc630ee9be8580050dee7f74832

                                                                                                                            SHA512

                                                                                                                            e39c9590f558477a1b823de555bf27542a725566d8bd839a1c493459444d49d755445d8ff34f59681ede12a8e654c5a7fc34b6008c9abcfd65d09f6b1b523a65

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                                                            Filesize

                                                                                                                            323B

                                                                                                                            MD5

                                                                                                                            5bb09788c9541ba2d13fa1729fcf1160

                                                                                                                            SHA1

                                                                                                                            650626af286f93e2a92930dd45fbcab95101af2a

                                                                                                                            SHA256

                                                                                                                            c0c89f1301f81cf2639f9d5fedc9cab8fafc6d3bd2d5cf4711cb5f42a9511c47

                                                                                                                            SHA512

                                                                                                                            bb20ca5b2f07756e697c5c9955f186727df41fedd29a489540acf0091e4b6a7da9a010001a43071c3b229947ad0678d1ddaf3755e7059ed471d34c6debfc563a

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            MD5

                                                                                                                            4131fb09888f94509ef8d8cf7fd13566

                                                                                                                            SHA1

                                                                                                                            af7a348603f16b8ca5eef5d7dbf0b68062285400

                                                                                                                            SHA256

                                                                                                                            72f19c27e8253d51fc32941370ea6fe2f6b649e2dd3f5e52df3bd8ca8ec15780

                                                                                                                            SHA512

                                                                                                                            fd0712ee9be1cdeccb4255149fd904f7eb5c967a80ee6ed92a25a48c125ef63236b1649d14084768e5235b97d471000bd3d88a4cc8f5831177ebf77ca4d33ecb

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                            Filesize

                                                                                                                            16B

                                                                                                                            MD5

                                                                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                                                                            SHA1

                                                                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                            SHA256

                                                                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                            SHA512

                                                                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                                                            Filesize

                                                                                                                            11B

                                                                                                                            MD5

                                                                                                                            838a7b32aefb618130392bc7d006aa2e

                                                                                                                            SHA1

                                                                                                                            5159e0f18c9e68f0e75e2239875aa994847b8290

                                                                                                                            SHA256

                                                                                                                            ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                                                                                                                            SHA512

                                                                                                                            9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                            Filesize

                                                                                                                            10KB

                                                                                                                            MD5

                                                                                                                            a9ff728b9ea310d06daacb6f957cd1f2

                                                                                                                            SHA1

                                                                                                                            7f79e12ac73eb9255feceb048c34f238857657f7

                                                                                                                            SHA256

                                                                                                                            d2106c7b7c2e8d684762a09cf66131e6b815ee9c92e4c19437590e99daddf5ec

                                                                                                                            SHA512

                                                                                                                            ffbc06dc78beb5d707b93291d06455ea425560e7477da43cdd2fc9ffcafad884be352392f1b64a243b44860b175b25d958ae61b66795d92b279f231a9a9c1150

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            e3936bdf35c1e26def3effb316e9b419

                                                                                                                            SHA1

                                                                                                                            79223aedf4a08bc22448493ce46841961f5c6791

                                                                                                                            SHA256

                                                                                                                            4584bd1815d9476f80aa6032992e791f966102003ca05f51b977b2887faa63be

                                                                                                                            SHA512

                                                                                                                            11f6dd3e352433ebb113751dc5505d679fda308a0279fd930f635f727396528690a9a536b578122a3bfb10b80e2fa513f2d27464296e6b4066f6bdca9230c744

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\B769.bat

                                                                                                                            Filesize

                                                                                                                            77B

                                                                                                                            MD5

                                                                                                                            55cc761bf3429324e5a0095cab002113

                                                                                                                            SHA1

                                                                                                                            2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                                                                                            SHA256

                                                                                                                            d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                                                                                            SHA512

                                                                                                                            33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C323.exe

                                                                                                                            Filesize

                                                                                                                            342KB

                                                                                                                            MD5

                                                                                                                            70e4d975f15d4933da2e2e4772523883

                                                                                                                            SHA1

                                                                                                                            bd36fb823e470883efcb0ae955634f552cf9556c

                                                                                                                            SHA256

                                                                                                                            e6934d21a8f4d72eac7cadb2f5d3b9b8d7ece47118cbb96a23faefce4c2787ce

                                                                                                                            SHA512

                                                                                                                            ea6db17a7640a2b90d6d5ca5e129632abad6eaa125a8d309534e0b07c72b2da82b45494c9a6f368e1bad6cb93030c7f7d4bbe2c476c7eb1f500bb3549bddd236

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C323.exe

                                                                                                                            Filesize

                                                                                                                            630KB

                                                                                                                            MD5

                                                                                                                            d2e51964c34d7b0572f90ad3c496466e

                                                                                                                            SHA1

                                                                                                                            fedcf11c7f18b3c6e0e53d7c6bfe0584d3fb073a

                                                                                                                            SHA256

                                                                                                                            186023e6180f0e2c51a519427362bfae15708257f2744604477c7c30311716e3

                                                                                                                            SHA512

                                                                                                                            b3affe943b692b7d9406353d59f1e876117f0583be6fc4b08a09c20e2838d2d5c22472e1f792db47d9eb4c36c5541b15acf0ee02cd9090c5316cb9d09042fb63

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\D66D.exe

                                                                                                                            Filesize

                                                                                                                            703KB

                                                                                                                            MD5

                                                                                                                            454440503db62af8520be0827389df6a

                                                                                                                            SHA1

                                                                                                                            473f9a477bdb8a408e7fad05e858dbbaa76f1dda

                                                                                                                            SHA256

                                                                                                                            b816a1f49cf7a431b9c23d32cb60eb6bae72d88b23b19a861e5f690488b00d57

                                                                                                                            SHA512

                                                                                                                            6c7f3847a00033394f5b8adb1fadb177b6103ccd6a9205dd2dad45e550805a0cf8295df2353bbf62ce9e629c3218e6c44621f716ebef23931b34ba4102debc15

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\D66D.exe

                                                                                                                            Filesize

                                                                                                                            592KB

                                                                                                                            MD5

                                                                                                                            a99b339b78da4b4c8b8db75fafabfb0b

                                                                                                                            SHA1

                                                                                                                            83f65ab67f97e36362376bcf51360188ce381c18

                                                                                                                            SHA256

                                                                                                                            fb755d4e0893611c4ce3bc56309a2a80cdf9adff782d7f3f10a4948f1f4f511c

                                                                                                                            SHA512

                                                                                                                            76fcec8b4ceac23950582da271a7acac2af7578f56c0e979718d02002ba9d9c18dff832bb1a2f49a8c84ad8d1fe0951e57024fb80758cde313cc516b591fbd45

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\D66D.exe

                                                                                                                            Filesize

                                                                                                                            73KB

                                                                                                                            MD5

                                                                                                                            79d5f69113af1d589e36929bc3d5fe22

                                                                                                                            SHA1

                                                                                                                            66774180d78f74e07d7ee11a4fad1d107f24c545

                                                                                                                            SHA256

                                                                                                                            9a138db343ad3bab20bc20108957de668216e29313712101f5b374e5024f24f1

                                                                                                                            SHA512

                                                                                                                            9b41988e9aedb6595440aea1eb3c7410ba280355ee54b3b05759b93b43094913fb1016e6a43e414f7264452f00a4b33a9fe078f3839f6c4a2b793f9178a4fd4b

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\D66D.exe

                                                                                                                            Filesize

                                                                                                                            212KB

                                                                                                                            MD5

                                                                                                                            14405897240db0a621e2bdf8e0751aad

                                                                                                                            SHA1

                                                                                                                            9ce03a5290c7571ac196b9a311a07cf4244090b2

                                                                                                                            SHA256

                                                                                                                            506d22e07b9c4ac24a57b693deaa7158f72c904d221e5ef7d3710911c7a38a37

                                                                                                                            SHA512

                                                                                                                            044ed9cb6247025956f20002f0a13017cf966102d851b20610b13f5145276889257716edfe1f1d5f14e7384091d9204991e7805317c87f71dc2e48530c705bd5

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DF58.exe

                                                                                                                            Filesize

                                                                                                                            340KB

                                                                                                                            MD5

                                                                                                                            489cff10aa13658719dadd92187b70c0

                                                                                                                            SHA1

                                                                                                                            27aa602226af41d3a79f4e3365f90b402c4ed9f5

                                                                                                                            SHA256

                                                                                                                            aaaf003879e29c3ae3c10502313ecee2e2d04c4dd4e947863345624e171ef40d

                                                                                                                            SHA512

                                                                                                                            330a44eb1ba08b77903bf5c58aa38bff82b00ce4f00084d7de082c58a1a079f7b7cbbbac7b7f7577fa68f5e35854ff2a76206bd3f0bb31d6b72f124b485c1ea8

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DF58.exe

                                                                                                                            Filesize

                                                                                                                            311KB

                                                                                                                            MD5

                                                                                                                            20ccaf9d91a78a59c086d53e22a7bb6c

                                                                                                                            SHA1

                                                                                                                            4b3c875227bbeb4742b2633e0e93e83e1634f6a5

                                                                                                                            SHA256

                                                                                                                            359eb7858b4c873b7dee6fa8b9d19b4f58c6e9bbf4c323dd44e962ba783b2fd0

                                                                                                                            SHA512

                                                                                                                            fdf33ed9812d49baa2c4fdc3ced2d3c5470ec8f5510744633fbd7b9b272bb09715eabf05326059e2169803ca01a36cf906a577fad55fd085aa79f03950626b75

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\EB30.exe

                                                                                                                            Filesize

                                                                                                                            258KB

                                                                                                                            MD5

                                                                                                                            8a6a030b76420293e06eb991d9c2ac18

                                                                                                                            SHA1

                                                                                                                            bddb19ec73fce6989848e3ac3dbcbbbec80dde0c

                                                                                                                            SHA256

                                                                                                                            3104772921fe88ca534cd942dd78930127792b34e8406e6d748d6be47e0450ef

                                                                                                                            SHA512

                                                                                                                            5fb1ed6b48ea9143d4070b814301950c192ee6de36c64d94e26a2e4e08ebcb59b00c499350736f93e33715bb4ab6ac866330cfcdda38ed5bed202d0f0fe64e12

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\EB30.exe

                                                                                                                            Filesize

                                                                                                                            290KB

                                                                                                                            MD5

                                                                                                                            cfb853c31d54e2979f33f9786cf568e4

                                                                                                                            SHA1

                                                                                                                            07513be8c48e8ac035f10f7e7802f2f9e0a04426

                                                                                                                            SHA256

                                                                                                                            d690eb2918fcac3fa38e251dd34c51332ba70ae726d1e3ba5141a4250879869f

                                                                                                                            SHA512

                                                                                                                            a6609ed1f25028cd6b1131e99411bae2bf17b025f586ccd04b5e1bfe7be5ebb98c52fc9048e217d8da519468d6abdefcf7cb462a108739dc3963a3e696115298

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\F2E2.exe

                                                                                                                            Filesize

                                                                                                                            92KB

                                                                                                                            MD5

                                                                                                                            8c155067b5c9b4b4b26ba3a4b3818033

                                                                                                                            SHA1

                                                                                                                            b5abbe1264f97b845c1029861cd19f8ec35d5d8a

                                                                                                                            SHA256

                                                                                                                            f2e490c03d65ecdd3e3c07d36f58cc7840d14f1adb60e875c445d87504aca9f6

                                                                                                                            SHA512

                                                                                                                            f84e61a78889fe60d84c631491d042a37da1d11bde56e368ffdf446a23554dc8b53085d4b091622033ea18fbd48a642d2bcbdd0747baa3c05a8a02874e85debd

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\F2E2.exe

                                                                                                                            Filesize

                                                                                                                            136KB

                                                                                                                            MD5

                                                                                                                            c22c92b2213c34bd3099cb624a2d2654

                                                                                                                            SHA1

                                                                                                                            d760ca6d47d6e0fa748e782bf3ed4f96e49e42a9

                                                                                                                            SHA256

                                                                                                                            9024d30357b911eed2eaf58cb247a6b5a4f4f6fd001f75fa5fcab0e52e6cc10c

                                                                                                                            SHA512

                                                                                                                            d4276bd118c636b65db2679214938ceee757054a41b51c92f4ebe8e9fadf05453fc9cc101837f87760520dd35eaaedb3f40ee8cad51724bd1dcd0e1d3efb932b

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                                            Filesize

                                                                                                                            934KB

                                                                                                                            MD5

                                                                                                                            6abd6ed23a406a48aa439134f5d32301

                                                                                                                            SHA1

                                                                                                                            918ae7d9e51608a2cdc65ed1adc4833bda84deb1

                                                                                                                            SHA256

                                                                                                                            f99a06a609b21d922eec4a897e2078ad334df11bac719049862fd64d7a8a5ed5

                                                                                                                            SHA512

                                                                                                                            3f089a6ef5b72462742e3bedda5596434bb5ea27c9fa12ae16f95af8402b8b7fad82bb200b3ba44b1f82c3b0cd9cce990d0d5890d8ae8918e4d4e230ad524750

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

                                                                                                                            Filesize

                                                                                                                            147KB

                                                                                                                            MD5

                                                                                                                            2c60868fd3ba715c67fb11bbab61f485

                                                                                                                            SHA1

                                                                                                                            0f057bdca748cd011fe5b8e0002a57631c0ef1be

                                                                                                                            SHA256

                                                                                                                            bc5b5adf3286e620a47806a692a917141bd8e0378fbff8ca73d4dfcf4812ef04

                                                                                                                            SHA512

                                                                                                                            c8f222f7d1d324002a6dccc00606dfdbb21e5e770799ec838328dbbcf93e186751eab0dea399f840e3ff195a71c9c48239a781514f0860e835424e9b45b8d933

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

                                                                                                                            Filesize

                                                                                                                            77KB

                                                                                                                            MD5

                                                                                                                            12ff7a3ef2a3b88706fb58c7feda73de

                                                                                                                            SHA1

                                                                                                                            1ca23327274e573f510a898c361c965e1581de04

                                                                                                                            SHA256

                                                                                                                            76522bf4426b1dc477c6a14a0e2fde2580b50fdecb8f1a861d508d3e0ce11b78

                                                                                                                            SHA512

                                                                                                                            b03412ce57ab34f9563448346e35a92321f6a4b5670ebd15c95dce9a98dd06532245bb554277e2b7757ea8694ce0dded05c57c5074effb62b7c961216d54efe4

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe

                                                                                                                            Filesize

                                                                                                                            38KB

                                                                                                                            MD5

                                                                                                                            9ac2d409d53ee85ceb60058a8bcc33d9

                                                                                                                            SHA1

                                                                                                                            2dc44451f40097305f330d7fc51f6dbf39c8465c

                                                                                                                            SHA256

                                                                                                                            871cfada7e4391fdbb6bb8aaff7adf6bd1e4c30699f6bc0f6be4606256cddbfd

                                                                                                                            SHA512

                                                                                                                            3585e04d38e4d359321e7793e2db93ca29d6784a768466c97fa92f443dc8eec403d4267e812c4775394af1ac84a009c580ecb4e4d0ab7b986ab31ef75c403534

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

                                                                                                                            Filesize

                                                                                                                            212KB

                                                                                                                            MD5

                                                                                                                            18f22f6769d72a82cd2f08150157dcdd

                                                                                                                            SHA1

                                                                                                                            8c14398b66fb5aa0c84d807636cb66e2c565ed68

                                                                                                                            SHA256

                                                                                                                            49909a5b1190b08648c4115bd8e88c8efb005ff7f31273f46b77d8d3cc85be1b

                                                                                                                            SHA512

                                                                                                                            52200816592c72c7aa483852e8add90eb1efc6b8abdb66b39a9086539789f52ab8f4430e8901a7ce8386555af1161bc00ae695dd8c678e2967bd24f7cf6ba9f0

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

                                                                                                                            Filesize

                                                                                                                            87KB

                                                                                                                            MD5

                                                                                                                            1263e6b198d4a20f570074cee23cce4d

                                                                                                                            SHA1

                                                                                                                            9cd9a1865feec0c2470738d0290de0e031f6141e

                                                                                                                            SHA256

                                                                                                                            e8600c33ad435ceeea03e0ac870c703fded5f928cf645651445e8fa3fb69bb1a

                                                                                                                            SHA512

                                                                                                                            12a0dc7671deb15a39aa58d478a9c33b26bec87ae1521a0f47dbd81509452da6b6366a6ba812e37046c2d7ef9114507ebc87f0912612657fc3560bf3fbd5dff7

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

                                                                                                                            Filesize

                                                                                                                            176KB

                                                                                                                            MD5

                                                                                                                            c71139dbb3a5a7cdd21a6faaa86d35e1

                                                                                                                            SHA1

                                                                                                                            ab8f23d4c689536c2ac331477abe3cf48a689426

                                                                                                                            SHA256

                                                                                                                            f943626c5ddf1d6f121ef90c0ee2124c36ce6f747cae9447952cd542d4f0caca

                                                                                                                            SHA512

                                                                                                                            80ed898acaf98a716b868816021968ff3b7bc0eb4ea45bda3b1d98ca2acf3f13905f9b4e43d6fc418d34ff8d97ad4b471d657519915ffd98fe9c9ebd7a0d25c2

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

                                                                                                                            Filesize

                                                                                                                            94KB

                                                                                                                            MD5

                                                                                                                            e851174f45457b44a92ea796a05378d4

                                                                                                                            SHA1

                                                                                                                            65128a993d07867eb080d8f0410263e86d5b7056

                                                                                                                            SHA256

                                                                                                                            e914efa498c98cfdb9b2661e9bc3416bc5b9671a1840712d7fcfabc09252689e

                                                                                                                            SHA512

                                                                                                                            f0765bf9a8a02eb2ca15ae5fa1766df4c3762d33a8f622d7e05ad29b5b37ad59818dfd8f348d03e93c8cfc77e01a591c3c7cc84b3d78a59ec42e7383268374aa

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe

                                                                                                                            Filesize

                                                                                                                            182KB

                                                                                                                            MD5

                                                                                                                            e829279ff2ce0d314b41aefca27d810b

                                                                                                                            SHA1

                                                                                                                            10460cba71726efed02901fffe97c36de58379cb

                                                                                                                            SHA256

                                                                                                                            f2da17e28e9d2a6a6bb1fb94147b9718649c00ef32244225ec3c401b924bed74

                                                                                                                            SHA512

                                                                                                                            c9b163ab69c38ac4b9c9d1f0b15a7f989497a4f5bd69417d11849fb5ce94a86e5d468087725f655e8c03406ea6ad6366181dedd7595170371d07fd352e3d4778

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\grandUIA5yzqZi02IJtBw\information.txt

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            MD5

                                                                                                                            ea782c31dd81b3db45a4888fe31c3393

                                                                                                                            SHA1

                                                                                                                            1c12e7df01933caf3f15de29023ae74689d10623

                                                                                                                            SHA256

                                                                                                                            81be61dca23447b9a0c5ff85fc72635826700220fc5c16d99ab7141c36552d1d

                                                                                                                            SHA512

                                                                                                                            7b7c9d26b17f26f0c38d5a60fa3a7e5a7826d1066499c8b3e4e87edc8eeedffa28aaa155e6d4146e98dc73b96afd623d4e413307694caf898c425a7c6c164c45

                                                                                                                          • C:\Users\Admin\AppData\Local\dd8032d2-9f19-4b6f-908f-0ed659910701\D66D.exe

                                                                                                                            Filesize

                                                                                                                            377KB

                                                                                                                            MD5

                                                                                                                            38896a361ade17512c264b1608c721cf

                                                                                                                            SHA1

                                                                                                                            40ac678d12fbee6fc5750b83c1d9d56e17763fea

                                                                                                                            SHA256

                                                                                                                            f5ee18d20a089d206f28a6aebde1f010c569242fcc708e6eeb77f0db5fc53bce

                                                                                                                            SHA512

                                                                                                                            54782549b707a6c9889dc1ffad8a6f654b942fe9c7b0fdd1d6e64c8b2278511675e0000e7c43602e4bdf005ee118787fb72a49458070da24352dd48b53a0ec3b

                                                                                                                          • memory/740-54-0x00000000026F0000-0x000000000280B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.1MB

                                                                                                                          • memory/740-51-0x0000000002650000-0x00000000026E4000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            592KB

                                                                                                                          • memory/808-122-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-2194-0x000001CB78B50000-0x000001CB78B60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/808-80-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-84-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-87-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-70-0x00007FFEBE6D0000-0x00007FFEBF191000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            10.8MB

                                                                                                                          • memory/808-90-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-76-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-69-0x000001CB5E2F0000-0x000001CB5E42A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-101-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-104-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-106-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-71-0x000001CB60160000-0x000001CB60290000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-97-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-108-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-75-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-110-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-114-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-116-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-118-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-112-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-120-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-126-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-128-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-124-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-130-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-78-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-93-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/808-1965-0x00007FFEBE6D0000-0x00007FFEBF191000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            10.8MB

                                                                                                                          • memory/808-82-0x000001CB60160000-0x000001CB6028A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/2020-3-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            36KB

                                                                                                                          • memory/2020-4-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            36KB

                                                                                                                          • memory/2020-6-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            36KB

                                                                                                                          • memory/2152-2-0x0000000000B00000-0x0000000000B09000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            36KB

                                                                                                                          • memory/2152-1-0x0000000000B10000-0x0000000000C10000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/2416-183-0x0000000000400000-0x0000000000875000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4.5MB

                                                                                                                          • memory/2416-186-0x0000000005000000-0x0000000005010000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/2416-181-0x00000000024D0000-0x000000000251F000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            316KB

                                                                                                                          • memory/2416-189-0x0000000005000000-0x0000000005010000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/2416-196-0x0000000075040000-0x00000000757F0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            7.7MB

                                                                                                                          • memory/2416-177-0x0000000002A10000-0x0000000002A5A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            296KB

                                                                                                                          • memory/2416-178-0x0000000000B30000-0x0000000000C30000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/2416-171-0x0000000002870000-0x00000000028BC000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            304KB

                                                                                                                          • memory/3288-5-0x00000000009C0000-0x00000000009D6000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            88KB

                                                                                                                          • memory/4388-89-0x0000000002400000-0x000000000249E000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            632KB

                                                                                                                          • memory/4756-29-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-36-0x0000000000D30000-0x00000000016EC000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            9.7MB

                                                                                                                          • memory/4756-141-0x0000000008C60000-0x0000000008CC6000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            408KB

                                                                                                                          • memory/4756-173-0x0000000000D30000-0x00000000016EC000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            9.7MB

                                                                                                                          • memory/4756-1801-0x0000000000D30000-0x00000000016EC000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            9.7MB

                                                                                                                          • memory/4756-44-0x00000000083E0000-0x000000000842C000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            304KB

                                                                                                                          • memory/4756-43-0x00000000083A0000-0x00000000083DC000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            240KB

                                                                                                                          • memory/4756-42-0x0000000008340000-0x0000000008352000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                          • memory/4756-41-0x0000000008A40000-0x0000000008B4A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.0MB

                                                                                                                          • memory/4756-519-0x000000000A780000-0x000000000A942000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.8MB

                                                                                                                          • memory/4756-526-0x000000000AE80000-0x000000000B3AC000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.2MB

                                                                                                                          • memory/4756-40-0x0000000009060000-0x0000000009678000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            6.1MB

                                                                                                                          • memory/4756-39-0x0000000008110000-0x000000000811A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            40KB

                                                                                                                          • memory/4756-38-0x0000000007F80000-0x0000000008012000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            584KB

                                                                                                                          • memory/4756-37-0x0000000008490000-0x0000000008A34000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.6MB

                                                                                                                          • memory/4756-1787-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-643-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-199-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-25-0x0000000000D30000-0x00000000016EC000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            9.7MB

                                                                                                                          • memory/4756-26-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-1466-0x000000000A0D0000-0x000000000A120000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            320KB

                                                                                                                          • memory/4756-27-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-662-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-665-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-1053-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-28-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-30-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-31-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-33-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-175-0x0000000075C70000-0x0000000075D60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            960KB

                                                                                                                          • memory/4756-32-0x0000000077B54000-0x0000000077B56000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            8KB

                                                                                                                          • memory/4764-53-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/4764-56-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/4764-55-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/4764-73-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/4764-50-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/5048-98-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/5048-102-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/5048-96-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/6260-651-0x0000000004B60000-0x0000000004B70000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/6260-641-0x0000000004990000-0x00000000049AA000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            104KB

                                                                                                                          • memory/6260-634-0x00000000021C0000-0x00000000021DC000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            112KB

                                                                                                                          • memory/6260-648-0x0000000075040000-0x00000000757F0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            7.7MB

                                                                                                                          • memory/6260-659-0x0000000004B60000-0x0000000004B70000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/6260-656-0x0000000004B60000-0x0000000004B70000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/6260-1260-0x0000000075040000-0x00000000757F0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            7.7MB

                                                                                                                          • memory/6508-1280-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            44KB

                                                                                                                          • memory/6508-1489-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            44KB

                                                                                                                          • memory/7128-1539-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.0MB

                                                                                                                          • memory/7128-1528-0x0000000002660000-0x00000000027F5000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.6MB

                                                                                                                          • memory/7128-1525-0x0000000002580000-0x0000000002659000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            868KB

                                                                                                                          • memory/7128-2173-0x0000000000400000-0x000000000090C000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.0MB