Analysis

  • max time kernel
    74s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2023 08:13

General

  • Target

    61fbb8ca397b6e2b365f73b5e02bfd33.exe

  • Size

    1.6MB

  • MD5

    61fbb8ca397b6e2b365f73b5e02bfd33

  • SHA1

    2db923d7a49b02847c02b4e18abcafb1aef211c2

  • SHA256

    b90fc851dee3bbb480aac668be792e552bde6c4571ec9f1847da7da7f964a24f

  • SHA512

    53a8f1f225e3a00dba13c828f08fc25e0d9a3331b2670627ffcd720bcfbedba812e218975c9b26873564d1895ee75a84a449ebf683f0e54221111ce3a7f16e95

  • SSDEEP

    24576:uyjDa6l2LNi4kd652rbkYZGlioWX5EPZfQ6F9NOkfMhJIjQD2xA1E00IyS5C:9ftELo4D52sx0oWXiPZfQUbfMXJ5H0

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

http://ratefacilityframw.fun/api

Signatures

  • Detect Lumma Stealer payload V4 2 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61fbb8ca397b6e2b365f73b5e02bfd33.exe
    "C:\Users\Admin\AppData\Local\Temp\61fbb8ca397b6e2b365f73b5e02bfd33.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xz7Lf39.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xz7Lf39.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4604
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hT2mH85.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hT2mH85.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1140
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1WA80NY9.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1WA80NY9.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4904
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1856
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe333946f8,0x7ffe33394708,0x7ffe33394718
              6⤵
                PID:5012
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,7738148911162619931,488134497313822651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5568
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,7738148911162619931,488134497313822651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                6⤵
                  PID:5560
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4328
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x144,0x170,0x7ffe333946f8,0x7ffe33394708,0x7ffe33394718
                  6⤵
                    PID:4488
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11340204228833507350,14732871776566884859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5596
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11340204228833507350,14732871776566884859,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
                    6⤵
                      PID:5588
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:564
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe333946f8,0x7ffe33394708,0x7ffe33394718
                      6⤵
                        PID:4420
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,8636747028844737434,17468079329149350900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:6400
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2184
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe333946f8,0x7ffe33394708,0x7ffe33394718
                        6⤵
                          PID:4680
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,4090750989749157735,17039325653095834365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
                          6⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5752
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,4090750989749157735,17039325653095834365,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
                          6⤵
                            PID:5656
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1300
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x104,0x16c,0x7ffe333946f8,0x7ffe33394708,0x7ffe33394718
                            6⤵
                              PID:4624
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,7515213910588063209,2970197797114841526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5712
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7515213910588063209,2970197797114841526,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
                              6⤵
                                PID:5704
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                              5⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1536
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe333946f8,0x7ffe33394708,0x7ffe33394718
                                6⤵
                                  PID:2036
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,8400132546858761038,12266781470909506734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
                                  6⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5648
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,8400132546858761038,12266781470909506734,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
                                  6⤵
                                    PID:5636
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                  5⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1908
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe333946f8,0x7ffe33394708,0x7ffe33394718
                                    6⤵
                                      PID:4896
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,11916252528144522516,11590777651012004321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5628
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,11916252528144522516,11590777651012004321,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
                                      6⤵
                                        PID:5620
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                      5⤵
                                      • Enumerates system info in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of WriteProcessMemory
                                      PID:4024
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe333946f8,0x7ffe33394708,0x7ffe33394718
                                        6⤵
                                          PID:5032
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
                                          6⤵
                                            PID:5484
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
                                            6⤵
                                              PID:5732
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
                                              6⤵
                                                PID:5156
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                                                6⤵
                                                  PID:5140
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                                                  6⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5604
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
                                                  6⤵
                                                    PID:6684
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
                                                    6⤵
                                                      PID:6580
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
                                                      6⤵
                                                        PID:5248
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
                                                        6⤵
                                                          PID:6640
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
                                                          6⤵
                                                            PID:6356
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                                                            6⤵
                                                              PID:6700
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
                                                              6⤵
                                                                PID:6888
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                                                                6⤵
                                                                  PID:6008
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
                                                                  6⤵
                                                                    PID:7384
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
                                                                    6⤵
                                                                      PID:7404
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
                                                                      6⤵
                                                                        PID:8168
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
                                                                        6⤵
                                                                          PID:8176
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7244 /prefetch:8
                                                                          6⤵
                                                                            PID:7684
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7244 /prefetch:8
                                                                            6⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:7708
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
                                                                            6⤵
                                                                              PID:2280
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
                                                                              6⤵
                                                                                PID:6764
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
                                                                                6⤵
                                                                                  PID:5068
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
                                                                                  6⤵
                                                                                    PID:1188
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6812 /prefetch:8
                                                                                    6⤵
                                                                                      PID:6256
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7852 /prefetch:8
                                                                                      6⤵
                                                                                        PID:5496
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
                                                                                        6⤵
                                                                                          PID:5920
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,318837759024575808,4600722235032665671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
                                                                                          6⤵
                                                                                            PID:5508
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3920
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe333946f8,0x7ffe33394708,0x7ffe33394718
                                                                                            6⤵
                                                                                              PID:1616
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,12449972850019948592,8090981209045254864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
                                                                                              6⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:5516
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12449972850019948592,8090981209045254864,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
                                                                                              6⤵
                                                                                                PID:5492
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2YV6151.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2YV6151.exe
                                                                                            4⤵
                                                                                            • Modifies Windows Defender Real-time Protection settings
                                                                                            • Executes dropped EXE
                                                                                            • Windows security modification
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:2392
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3yp67Lo.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3yp67Lo.exe
                                                                                          3⤵
                                                                                          • Drops startup file
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Accesses Microsoft Outlook profiles
                                                                                          • Adds Run key to start application
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • outlook_office_path
                                                                                          • outlook_win_path
                                                                                          PID:7972
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                            4⤵
                                                                                              PID:6892
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                                5⤵
                                                                                                • Creates scheduled task(s)
                                                                                                PID:4060
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                              4⤵
                                                                                                PID:7268
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                  5⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:5924
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7972 -s 3068
                                                                                                4⤵
                                                                                                • Program crash
                                                                                                PID:2728
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Mx8pQ9.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Mx8pQ9.exe
                                                                                            2⤵
                                                                                              PID:5876
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:5388
                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                              1⤵
                                                                                                PID:6828
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 7972 -ip 7972
                                                                                                1⤵
                                                                                                  PID:3220
                                                                                                • C:\Users\Admin\AppData\Local\Temp\F121.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\F121.exe
                                                                                                  1⤵
                                                                                                    PID:5268
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 836
                                                                                                      2⤵
                                                                                                      • Program crash
                                                                                                      PID:6352
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\F681.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\F681.exe
                                                                                                    1⤵
                                                                                                      PID:6196
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5268 -ip 5268
                                                                                                      1⤵
                                                                                                        PID:7156

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                        Filesize

                                                                                                        152B

                                                                                                        MD5

                                                                                                        b810b01c5f47e2b44bbdd46d6b9571de

                                                                                                        SHA1

                                                                                                        8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc

                                                                                                        SHA256

                                                                                                        d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45

                                                                                                        SHA512

                                                                                                        6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                        Filesize

                                                                                                        152B

                                                                                                        MD5

                                                                                                        efc9c7501d0a6db520763baad1e05ce8

                                                                                                        SHA1

                                                                                                        60b5e190124b54ff7234bb2e36071d9c8db8545f

                                                                                                        SHA256

                                                                                                        7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                                                                                        SHA512

                                                                                                        bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\92bae438-2c38-41c6-b014-122061a88257.tmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                        MD5

                                                                                                        666adbac63854c882ac3f716c8b4c3f9

                                                                                                        SHA1

                                                                                                        1f3ab24bbf9c8afb28b31fb8b03af97798e398e5

                                                                                                        SHA256

                                                                                                        6a60c0516c659771e0587d94898d3b72a83400d82c77eebc2f950136f11991e3

                                                                                                        SHA512

                                                                                                        92ce433538c35e99ea4d7f047bdf447bc910dd1057d7cdb45d46d5bb2e77fb632bbcae778158633f657a0dce95163b35ca33d41e9a7dd415fdbb6f41008819f0

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

                                                                                                        Filesize

                                                                                                        201KB

                                                                                                        MD5

                                                                                                        e3038f6bc551682771347013cf7e4e4f

                                                                                                        SHA1

                                                                                                        f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                                                        SHA256

                                                                                                        6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                                                        SHA512

                                                                                                        4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\CURRENT

                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        46295cac801e5d4857d09837238a6394

                                                                                                        SHA1

                                                                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                        SHA256

                                                                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                        SHA512

                                                                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                        Filesize

                                                                                                        23B

                                                                                                        MD5

                                                                                                        3fd11ff447c1ee23538dc4d9724427a3

                                                                                                        SHA1

                                                                                                        1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                        SHA256

                                                                                                        720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                        SHA512

                                                                                                        10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                        Filesize

                                                                                                        111B

                                                                                                        MD5

                                                                                                        285252a2f6327d41eab203dc2f402c67

                                                                                                        SHA1

                                                                                                        acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                        SHA256

                                                                                                        5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                        SHA512

                                                                                                        11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        5KB

                                                                                                        MD5

                                                                                                        70ccc788a213af48826faa4be5673972

                                                                                                        SHA1

                                                                                                        e1274bd4e786f45d2e7c8ccfe26d030cb5049c30

                                                                                                        SHA256

                                                                                                        6ea1dd9b5c6b193549a966b7cf05ed07e71c6ef0f79177bfd11b6deab32e15b4

                                                                                                        SHA512

                                                                                                        5487b8228bfcb44bb91429534bb67b82a1b517c1cc879de816773690e126758de73d2151258351d56cc96db975af475b48e5684d4810833ddfe032f189295943

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                        MD5

                                                                                                        c148a384c07b8ed13a6ba4c6dab41f4a

                                                                                                        SHA1

                                                                                                        20a4a4d8ba87fed32ec76e50ec5682f240ecf7ae

                                                                                                        SHA256

                                                                                                        ca1163a42064f4af5ea14c40d43fe22a3ad782011698d57a31b5f86644d3957f

                                                                                                        SHA512

                                                                                                        84cf436686fa7bb375f3da32d7bf938b52efb94bc11f4f8ec54a895008baf258c4d252d1905d4f287523db7833ce832c30a57c8b391dff73f34dd470e521c1df

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                        Filesize

                                                                                                        24KB

                                                                                                        MD5

                                                                                                        121510c1483c9de9fdb590c20526ec0a

                                                                                                        SHA1

                                                                                                        96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                                                                                        SHA256

                                                                                                        cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                                                                                        SHA512

                                                                                                        b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        71246cca27056c62d7814256239338d6

                                                                                                        SHA1

                                                                                                        5fbdbd3bc08f345d40764a9c2443853609c2055c

                                                                                                        SHA256

                                                                                                        85b34db42ff9d1e7ceea0db81685e9bb5934eea43f26d539c0d14db7cea3f1b0

                                                                                                        SHA512

                                                                                                        7eb51d98b870317fe15aaebf7f982666a58356efba59107eafb392a9ab378e251a2371d57ba00d2ff3585b3e40a18e1325b9f3626f900df4ea47295676bbc8a5

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                        Filesize

                                                                                                        3KB

                                                                                                        MD5

                                                                                                        41bf9f941024593b9587c91ce47a05dd

                                                                                                        SHA1

                                                                                                        d8e7d90075edac083f1b7c5fd27dc32a54f12393

                                                                                                        SHA256

                                                                                                        d32489326250f6dac5c8a8b9dfbbc30ff6c3d67f39591f23a12de427a802c4dc

                                                                                                        SHA512

                                                                                                        64df7d532ef0080914c82e46fe2055ed7f1c6f0bda9e80ab6fb128b254acaa65a693214822669da6d11112c9b741b833df0f5f19986c1bc150cafa7a74e07017

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        c2765af2780aabc2826b8a020b162aaa

                                                                                                        SHA1

                                                                                                        93a6fcb4d7a37823810151cb5861a17a89fb60fb

                                                                                                        SHA256

                                                                                                        16a1d4ce8ea270ddfc902b682d89887eb264ff32219eccf880136f0efe32203d

                                                                                                        SHA512

                                                                                                        f3441bdf3ee5aa2d95371a4af332b6e5576d12028722a0fc8ab95239f4e04a8a0440bd270dba0ff4c49ea3a2fb7a377489dded2d5b83fe877da2db68dbfe540f

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        863427a34401ab83ccdfcb606ae4c154

                                                                                                        SHA1

                                                                                                        dfb8cf0afc4331c8aefba6ba3cd4af771d88a0ca

                                                                                                        SHA256

                                                                                                        b783f94b19759fbfc6ea944b8ec5de990ec6e33750a1bf55aa1fc90e8db34922

                                                                                                        SHA512

                                                                                                        71a414a9dcf5bde716b3dcab74239af3640cb9a17cb5ac0beabdaafebc2f6bf5e7732727d1597ecec1acd696d99281fde4fa39497be39cc2bc388f5be275717d

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586637.TMP

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        c2e0b668cc655895feb4f35d724a2685

                                                                                                        SHA1

                                                                                                        47f60b224221eb57b526f840590d047b4cf0d45d

                                                                                                        SHA256

                                                                                                        326364b34c69dba1f89c70eff35a6a1689939f51a697f89c1807f4024b38f231

                                                                                                        SHA512

                                                                                                        bc4cfb144c7c5a3954bf621c953d2ec5dc1d755290c7415dc01e7424852b7111d258aab3865b96b09c2d216a5bd9d5e98851abc730a19f559d436ac0237313d7

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                                                        SHA1

                                                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                        SHA256

                                                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                        SHA512

                                                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        a52a2cb14a06147c261153d60780e2ab

                                                                                                        SHA1

                                                                                                        7e8b918df143c2a3407a6c1fafa19920ca7e09d0

                                                                                                        SHA256

                                                                                                        0985a973ded289953311726dc7c4adbb25db676c2812509b57a2cc4d86e4745a

                                                                                                        SHA512

                                                                                                        3600f6029e741f7822c0495c470eb3c810973129d9300dacb1a9288252db4b570cbd501615aa5b5d8548e3cd5fe19f79075163fd0e4531361a13bc112d3368d5

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        a28c024a858b7b6f97adf34f84500b0a

                                                                                                        SHA1

                                                                                                        b6ee72343cb815e37416ea27f0e557f63381806f

                                                                                                        SHA256

                                                                                                        c78f81e3a0bf901158aa5faf7e7336ae46afedde9391a980b4e8063919818b57

                                                                                                        SHA512

                                                                                                        ca9d104f5ca0b40b0961dca4e1b2b1fd2e6273afaa07152a612b3875df9d381c9d1b1203b20e0756ac0db58ae36cbac2a939b785e2868992d56a7e7b1bc66b44

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        9db7cffc04f7a05a9d996a1d99877ff0

                                                                                                        SHA1

                                                                                                        d6fa3a1cd27fb846b702cc951c477861663d4fd5

                                                                                                        SHA256

                                                                                                        a877890f67ba51185fb7a5fee2d86d3e827309d7416c5742705f42d9b61d9ac7

                                                                                                        SHA512

                                                                                                        2caf52ebc8c551e28c71022d7bb86d77e464ebdefe81bec653e3b4bc3ede9c35c84f40fcbc58c8827ab34ec2f649785a24104972803e8c608459d67e5d7eb34f

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        9419cd5cc72f0038617758032744a5b8

                                                                                                        SHA1

                                                                                                        2d553de1d61ceacdf2e3d641c8f7ea0e5b08f7cb

                                                                                                        SHA256

                                                                                                        760b13030ed4b9f2945f31dfbda13c4c5a4aaf457cd7abbf39dc695a6dbd28ce

                                                                                                        SHA512

                                                                                                        da03c0d27449e157ca49cc03afc2a84127e2fbe393c1fa870ecab7739cd47be0de05a5233f8614c3f15a3c8e23f813cb34b9b07df5ae918de0af32624820435e

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        10KB

                                                                                                        MD5

                                                                                                        abeb67acaf740b16ebcddb78be4b88e9

                                                                                                        SHA1

                                                                                                        7b0553a62c407cfe554f61a98d54fcfd240dc80e

                                                                                                        SHA256

                                                                                                        9cab772230135a9d9176463d1f27439d01ec74e2f8346b600aaa508a2da04a19

                                                                                                        SHA512

                                                                                                        0bce2a725bc034ff1ba34c19e980dd4f4d89225a42840fe75999d645e682c0a33335aab1389920ff9c8edb79e1540275962bb0e49cc07dfcee096c8a30a3878e

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        47a6d0961a38ac38f10f6d90862153d6

                                                                                                        SHA1

                                                                                                        c3f35a6ee451231fce6acc49f8c3916e6d97b76a

                                                                                                        SHA256

                                                                                                        28542c453a8fb114af20fbb02f55c9dc9b6e903df60eb4df9c49717ceb643b9b

                                                                                                        SHA512

                                                                                                        5a89151d1023478606128d166f78b2b412055893d372394673619556f1a56a4d1d3b379f05ac26bb47bbe3a420e084c2dc3a4e639e1588b7a35789c16fe1b8a2

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        b42902d558531a999ff0ce44eeb1f6f3

                                                                                                        SHA1

                                                                                                        588b1dfec2d93c89a028f3c7d53319d05e740117

                                                                                                        SHA256

                                                                                                        7257a760069d6a8b1f84f8dde49594d5b055c5060bb836f5c964827597672bf8

                                                                                                        SHA512

                                                                                                        67348dec317611c17a385f4a527c8223b4b3bccfa159bbf637d5f03873a4dedfc03ec8ccce3044cb94bf2259dd4548d7eb47405b5a3a0a0ee64bfb497670d980

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                        Filesize

                                                                                                        802KB

                                                                                                        MD5

                                                                                                        4ef83bf51ae6dd5861d78e56dd25ce42

                                                                                                        SHA1

                                                                                                        14b619f8a1e8fda9062f0ecdaaf37d12e5be9fd0

                                                                                                        SHA256

                                                                                                        25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea

                                                                                                        SHA512

                                                                                                        c14dec81372cc9f93e13237e79dfdfafd3971a2250b23843f67012672301744bf21f1a1a23ae182acc37d73ba66fce8bfba6e9bc2871172f06bc078bd486e4b1

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xz7Lf39.exe

                                                                                                        Filesize

                                                                                                        1.5MB

                                                                                                        MD5

                                                                                                        e04d55baccfb24d3f4a91624d911f1e7

                                                                                                        SHA1

                                                                                                        c8112a73dc177e624f761e3f54e978855d640a79

                                                                                                        SHA256

                                                                                                        f93f00d4f7780b2bd6db01fcbcea36b20ff6c13213bad8f6c9199a99d491be91

                                                                                                        SHA512

                                                                                                        e22c7269ccb1617b4fe63129d8bd17858ee17666ec4b4619905e30c9007b477e81bb58f175070afa12f93fd73bf0ccedc09bec512da29e4d76266f5571c88981

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hT2mH85.exe

                                                                                                        Filesize

                                                                                                        1.1MB

                                                                                                        MD5

                                                                                                        f76baf86af41374e5a4563bc317bad47

                                                                                                        SHA1

                                                                                                        6df4f363cd054ad62877c9cd84180b8cbe653a2d

                                                                                                        SHA256

                                                                                                        99e55792e438c2d6dbccde384e31df5d50d5cc36bac5e4e169eecba3e4915f69

                                                                                                        SHA512

                                                                                                        653aa201d71fb5a815c07562a74bc1af5e24652b89f89fd6e3b3fb70397da161ab1e36132694e49dbfbde28bc5f663cf73b0452e85aaf883ee6e78ddd94f44d3

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1WA80NY9.exe

                                                                                                        Filesize

                                                                                                        895KB

                                                                                                        MD5

                                                                                                        f71265c06e705ca12a84836a18a8041b

                                                                                                        SHA1

                                                                                                        2e3aa98a4ec89d0450752379e8475be5e3cc50a4

                                                                                                        SHA256

                                                                                                        b2f34a645841686f4f58fe193cdaaa02cbe4a31d7d78f4a8a9892356634118a1

                                                                                                        SHA512

                                                                                                        d3925cddbb0bceaaef3317125d146cca602072df4afea38460f5954b18079c959b3b28af66c0033c41278cff1c8569b4ee7fd741350042b6a949fb1e2316b15a

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2YV6151.exe

                                                                                                        Filesize

                                                                                                        603KB

                                                                                                        MD5

                                                                                                        09ad33bc3340bb460945f52fc64d8104

                                                                                                        SHA1

                                                                                                        8961fb7b80dd09fb1f7936e1a488340076d241b3

                                                                                                        SHA256

                                                                                                        a3cf01cc1676f1ed1b8c99e0fec006243eee183afbf9f9d798e4730fa7eac4e5

                                                                                                        SHA512

                                                                                                        2c39399642bd76f6912a57b7ab743752bb678eb8a85e8f53499403818984c3c750e4dedeb13ea179076211a351a74f5f3656003b928cdcbf2917f4fe0a1079b7

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tempAVSv8K0e21AFhn7\6eZIJt8aUD3BWeb Data

                                                                                                        Filesize

                                                                                                        92KB

                                                                                                        MD5

                                                                                                        ec564f686dd52169ab5b8535e03bb579

                                                                                                        SHA1

                                                                                                        08563d6c547475d11edae5fd437f76007889275a

                                                                                                        SHA256

                                                                                                        43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

                                                                                                        SHA512

                                                                                                        aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tempAVSv8K0e21AFhn7\VK9dufnU58JyWeb Data

                                                                                                        Filesize

                                                                                                        116KB

                                                                                                        MD5

                                                                                                        f70aa3fa04f0536280f872ad17973c3d

                                                                                                        SHA1

                                                                                                        50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                        SHA256

                                                                                                        8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                        SHA512

                                                                                                        30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                      • \??\pipe\LOCAL\crashpad_3920_HQQLKNHJFTDKNWVI

                                                                                                        MD5

                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                        SHA1

                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                        SHA256

                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                        SHA512

                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                      • memory/2392-138-0x0000000000400000-0x00000000007A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.6MB

                                                                                                      • memory/2392-75-0x0000000000400000-0x00000000007A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.6MB

                                                                                                      • memory/2392-500-0x0000000000400000-0x00000000007A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.6MB

                                                                                                      • memory/2392-141-0x0000000000400000-0x00000000007A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.6MB

                                                                                                      • memory/3520-815-0x00000000026F0000-0x0000000002706000-memory.dmp

                                                                                                        Filesize

                                                                                                        88KB

                                                                                                      • memory/5268-1009-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                      • memory/5268-1008-0x00000000024B0000-0x000000000252C000-memory.dmp

                                                                                                        Filesize

                                                                                                        496KB

                                                                                                      • memory/5268-1007-0x00000000009D0000-0x0000000000AD0000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/5876-817-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                        Filesize

                                                                                                        40KB

                                                                                                      • memory/5876-768-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                        Filesize

                                                                                                        40KB

                                                                                                      • memory/6196-1029-0x0000000007D50000-0x0000000007D5A000-memory.dmp

                                                                                                        Filesize

                                                                                                        40KB

                                                                                                      • memory/6196-1028-0x0000000008060000-0x0000000008070000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/6196-1023-0x0000000007DE0000-0x0000000007E72000-memory.dmp

                                                                                                        Filesize

                                                                                                        584KB

                                                                                                      • memory/6196-1022-0x00000000082F0000-0x0000000008894000-memory.dmp

                                                                                                        Filesize

                                                                                                        5.6MB

                                                                                                      • memory/6196-1016-0x0000000000F80000-0x0000000000FBC000-memory.dmp

                                                                                                        Filesize

                                                                                                        240KB

                                                                                                      • memory/6196-1017-0x0000000073FD0000-0x0000000074780000-memory.dmp

                                                                                                        Filesize

                                                                                                        7.7MB

                                                                                                      • memory/7972-647-0x0000000004F70000-0x0000000004FD6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/7972-572-0x00000000089E0000-0x0000000008D34000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/7972-534-0x0000000007390000-0x00000000073A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/7972-504-0x0000000073CE0000-0x0000000074490000-memory.dmp

                                                                                                        Filesize

                                                                                                        7.7MB

                                                                                                      • memory/7972-570-0x0000000008500000-0x000000000851E000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/7972-519-0x00000000073A0000-0x0000000007416000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/7972-503-0x00000000005D0000-0x000000000069E000-memory.dmp

                                                                                                        Filesize

                                                                                                        824KB

                                                                                                      • memory/7972-766-0x0000000073CE0000-0x0000000074490000-memory.dmp

                                                                                                        Filesize

                                                                                                        7.7MB